Microsoft Clarity, HIPAA, GDPR and your data
If you searched this, you have a specific worry and the results are mostly forum threads with no accepted answer. So here is what Microsoft actually publishes about Clarity and your visitors' data, quoted, with a link to each source, including what the data is used for, in Microsoft's words.
Nobody needs a lawyer's reading to get here, because Microsoft's own documents settle it in three sentences, all from the terms of use:
"You will not use the Offering in connection with content which may contain sensitive user materials, such as health care, financial services or government-related information."source
"You and Microsoft are independent Controllers of the Personal Data Processed in connection with the Offering. The parties agree that neither of them are a "processor," "service provider," or equivalent status." A Business Associate Agreement covers a vendor that handles health information on your behalf. The terms say Microsoft is not acting on your behalf.source
"You will not knowingly disclose Personal Data that includes Sensitive Data to Microsoft." Health information is the plainest case of sensitive data.source
Put together: Clarity's terms tell you not to install it on health care content, and they make Microsoft an independent controller rather than a vendor working on your behalf, which is the relationship a HIPAA contract would need. A healthcare, financial or government site that installs Clarity anyway is outside Microsoft's terms, and that is before any compliance question is asked. For what Harvv does differently, see the last section; the short version is that we never take the data in the first place.
"Starting October 31, 2025, Clarity begins enforcing consent signal requirements for page visits originating from the European Economic Area (EEA), United Kingdom (UK), and Switzerland (CH)."source
Consent Mode is on by default for those visitors, and Clarity sets no cookies until it gets a valid consent signal. Passing that signal is your job, Microsoft says, through a supported consent tool or Clarity's Consent API. Clarity is common enough that this is not a niche worry: about four in ten sites in our own sample load it.
Clarity's privacy engineering is good, and better than several tools that charge for it. Personal data is detected and masked in the browser, so by Microsoft's account it never reaches their servers at all. There is IP exclusion, role-based access control, and Do-Not-Track support.
The things worth knowing below are structural rather than sloppy. They follow from what Clarity is: a free product where Microsoft is the controller of the data, not your processor. None of this is hidden. It is just spread across two documentation sites and easy to install without ever reading.
Microsoft says it is "designed to be GDPR ready" and "operates as a data controller". The nine facts below are what that sentence means in practice, each quoted from Microsoft and linked to where it says it.
Both of you, separately. The terms: "You and Microsoft are independent Controllers of the Personal Data Processed in connection with the Offering."
A processor handles data on your instructions. A controller decides for itself. Installing Clarity is closer to introducing your visitors to Microsoft than to hiring a vendor.
Not as your processor. The terms: "neither of them are a "processor," "service provider," or equivalent status under Data Protection Law in connection with the Offering."
The data processing agreement a procurement review asks for (GDPR Article 28) is a contract with a processor, and the terms rule that role out. Until August 2026 the privacy page also said Microsoft could not sign "any additional terms or contracts (e.g., DPAs)"; that line is gone, and the terms now say it more precisely.
No. "You need to delete the entire project to delete user’s data."
A GDPR erasure request for a single visitor cannot be honoured without destroying the entire project’s history. In practice that means it cannot be honoured.
Recordings for 30 days. Favourites and "randomly selected sample of recordings" for up to 9 months.
The 30-day figure is the one usually quoted. The 9-month tail is the one that matters for a retention schedule, and it is a sample you did not choose.
"Clarity data is stored in one of Microsoft’s US data centers." EU customers contract with Microsoft Ireland Operations Limited, which uses standard contractual clauses (SCCs) with Microsoft Corporation in the US.
So the data does go to the US, under SCCs between two Microsoft companies. Microsoft’s FAQ says EU customers "shouldn’t worry" about it. Whether that satisfies your own transfer assessment is your call; there is no EU-region option to pick.
"Any third-party cookies used by Clarity are to support operational purposes like advertising." The visitor opt-out Microsoft points to is the Digital Advertising Alliance’s, at optout.aboutads.info.
The opt-out being an advertising-industry mechanism tells you which category this sits in. That is not a leak or a scandal; it is the arrangement, stated plainly by them.
No. The terms of use: "You will not use the Offering in connection with content which may contain sensitive user materials, such as health care, financial services or government-related information."
This is the sentence behind every "is Clarity HIPAA compliant" thread. It is not a compliance verdict; it is Microsoft telling you not to install it there.
The terms: Microsoft may use personal data "for any purpose in accordance with the Microsoft Privacy Statement, including ... create user profiles for purposes that include advertising", and non-personal data for "training, fine-tuning, and evaluating machine learning models".
That is the price of a free tool, stated by the vendor. Note the split: the AI training clause covers non-personal data; the advertising profiles clause covers personal data.
PII is detected and masked in the browser, so it "never reaches Clarity servers". The mode is one of "relaxed, balanced (default), or strict".
This part is genuinely well built, and better than a lot of paid tools. Worth knowing the default is balanced rather than strict, so the strictest setting is one you opt into.
Not for a site that handles health information. Clarity’s terms of use say you will not use it "in connection with content which may contain sensitive user materials, such as health care, financial services or government-related information". The same terms say Microsoft is an independent controller and not a "processor" or "service provider", so it is not acting on your behalf, which is what a Business Associate Agreement would cover. Those are Microsoft’s words, not a lawyer’s verdict, and they are enough: there is no supported way to run Clarity on a HIPAA site.
Non-personal data, yes, in Microsoft’s own terms: it may use non-personal data collected through Clarity for "training, fine-tuning, and evaluating machine learning models". Personal data may be used "for any purpose in accordance with the Microsoft Privacy Statement", including to "create user profiles for purposes that include advertising". The terms do not say personal data trains AI models, and we do not claim that either. If you need the precise scope in writing, ask clarityms@microsoft.com.
Microsoft says Clarity "is designed to be GDPR ready and operates as a data controller", and processes data in compliance with CCPA. The thing to understand is the controller part: the terms make you and Microsoft independent controllers, neither a processor, so there is no Article 28 processing agreement to sign. EU customers contract with Microsoft Ireland, and data goes to the US under standard contractual clauses. Ready is not the same as compliant-in-the-shape-your-legal-team-expects.
For visitors from the EEA, the UK and Switzerland, yes. Microsoft: "Starting October 31, 2025, Clarity begins enforcing consent signal requirements for page visits originating from the European Economic Area (EEA), United Kingdom (UK), and Switzerland (CH)." Consent Mode is on by default for those visitors, Clarity sets no cookies until it gets a valid consent signal, and Microsoft says the site owner is responsible for passing that signal, through a supported consent tool or Clarity’s Consent API.
DSGVO is the German name for the GDPR, so the GDPR answer applies: Microsoft says Clarity is "designed to be GDPR ready" as a data controller, there is no processing agreement (Auftragsverarbeitungsvertrag) because neither side is a processor, the data is stored in US data centres under standard contractual clauses, and Clarity needs a consent signal before it sets cookies for visitors from Germany and the rest of the EEA. The full answer in German is at harvv.com/de/microsoft-clarity-dsgvo.
No. Microsoft’s FAQ says you must delete the entire project to delete one user’s data. If you receive an erasure request naming one visitor, the only mechanism available destroys everything you have collected for that site.
The same clause that covers health care covers them: Clarity’s terms restrict use with content that may contain "financial services or government-related information". That is Microsoft’s restriction, not our opinion. A bank, a lender, a payments page or a public-sector site is outside what Clarity is offered for.
Not recording. Harvv captures behavioural signals with zero personally identifiable information and no session video, so there is no footage to mask, no erasure request to fulfil against a recording, and nothing to expire. That is a real tradeoff rather than a free win: if you need to watch a specific person’s session, we cannot show you one.
Harvv captures behavioural signals and zero personally identifiable information. No session video, so no footage to mask and no recording to delete. We are not a HIPAA business associate and do not claim to be one; what we offer a regulated site is a pixel that does not take the data. Free for up to 3 sites.
Also: Microsoft Clarity vs Google Analytics · Microsoft Clarity vs Hotjar · Microsoft Clarity und DSGVO (Deutsch) · CIPA lawsuits and session replay · Is Cloudflare Web Analytics accurate? · Shopify bot traffic, measured
