Does Microsoft Clarity need cookie consent?
On this page
Yes, for visitors in the EEA, UK and Switzerland. Clarity’s cookies are non essential, and since 31 October 2025 Microsoft has enforced a consent signal for those visits: cookies are placed only once it says granted. Otherwise Clarity runs cookieless and counts each page view as a new session. Elsewhere, local law decides.
Does Microsoft Clarity need cookie consent in every country?
There are two separate questions here: what Microsoft requires, and what the law requires. Microsoft’s consent documentation covers the first. For page visits from the EEA, the UK and Switzerland, Clarity expects a consent signal, and it applies that to any site receiving those visits, wherever the company is based. Microsoft also says the change adds no new consent requirement. It enforces rules that already applied.
The law is the older part. Article 5(3) of the ePrivacy Directive requires consent to store or read information on a visitor’s device unless it is strictly necessary for the service they asked for. Microsoft describes Clarity’s cookies as non essential, so in the EU they wait for consent. The UK added exceptions in the Data (Use and Access) Act 2025, including one for statistical purposes where the visitor can object. Whether a session recording tool fits it is a question for the ICO’s guidance and your adviser. Microsoft’s signal requirement covers UK visits either way.
Outside those regions, Clarity sets cookies unless you turn that setting off. Local law decides what you need. If you are still sorting tools into groups, which consent category a script belongs in helps.
What happens to Clarity without a consent signal?
Clarity still loads. In Consent Mode each signal is denied until you update it, so no signal behaves like a rejection. Microsoft’s API reference says a visitor without consent gets a unique ID per page view and no cookies.
Two signals, two separate jobs.
analytics_Storage grantedCookies set, pages joinedanalytics_Storage denied or not sentNo cookies, new ID per page viewad_Storage grantedShares data with Microsoft Adsad_Storage denied or not sentShares nothing with Microsoft AdsHow does missing consent change your Clarity reports?
This can look like a traffic spike that never happened. Microsoft lists the effects for visitors without consent:
- Sessions equal page views, so session counts rise.
- Pages per session reads 1, and every page is both an entry and an exit.
- Funnels with several steps show a full drop off.
- Returning users disappear, because every visitor counts as new.
- Source and channel lean towards Direct and Other.
So do not compare a period without the signal against a period with it as if they measured the same thing. Note the date you fixed the signal on your reports, and read trends from that date forward.
Does cookieless mode mean you can skip the banner?
No. Cookieless describes what Clarity stores, and it is not a legal conclusion. Microsoft’s own test tells you to confirm that Clarity is still executing and sending its /collect calls after a decline. The EU rule also covers reading information from the device, and recordings can capture what people do on the page. You have two honest setups: let Clarity run cookieless before a choice, or hold the tag until analytics is allowed. Take the first only after your adviser has looked at it.
How do you set up Clarity consent correctly?
Turn off the project’s cookie setting
In Clarity, open Settings, then Setup, and turn the cookie setting off. Microsoft applies Consent Mode by default to visitors from the three regions. This setting makes Clarity wait for the signal everywhere else too.
Decide whether Clarity may run before a choice
Clarity loads whether or not the signal has arrived, and collects cookieless data until the visitor decides. If you want nothing from Clarity before a choice, hold the whole tag until analytics is allowed and send the signal as well.
Send consentv2 whenever a choice takes effect
Call
window.clarity('consentv2', { ad_Storage: 'denied', analytics_Storage: 'granted' })with the visitor’s real values. Both parameters are required, and the capital S is Microsoft’s spelling. Send it after a new choice, and when a stored choice is read on a return visit.Make sure an early signal is not lost
If your banner can run before the tag, define Microsoft’s queue first:
window.clarity = window.clarity || function () { (window.clarity.q = window.clarity.q || []).push(arguments); };. The real tag reads that queue when it loads.Give a Tag Manager tag a trigger after consent
If Clarity is held by a consent check, a page load trigger alone may never start it. On a client estate we remediated in November 2026, the tag stayed held on every page, even with stored consent, until it got a consent update trigger. The post on the consent update event shows the setup.
Test a decline and an accept
Open a fresh private window from a covered region and run Microsoft’s check:
clarity('metadata', (d, upgrade, consent) => console.log(consent), false, true, true). After a decline, both values read denied and there is no_clckor_clskcookie. After an accept, both read granted and the cookies appear. If you hold the tag, there is nothing to read until the visitor accepts.
Clarity counts consent as valid for up to nine months unless the visitor changes it or your local configuration requires less, so keep your banner’s renewal period in step with that.
Why can Clarity keep tracking someone who rejected?
Microsoft says a rejection deletes existing Clarity cookies, and on the current host that is what we saw. The exception came up when we traced the real tag in November 2026 while building Velo’s integration. Told denied, Clarity deleted _clsk across every domain level, which cleared the cookie domain it had cached, and then deleted _clck on the current host only. A copy of _clck on the parent domain, carrying a granted state from a previous consent tool or an older policy version, survived. Clarity read it when it restarted and kept tracking the same visitor while reporting denied. Treat that as one traced case on one tag version, and worth testing.
It also left _cltk in session storage after a rejection in our test. Microsoft makes the site owner responsible for telling Clarity about consent changes, so do not assume the signal alone cleans everything. To check your site, accept once, copy the _clck value to a cookie on the parent domain, reject, and look at what is left on both levels and in session storage.
A smaller trap sits in the opposite direction. Because a denied signal deletes _clck, sending denied on every page load and then granted gives a consenting visitor a new ID on each page. Read the stored choice first and send the real state once.
How does Velo handle Microsoft Clarity?
Velo sends consentv2 each time a choice takes effect, so you add no code. Its analytics category sets analytics_Storage, its advertising category sets ad_Storage, and an undecided visitor in an opt in region counts as denied. When analytics is not granted, Velo deletes _clck, _clsk and _cltk from your site itself. Cookies Microsoft set on its own domains, such as MUID, stay there, because your site cannot reach them. A visitor who arrives with Clarity cookies from another tool loses them, and counts as new if they then accept. Velo is not on Microsoft’s list of supported platforms and uses the Consent API instead. The Clarity section of our Microsoft guide has the setup.
Common questions
What people ask about this topic.
Does Microsoft Clarity need cookie consent?
Yes, for visits from the EEA, UK and Switzerland. Microsoft has enforced a consent signal for those visits since 31 October 2025, and Clarity places its cookies there only once that signal says granted. Elsewhere, Clarity sets cookies unless you turn that setting off, and your local law decides whether you need consent first.
Does Microsoft Clarity work without cookies?
Yes, with limits. Without consent, Clarity runs in a cookieless mode and gives each page view its own ID. Sessions equal page views, pages per session reads 1, multi step funnels show a full drop off and no visitor counts as returning.
Does the signal apply if my business is outside Europe?
It follows the visitor, not the company. Microsoft tells organisations outside the EEA, UK and Switzerland to review their setup if they receive traffic from those regions.
Does cookieless mode remove the need for consent?
Not by itself. Clarity still loads and collects data in that mode, and the EU rule covers access to information on the device as well as cookies. If you want nothing collected before a choice, hold the whole tag until analytics is allowed, and ask your adviser about your own setup.
Why did my Clarity sessions jump after October 2025?
A jump in sessions alongside a fall in pages per session is what Microsoft documents when European visitors have no valid consent signal, because each page view becomes its own session. Check that your banner sends consentv2 before you read it as a change in traffic.
