Websites Are Watching Your Mouse — Here's What They're Collecting and How to Stop It

You load a webpage, scan around, scroll halfway down, hover over a button you don't click, and then leave. Pretty unremarkable, right? Not to the website's analytics team. To them, every single one of those movements is a data point — and chances are, it was recorded.

This isn't science fiction or paranoia. It's a standard practice in web development called session recording, and it's more widespread than most people realize.

What Session Recording Actually Is

Session recording tools — with names like Hotjar, FullStory, Microsoft Clarity, and Mouseflow — let website owners capture a replay of what individual visitors do on a page. That includes:

• Where your mouse moves (even when you're not clicking)
• What you click, tap, or highlight
• How far you scroll before giving up
• How long you pause before taking action
• What you type into forms — including fields you clear and retype

That last one is worth repeating. Some tools can log what you type into a text field even if you delete it before submitting. Most reputable tools try to mask password fields, but the implementation isn't always perfect.

Beyond session recordings, companies also use heatmap tools that aggregate behavior across thousands of users. A heatmap shows, visually, which parts of a page get the most attention — where people click, where they stop scrolling, and which areas they completely ignore. It's a powerful design tool, and it's built entirely on watching you.

Why Companies Do This

The honest answer: it's genuinely useful for building better websites. If a company notices that 80% of users scroll right past their call-to-action button without clicking it, that's actionable information. If people keep clicking something that isn't a link, maybe it should be.

This kind of behavioral data helps product teams make decisions without running expensive user studies. It's faster and cheaper than traditional research, which is exactly why it's everywhere.

The problem isn't the intent — it's the consent. Most users have no idea this is happening. A buried line in a privacy policy doesn't really count as informed consent, especially when the tools can capture surprisingly intimate browsing behavior.

How to Find Out If a Site Is Recording You

You can't always tell just by looking, but there are a few ways to check:

Look at the page source. Right-click any webpage and choose "View Page Source" or "Inspect." Search for terms like hotjar, fullstory, clarity, mouseflow, or logrocket. If any of those strings appear in the code, that tool is running on the site.

Use a browser extension. Extensions like Privacy Badger (from the Electronic Frontier Foundation) or uBlock Origin can detect and block third-party tracking scripts, including many session recorders. Once installed, they'll flag or silently block these tools without you having to do anything extra.

Check your network requests. If you're comfortable with browser developer tools, open the Network tab while a page loads and look for requests going out to domains like hotjar.com, fullstory.com, or clarity.ms. That's your confirmation.

What You Can Do About It

You've got more options than you might think.

Install a Content Blocker

This is the highest-impact, lowest-effort move. uBlock Origin is free, open-source, and available for Chrome, Firefox, Edge, and Safari. It blocks a wide range of trackers by default, including most session recording scripts. You install it once and largely forget about it.

Ghostery is another solid option with a cleaner interface if you prefer something more visual. It shows you exactly what trackers are present on each page and lets you toggle them on or off.

Tighten Your Browser's Privacy Settings

Most major browsers now include built-in tracking protections that have gotten meaningfully better over the past few years:

• Firefox has Enhanced Tracking Protection turned on by default. Set it to "Strict" mode in your privacy settings for broader coverage.
• Brave blocks trackers aggressively out of the box — it's worth considering if privacy is a priority for you.
• Chrome has improved its privacy controls but still lags behind. If you're on Chrome, a third-party extension matters more.

Use a Privacy-Focused DNS

Switching your DNS to something like NextDNS or Cloudflare's 1.1.1.1 won't catch everything, but NextDNS in particular lets you enable blocklists that target tracking domains — including analytics and session recording services. It works across your whole device, not just your browser.

Opt Out When You Can

Some sites, particularly those subject to GDPR or California's CCPA, will show you a cookie consent banner that includes options to reject analytics and behavioral tracking. Actually clicking "Manage Preferences" and turning that stuff off does make a difference — at least for compliant companies.

For US users, your rights here are patchier than in Europe, but they're improving. California residents have some of the strongest protections in the country under CCPA.

The Stuff That's Harder to Block

First-party analytics — tools that a company runs entirely on its own servers without relying on third-party scripts — are much harder to detect or block. A company that builds its own behavioral tracking system won't show up in a standard blocklist.

There's not a clean solution for that scenario short of not visiting the site. But for the vast majority of session recording out there, which relies on third-party tools loaded as external scripts, a good content blocker handles it effectively.

Quick Reference: Your Blocking Toolkit

You don't need all of these — pick one or two that fit how you browse. uBlock Origin plus your browser's built-in protections is a solid starting point for most people.

The bottom line: websites tracking your mouse movements isn't illegal, and in many cases it genuinely helps make better products. But you have every right to decide you'd rather not participate — and now you know exactly how to opt out.