Is Microsoft Clarity Free and Privacy Compliant?

Updated

Microsoft Clarity is described on its own site as permanently free, and the same page states it is GDPR and CCPA ready. Those two claims answer the headline question, but they answer it at different levels of confidence. "Permanently free" is a product commitment you can verify on the pricing page. "GDPR and CCPA ready" is a vendor statement about its own posture — it tells you Clarity is built with those regimes in mind, not that your specific deployment is automatically compliant. If you are evaluating Clarity for a site that handles personal data, treat the free part as settled and the compliance part as something you still need to confirm against your own obligations.

What "free" actually covers

The homepage states Clarity is permanently free, and a dedicated pricing page exists at clarity.microsoft.com/pricing if you want to confirm current terms before committing. The page evidence does not list paid tiers, usage caps, or payment platforms, so the supported reading is simply: the product is presented as free, with no pricing detail beyond that in the material available.

Two practical notes:

  • Free does not mean unlimited in every dimension. The evidence does not specify traffic limits or retention windows, so check the pricing page directly if those matter to you.
  • Free does not mean no login. The site offers a live demo, but using Clarity on your own site implies an account and a tracking setup. Nothing in the evidence says otherwise.

What Clarity does with user behavior

Understanding the compliance question requires knowing what data the tool touches. Clarity is a user behavior analytics tool built around:

Capability What it captures
Session recordings Real user sessions, with Highlights marking key moments in each journey
Heatmaps Where users click, scroll, and place attention
AI summaries Automated takeaways on where users struggle and what to prioritize
AI chat Natural-language questions answered from your data
AI visibility When your content is cited by AI, which queries trigger it, and which AI bots crawl your site
Brand agents AI assistants that guide shoppers using real-time behavioral signals

Session recordings and heatmaps are the features most relevant to privacy review, because they reconstruct individual user journeys rather than aggregate counts. That is exactly why the GDPR/CCPA framing matters.

Reading the compliance claim correctly

"GDPR and CCPA ready" is a statement about the tool's design and the vendor's readiness to support those frameworks. It is not a certification, and it does not transfer your obligations to Microsoft. Under both regimes, the site operator remains the party responsible for lawful basis, notices, and honoring user rights.

A workable way to think about it:

  • Clarity provides the mechanism. The site presents itself as prepared for GDPR and CCPA, which typically means features like consent handling and data controls exist to support compliance.
  • You provide the context. Whether recordings are lawful on your site depends on your consent banner, your privacy notice, and what you actually record.
  • The gap is yours to close. If your legal or privacy team needs specifics — data retention, IP handling, sub-processors — those belong in a review of Clarity's own documentation, not in the marketing claim.

A concrete evaluation path

If you are deciding whether to deploy Clarity, this sequence keeps the decision grounded:

  1. Confirm the cost claim. Open clarity.microsoft.com/pricing and check the current terms rather than relying on the homepage line.
  2. Map what you would record. Decide whether session recordings are appropriate for every page, or whether some flows (checkout, account, health-related forms) should be excluded.
  3. Check your consent flow. If you operate under GDPR, recordings generally need to align with the consent you collect. Confirm your banner covers behavioral recording, not just cookies.
  4. Review the data path. Identify who can access recordings inside your organization and how long they are retained.
  5. Run a limited pilot. Start on a low-risk section of the site, verify the data looks as expected, then expand.

Where the evidence stops

The material available supports two claims: permanently free, and GDPR/CCPA ready. It does not provide retention periods, data residency, sub-processor lists, or a signed data processing agreement. It also does not state that Clarity is free of all limits or that no account is required.

For a personal project or a marketing site with light personal data, those gaps are usually minor. For a regulated business, they are the questions to raise with Clarity directly and with your own privacy counsel before you turn recordings on.