Microsoft Clarity and your data
If you searched this, you have a specific worry and the results are mostly forum threads. So here is what Microsoft actually publishes about Clarity and your visitors' data, quoted, with a link to each source, including the one thing people ask most that we could not source at all.
Clarity's privacy engineering is good, and better than several tools that charge for it. Personal data is detected and masked in the browser, so by Microsoft's account it never reaches their servers at all. There is IP exclusion, role-based access control, and Do-Not-Track support.
The things worth knowing below are structural rather than sloppy. They follow from what Clarity is: a free product where Microsoft is the controller of the data, not your processor. None of this is hidden. It is just spread across two documentation sites and easy to install without ever reading.
Microsoft. Their documentation reads "Clarity is GDPR-compliant as a data controller."
A processor handles data on your instructions. A controller decides for itself. Installing Clarity is closer to introducing your visitors to Microsoft than to hiring a vendor.
No. "We are not able to sign any additional terms or contracts (e.g., DPAs)."
A data processing agreement is the standard instrument for this relationship, and many procurement and security reviews require one. There is no version of Clarity that comes with a signed DPA, at any price, because there is no price.
No. "You need to delete the entire project to delete user’s data."
A GDPR erasure request for a single visitor cannot be honoured without destroying the entire project’s history. In practice that means it cannot be honoured.
Recordings for 30 days. Favourites and "randomly selected sample of recordings" for up to 9 months.
The 30-day figure is the one usually quoted. The 9-month tail is the one that matters for a retention schedule, and it is a sample you did not choose.
"Clarity data is stored in one of Microsoft’s US data centers."
For an EU or UK operator this is a transfer out, and it is not configurable. There is no EU-region option to select.
"Any third-party cookies used by Clarity are to support operational purposes like advertising." The visitor opt-out Microsoft points to is the Digital Advertising Alliance’s, at optout.aboutads.info.
The opt-out being an advertising-industry mechanism tells you which category this sits in. That is not a leak or a scandal; it is the arrangement, stated plainly by them.
PII is detected and masked in the browser, so it "never reaches Clarity servers". The mode is one of "relaxed, balanced (default), or strict".
This part is genuinely well built, and better than a lot of paid tools. Worth knowing the default is balanced rather than strict, so the strictest setting is one you opt into.
We could not find a first-party Microsoft source saying that it does, and we are not going to claim it. The worry is widely repeated, including in Reddit threads that rank on this exact search, but Microsoft’s public statements about not training on customer data concern Microsoft 365, not Clarity specifically. If you need a definitive answer, ask Microsoft directly at clarityms@microsoft.com and get it in writing, because we cannot source it either way.
Microsoft states Clarity is GDPR-compliant as a data controller, and processes data in compliance with CCPA. The thing to understand is the controller part: Microsoft decides how the data is used rather than acting on your instructions, and Microsoft will not sign a DPA. Compliant is not the same as compliant-in-the-shape-your-legal-team-expects.
No. Microsoft’s FAQ says you must delete the entire project to delete one user’s data. If you receive an erasure request naming one visitor, the only mechanism available destroys everything you have collected for that site.
Clarity’s terms restrict use in connection with content that may contain sensitive material such as health care, financial services or government information. That is their restriction, not our opinion, and it is the answer for anyone asking whether Clarity is HIPAA-usable: it is not intended for that content.
Not recording. Harvv captures behavioural signals with zero personally identifiable information and no session video, so there is no footage to mask, no erasure request to fulfil against a recording, and nothing to expire. That is a real tradeoff rather than a free win: if you need to watch a specific person’s session, we cannot show you one.
Harvv captures 50+ behavioural signals and zero personally identifiable information. No session video, so no footage to mask and no recording to delete. Free for one site.