Behavioral Tracking and Session Replay Technologies

What it is

When you visit the Thomson Reuters website, several tracking tools are active on the page, including one that records a sample of user sessions and captures how you interact with the site. A cookie consent tool is present to manage some of these trackers.

Why it matters (compliance & governance perspective)

Session replay technology can capture detailed behavioral data including mouse movements, clicks, and potentially form field interactions, which goes beyond standard analytics; the presence of Facebook tracking also means browsing behavior may be shared with Meta for advertising purposes.

Consumer impact (what this means for users)

Visitors to thomsonreuters.com may have their browsing session recorded and replayed by DataDog's RUM tool, and their behavior may be shared with third parties including Meta via the Facebook Connect script, depending on cookie consent selections. EU and UK users have consent rights under GDPR and UK GDPR that may limit this tracking, and the OneTrust tool on the site is the mechanism for exercising those preferences.

What you can do

Institutional analysis (Compliance & governance intelligence)

(1) REGULATORY LANDSCAPE: The deployment of session replay technology engages GDPR Articles 5, 6, and 13 for EU/EEA users, requiring a lawful basis for processing and transparent disclosure in a privacy notice. The UK GDPR imposes equivalent obligations. CCPA and CPRA apply to California residents, requiring disclosure of data sharing with third parties and honoring opt-out rights for sale or sharing of personal information. The Facebook Connect script may constitute sharing of personal data with Meta for cross-context behavioral advertising purposes under CPRA, which requires a mechanism for consumers to opt out. The FTC and relevant EU supervisory authorities are the primary enforcement bodies. The ICO enforces UK GDPR compliance. (2) GOVERNANCE EXPOSURE: High for EU, UK, and California-specific compliance. Session replay tools that capture user interaction data, even with input masking, may constitute processing of personal data under GDPR if users are identifiable. The deployment of Meta tracking pixels on a business-to-business information services site raises questions about the necessity and proportionality of that data sharing under GDPR's data minimization principle. (3) JURISDICTION FLAGS: EU and EEA users have the strongest protections under GDPR, requiring valid consent for non-essential cookies and tracking. California residents have CPRA opt-out rights for sharing of personal information with advertising platforms. Illinois BIPA may be relevant if any biometric or behavioral pattern data is captured through session replay. UK GDPR mirrors GDPR obligations post-Brexit. (4) CONTRACT AND VENDOR IMPLICATIONS: Legal teams should confirm that DataDog, Adobe, AppDynamics, and Meta have valid Data Processing Agreements in place under GDPR Article 28. The transfer of personal data to US-based processors requires either Standard Contractual Clauses or another valid transfer mechanism under GDPR Chapter V. The OneTrust configuration should be audited to ensure DataDog session replay and Facebook Connect are correctly categorized as non-essential and gated behind appropriate consent categories. (5) COMPLIANCE CONSIDERATIONS: A full cookie audit should be conducted to confirm all active trackers are disclosed in the cookie policy and correctly mapped to OneTrust consent categories. The session replay tool's privacy level setting ('mask-user-input') should be verified as adequate for GDPR compliance. Data retention schedules for session replay data should be established and documented. California-specific CPRA notices should address the Meta pixel data sharing. Any records of processing activities under GDPR Article 30 should include all identified trackers.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Disclaimer of Warranties medium
• Limitation of Liability for All Damages medium
• Copyright and Content Reproduction Restriction medium
• Unilateral Right to Modify or Discontinue Site low
• No Responsibility for Third-Party Linked Sites low
• Governing Law and Jurisdiction medium

Related Analysis

• Netflix Updated Terms Authorize Voice Data Collection: April 2026

  Netflix updated its Privacy Statement on April 18, 2026, disclosing voice recording collection and expanded household ad profiling for the first time.

• What Google Actually Knows About You

  Google's Privacy Policy covers Search, Gmail, YouTube, Maps, and every site running Google Analytics. Here is what it actually authorizes.