Heatmaps and session recordings: CRO for ecommerce

I opened a client’s session recordings meaning to watch for five minutes and came out forty minutes later. I’d seen people hesitate, go back, abandon the cart. Strong feeling that I’d understood something, zero actions written down. That’s the trap. These tools put you closer to the user than any Analytics table does, and that closeness gets mistaken for evidence almost without you noticing.

What follows is how I use them now, after losing a fair number of afternoons that way. The short position: heatmaps and recordings are qualitative research. They generate hypotheses. They don’t validate anything, and they can’t, because you’re looking at a handful of sessions with no control group. What they do better than any other source is tell you where to look.

In 30 seconds:

• Heatmaps and recordings produce hypotheses, not conclusions. Any sentence that starts with “the data proves” and ends in a recording is badly built.
• Each artefact answers a different question: the scroll map tells you whether your key content sits below the fold, the click map whether an element gets touched, the attention map where time stops.
• Watching ten recordings and concluding something is biased sampling: you chose the filter, and your memory picks the dramatic sessions.
• Always go in with a written question and a time limit. Browsing recordings without a question is entertainment.
• Recording sessions means processing personal data: prior consent, masked form fields, and a defined retention period.

What does a heatmap actually answer, and what doesn’t it?

It answers questions of existence, not of cause. It knows whether an element gets clicks, how far down people get, and where time stops. It doesn’t know why. That looks obvious written down, and half the CRO reports I’ve reviewed still ignore it in the first paragraph.

Microsoft describes the click map as a way to understand the critical content on the page and identify parts of the design users mistake for links. That second half is what’s paid off most for me in ecommerce: people tap product images that don’t zoom, tap the price expecting something, tap trust badges. The same page documents dead clicks, where the click had no effect, and rage clicks, where someone jabbed rapidly at the same small area.

The scroll map covers a different question. Microsoft presents it as a way to determine the ideal page length and see how far your users scroll, adding that it helps you work out whether they see the most important content. It also draws the average fold. On a long product page that’s worth a lot: it tells you if your returns policy sits where a good chunk of people never arrive.

The third one, the attention map, is the most misread. It exists to show which parts of the page users spend the most time on. Time isn’t interest. It can be confusion: I’ve seen hot zones that turned out to be an unreadable size chart on mobile.

Why doesn’t a recording validate a hypothesis?

Because there’s no control group and you picked the sample yourself. Filter for “sessions with a rage click in checkout”, watch eight, and you’ve hand-built a set of extreme cases. You’ll find friction, guaranteed. What you can’t know from there is what share of your traffic hits it, or whether fixing it moves anything.

There’s a technical detail worth being clear about. Recordings aren’t video: Clarity reconstructs the DOM and the user’s actions to produce an animation, and it warns that it tracks all sessions but recordings might not be available for all of them. What you see is already filtered before you filter anything.

Then there’s the bias nobody talks about, which is yours. How many of the fifteen recordings you watched yesterday do you actually remember? The two odd ones. The other thirteen, where nothing happened, you’ve forgotten, and they’re the ones that represent most of your traffic.

That’s why the step after a recording is quantitative, never a direct decision. If you have the volume, a properly run A/B test turns the suspicion into data. If you don’t, and most small shops don’t, the guide to optimising with low traffic covers that scenario, and it isn’t about pretending the recording was enough.

How do you watch recordings without losing the afternoon?

With a question written down before you open the tool. It’s the only real difference between research and a wasted afternoon. Here’s how I do it, and the order matters because each step constrains the next.

1. Write the question in one sentence. “Why do people who add to cart from the listing never reach checkout?” works. “I want to understand users” doesn’t.
2. Translate the question into a filter. Page, device, event, segment. If you can’t translate it, the question is still too vague.
3. Set the sample size before you start. Fifteen sessions or thirty minutes. Without a limit there’s always one more.
4. Write down observable facts only. “Clicked the image three times and it didn’t zoom” is a fact anyone can verify by reopening that same session; “was frustrated” is your interpretation and nobody can check it. Write the first one.
5. Count frequencies. Out of fifteen sessions, in how many did it happen. Eleven is a pattern. Two is noise.
6. Close with a hypothesis, or drop the question. With no written outcome, the session didn’t happen.

One operational warning: none of this is kept forever. Clarity states that data stays available to the webmaster for up to 30 days from the recording, and heatmaps for up to nine months. Spot something odd on a Tuesday, leave it for when you have time, and it may be gone.

Which ecommerce pages should you instrument first?

Product page, cart, and each checkout step, in that order. Not because they get the most traffic, but because friction there has an immediate price. A doubt on a blog post costs a visit. A doubt on the shipping step costs the order.

On the product page I look at three things: whether the scroll map shows shipping and returns sitting out of reach for most people, whether there are dead clicks on images or variants, and whether attention heats up somewhere you didn’t expect. The usual fixes are in my 19 ideas for optimising the product page.

Cart and checkout call for recordings more than maps, because the problem is almost never visual: a field that rejects a phone format, a coupon that won’t apply, a payment method that hangs. The value is in seeing the exact step where it breaks, and the catalogue of fixes is in my 20 ideas for optimising checkout. Never compare a desktop map with a mobile one as if they were the same page: the fold sits elsewhere and a thumb isn’t a mouse, which I cover in mobile CRO for ecommerce.

How do I turn an observation into a testable hypothesis?

With a boring template, always the same one. Because X, we believe changing Y will move Z in this direction, and we’ll know when we measure W. It sounds like homework. It works because it forces you to separate what you saw from what you believe, which is exactly where most heatmap reports fall apart.

An example of the structure, with no invented figures: “Because the scroll map shows the returns policy sitting below the point most mobile visitors reach, and because in eleven of fifteen recordings the user scrolled back up looking for something, we believe moving it next to the buy button will reduce drop-off. We’ll measure it with mobile add-to-cart rate.”

Notice the observation comes from two sources. That’s what changes the quality of a hypothesis most. A map tells you where, a recording tells you how, a survey tells you why. For that third leg I’ve got a post on surveys applied to CRO.

Before looking at anything I prefer to run the page through a structured review. A heuristic analysis in CRO usually finds in twenty minutes half the problems you’d confirm in two hours of recordings. If you need the full framework before touching tools, the guide to CRO for ecommerce is the starting point.

What does privacy require when you record sessions?

Asking for consent first, masking what’s sensitive, and deleting on time. Nearly all the content about heatmaps skips this part, and it’s the part that can cost you money. A recording captures what a person types, hesitates over and corrects on your site. That’s personal data processing, not aggregated analytics.

Spain’s data protection authority, the AEPD, published a guide on cookies for audience measurement tools setting out which measurements it considers strictly necessary, and therefore exempt from consent: page-by-page audience, referrer, device type, load times, time on page, bounce rate, scroll depth and click statistics, all aggregated daily. It then adds that any processing beyond that list needs the user’s consent to be lawful. Replaying an individual session isn’t on the list.

Microsoft confirms it from its side: without explicit consent, Clarity cookies can’t be used in the European Economic Area, the UK and Switzerland, and recordings are among the features affected. Add the AEPD’s general cookie guidance, which requires the reject option to be offered at the same time, at the same level and with the same visibility as accept, and you’ve got the minimum bar for the banner.

Masking is the second leg. Clarity masks sensitive content by default and never captures what’s masked; input boxes and dropdowns are masked in every mode, and the balanced mode you get out of the box classes numbers and email addresses as sensitive. Two warnings on that page are worth reading twice: content inside style sheets isn’t masked, and masking changes can’t be applied retroactively. If you realise in November that you’ve spent months recording a field with a national ID in it, what’s recorded is recorded.

On retention, Article 5 of the GDPR requires data to be adequate, relevant and limited to what is necessary and kept no longer than needed. For audience measurement, the AEPD puts numbers on it: thirteen months of cookie lifetime and twenty-five months maximum retention. My practice: define the period in writing before installing anything.

Frequently asked questions

Can heatmaps measure conversion?

Not directly. A heatmap aggregates clicks, scroll or time over a page screenshot, and none of those three is a conversion. They’re for locating where the problem might be and discarding hypotheses fast. Measuring the effect of a change belongs to your analytics or a test, never to the map itself.

How many recordings do you need to watch to draw a conclusion?

No quantity turns a recording into a conclusion. What volume does change is your confidence in the pattern: fifteen sessions filtered by the same behaviour usually gives you a decent hypothesis. Past that, returns drop off very quickly. I’d rather watch fifteen and quantify afterwards than watch fifty and decide on a hunch.

Do I need consent to record sessions in the EU?

Yes. The AEPD limits the consent exemption to a narrow set of aggregated statistical measurements, and replaying individual sessions isn’t in it. Microsoft also states that in the EEA, the UK and Switzerland Clarity cookies can’t be used without explicit consent, which directly affects recordings. Check it with whoever handles your compliance.

What should I mask in ecommerce recordings?

Every form field and any area showing customer data: addresses, phone numbers, emails, payment methods, order numbers and the account area. Clarity masks input boxes in every mode, but text already rendered on the page, like the shipping address in an order summary, depends on you flagging it element by element.

Heatmaps or surveys to understand a conversion problem?

Both, in that order. The heatmap tells you where something happens, the recording tells you how, and the survey tells you why. If you can only do one, it depends on the question: for interface friction, maps and recordings; for doubts about content, price or trust, the survey wins nearly every time.

They look, they don’t prove

The line I repeat most in CRO audits is that these tools are a telescope, not a set of scales. They show you things you wouldn’t otherwise see. But if you try to weigh something with them, the number means nothing.

When someone shows me a report full of screenshots with red arrows and firm conclusions, I don’t see research, I see a presentation. Research starts when you turn those screenshots into hypotheses with a metric attached, and ends when something quantitative confirms or kills each one.

If you’ve had Clarity installed for months, a cookie banner nobody has reviewed and not one written hypothesis, book 30 minutes of consulting and we’ll sort it out: what to look at first, what to mask, what to bin.