Microsoft Clarity, HIPAA, GDPR and your data
If you searched this, you have a specific worry and the results are mostly forum threads with no accepted answer. So here is what Microsoft actually publishes about Clarity and your visitors' data, quoted, with a link to each source, including what the data is used for, in Microsoft's words.
Nobody needs a lawyer's reading to get here, because Microsoft's own documents settle it in three sentences:
"You will not use the Offering in connection with content which may contain sensitive user materials, such as health care, financial services or government-related information."source
"We are not able to sign any additional terms or contracts (e.g., DPAs)." A Business Associate Agreement, the contract HIPAA requires between a covered entity and a vendor that touches protected health information, is such a contract.source
"Clarity is GDPR-compliant as a data controller." Microsoft decides how the data is used; it does not act on your instructions, which is the relationship a BAA would govern.source
Put together: Clarity's terms tell you not to install it on health care content, and Microsoft will not sign the contract HIPAA would require even if they did. A healthcare, financial or government site that installs Clarity anyway is outside Microsoft's terms, and that is before any compliance question is asked. For what Harvv does differently, see the last section; the short version is that we never take the data in the first place.
Clarity's privacy engineering is good, and better than several tools that charge for it. Personal data is detected and masked in the browser, so by Microsoft's account it never reaches their servers at all. There is IP exclusion, role-based access control, and Do-Not-Track support.
The things worth knowing below are structural rather than sloppy. They follow from what Clarity is: a free product where Microsoft is the controller of the data, not your processor. None of this is hidden. It is just spread across two documentation sites and easy to install without ever reading.
Microsoft says yes, "as a data controller". The nine facts below are what that sentence means in practice, each quoted from Microsoft and linked to where it says it.
Microsoft. Their documentation reads "Clarity is GDPR-compliant as a data controller."
A processor handles data on your instructions. A controller decides for itself. Installing Clarity is closer to introducing your visitors to Microsoft than to hiring a vendor.
No. "We are not able to sign any additional terms or contracts (e.g., DPAs)."
A data processing agreement is the standard instrument for this relationship, and many procurement and security reviews require one. There is no version of Clarity that comes with a signed DPA, at any price, because there is no price.
No. "You need to delete the entire project to delete user’s data."
A GDPR erasure request for a single visitor cannot be honoured without destroying the entire project’s history. In practice that means it cannot be honoured.
Recordings for 30 days. Favourites and "randomly selected sample of recordings" for up to 9 months.
The 30-day figure is the one usually quoted. The 9-month tail is the one that matters for a retention schedule, and it is a sample you did not choose.
"Clarity data is stored in one of Microsoft’s US data centers."
For an EU or UK operator this is a transfer out, and it is not configurable. There is no EU-region option to select.
"Any third-party cookies used by Clarity are to support operational purposes like advertising." The visitor opt-out Microsoft points to is the Digital Advertising Alliance’s, at optout.aboutads.info.
The opt-out being an advertising-industry mechanism tells you which category this sits in. That is not a leak or a scandal; it is the arrangement, stated plainly by them.
No. The terms of use: "You will not use the Offering in connection with content which may contain sensitive user materials, such as health care, financial services or government-related information."
This is the sentence behind every "is Clarity HIPAA compliant" thread. It is not a compliance verdict; it is Microsoft telling you not to install it there.
Microsoft: it "processes a massive amount of anonymous data around user behavior to gain insights and improve machine learning models that power many of our products and services. Clarity is one of the ways Microsoft gathers this important data".
That is the price of a free tool, stated by the vendor. Note the word "anonymous": Microsoft does not say it trains on recordings, and neither do we.
PII is detected and masked in the browser, so it "never reaches Clarity servers". The mode is one of "relaxed, balanced (default), or strict".
This part is genuinely well built, and better than a lot of paid tools. Worth knowing the default is balanced rather than strict, so the strictest setting is one you opt into.
Not for a site that handles health information. Clarity’s terms of use say you will not use it "in connection with content which may contain sensitive user materials, such as health care, financial services or government-related information", and Microsoft’s privacy page says it cannot sign "any additional terms or contracts", which rules out the Business Associate Agreement HIPAA requires. Those are Microsoft’s words, not a lawyer’s verdict, and they are enough: there is no supported way to run Clarity on a HIPAA site.
Microsoft’s own pricing page says it uses the data to improve machine learning models. Its words: Microsoft "processes a massive amount of anonymous data around user behavior to gain insights and improve machine learning models that power many of our products and services. Clarity is one of the ways Microsoft gathers this important data". It says "anonymous" and "machine learning models"; it does not say it trains generative AI on your recordings, and we do not claim that either. If you need the precise scope in writing, ask clarityms@microsoft.com.
Microsoft states Clarity is GDPR-compliant as a data controller, and processes data in compliance with CCPA. The thing to understand is the controller part: Microsoft decides how the data is used rather than acting on your instructions, and Microsoft will not sign a DPA. Compliant is not the same as compliant-in-the-shape-your-legal-team-expects.
No. Microsoft’s FAQ says you must delete the entire project to delete one user’s data. If you receive an erasure request naming one visitor, the only mechanism available destroys everything you have collected for that site.
The same clause that covers health care covers them: Clarity’s terms restrict use with content that may contain "financial services or government-related information". That is Microsoft’s restriction, not our opinion. A bank, a lender, a payments page or a public-sector site is outside what Clarity is offered for.
Not recording. Harvv captures behavioural signals with zero personally identifiable information and no session video, so there is no footage to mask, no erasure request to fulfil against a recording, and nothing to expire. That is a real tradeoff rather than a free win: if you need to watch a specific person’s session, we cannot show you one.
Harvv captures behavioural signals and zero personally identifiable information. No session video, so no footage to mask and no recording to delete. We are not a HIPAA business associate and do not claim to be one; what we offer a regulated site is a pixel that does not take the data. Free for up to 3 sites.
Also: Microsoft Clarity vs Google Analytics · Microsoft Clarity vs Hotjar
