The Behavior Analytics Glossary: Rage Clicks to Zone Maps

This behavior analytics glossary defines the practice of measuring what users actually do — their clicks, scrolls, cursor movement, errors — mostly through session replay and heatmaps. Below are 30 canonical terms, each with a plain definition and a short "why it matters" note. One caveat first: most of this vocabulary was coined by vendors, not by a standards body, so I attribute terms to their primary docs rather than pretend they're neutral.

Before you read: the creepy line

Every term here captures a piece of human behavior. And every one has a privacy failure mode before it has a feature. I keep coming back to a single lens I call "the creepy line": capturing enough to fix the flow without capturing more of the person than the fix requires. A rage-click count needs the gesture. It does not need the credit-card number the user was rage-clicking near.

Because vendors define most of these terms, I flag where detection is configurable or proprietary. Rage-click thresholds especially vary by tool, so counts don't transfer between products. The legal frame matters too. As Loeb & Loeb LLP noted in a July 2025 alert, these tools "track mouse movements, clicks, scrolls, keystrokes and page views to create a visual log," which is exactly why they face growing scrutiny under laws like California's CIPA. Watching sessions is not neutral. Design like someone will ask you to justify each field.

How to use this behavior analytics glossary

Terms are alphabetized within four blocks. Each entry gives a one-line definition and a "why it matters" note, and the heavier concepts point to deeper articles at the end. If you're skimming for a single lookup, jump to the letter block and read one entry. If you're building a capture policy, read the creepy-line audit near the bottom first, then map each term you plan to enable against those three questions.

A–D

AI-Summarized Replay — an auto-generated text summary of a session so you read the gist instead of watching end to end. Why it matters: it saves review time, but a summary can quietly surface what your masking was supposed to hide, because the model reads the reconstructed page. Several tools now offer this: Fullstory and Contentsquare on the enterprise side, and newer chat-first entrants like Kixo, which pairs summaries with a visible reasoning trail so you can see how a conclusion was reached. Treat any summary feature as a second surface where PII can leak, not just a convenience.

Blocking — excluding an element from capture entirely, versus masking its contents. Why it matters: Datadog's privacy docs distinguish the two, and blocking is the stronger choice when even the shape of an element (a promo code field, say) tells you too much.

Click Map — a heatmap that aggregates where users click or tap across many sessions. Why it matters: it shows demand for things that aren't links, which is how you find the "button" users think exists.

Cohort — a group of users defined by a shared behavior or trait over a time window. Why it matters: cohorts turn a pile of sessions into a comparison, like "users who hit the error versus users who didn't."

Conversion Funnel — an ordered set of steps toward a goal, measuring drop-off at each one. Why it matters: the funnel tells you where people leave; replay tells you why.

Dead Click — a click that produces no page response within a few seconds. Fullstory defines these plainly as "clicks that have no effect on the page or the element that is being clicked on." Why it matters: dead clicks are the cheapest usability bug to find and often the cheapest to fix.

DOM-Based Capture — recording changes to the Document Object Model rather than filming the screen. Why it matters: Sentry notes its replay "is not an actual 'screen' recording, but instead a recording of changes in the web browsers' Document Object Model," which makes the data searchable and scrubbable. You can strip fields you never wanted.

E–H

Engagement Map — a heatmap that blends clicks, scroll depth, and attention into one view. Why it matters: it's a fast triage view, though the blending hides which signal is driving the color.

Engagement Rate — the share of sessions with meaningful interaction rather than an immediate bounce. Why it matters: it separates "someone arrived" from "someone tried."

Error Click — a click that triggers a visible error state. Why it matters: Fullstory groups this with other frustration signals because it points at a specific broken interaction, not a vague mood.

Frustration Signals — the vendor-coined cluster of automatic frustration heuristics. Fullstory names them directly: "Rage Clicks, Dead Clicks, Error Clicks, and Thrashed Cursor are the primary frustration signals captured in session replay." Why it matters: this cluster is the fastest way to sort ten thousand sessions down to the fifty worth watching.

Heatmap — an aggregate visual overlay of behavior across many sessions. Why it matters: it answers "how often" so your replay stories don't become anecdotes of one.

Hesitation — a measurable pause before an action, often near a form field or a price. Why it matters: hesitation marks where users are doing unpaid cognitive work you could remove.

I–P

Interaction — any discrete user action the tool records: a tap, a scroll, a keypress. Why it matters: it's the atomic unit everything else is built from, which is also why keystroke capture is where privacy risk concentrates.

Journey — the end-to-end path a user takes across a product over one or more sessions. Why it matters: it reframes isolated screens as a sequence with intent.

Masking — replacing captured content, especially text, with placeholders, ideally client-side before it leaves the device. Why it matters: this is the single most important control on the creepy line. Datadog's docs are explicit: "When data is masked, that data is not collected in its original form by Datadog's SDKs and thus is not sent to the backend," and masking is on by default if you don't set a privacy level. Masking that happens server-side is a promise. Masking that happens client-side is a guarantee about what left the phone.

Page View — a single load or route change recorded during a session. Why it matters: it's the backbone of funnels and paths, and the coarsest thing you can capture, so it's low-risk.

Path / User Flow — the sequence of screens a user moves through. Why it matters: paths reveal the loops and dead ends that a funnel, which assumes a straight line, will miss.

PII Redaction — stripping personally identifiable information out of captured data. Why it matters: Sentry's DOM-based approach makes captured content searchable and therefore strippable, which is the mechanism that lets redaction actually work rather than being a checkbox.

Privacy Level — a per-element or per-app setting that controls how aggressively content is masked or blocked. Why it matters: the default matters more than the option, because most teams never change it.

Q–S

Rage Click — repeated rapid clicks in the same area signaling frustration; exact thresholds vary by tool and are usually configurable or proprietary. Why it matters: Contentsquare's 2025 retail benchmark found rage clicks in about 5.3% of retail sessions, which sounds small until you multiply it by your traffic. Because thresholds differ between vendors, don't compare rage-click counts across tools as if they measured the same thing.

Rage-Click Map — a heatmap that flags each burst of frustrated clicks. Contentsquare describes it well: "Each rage click—a burst of user clicks in quick succession that indicate frustration—gets flagged on the map with an 'angry face' icon." Why it matters: it takes you straight to the pixel that's making people angry.

Retention — whether users come back over time. Why it matters: it's the honest scoreboard behind every "engagement" number.

Scroll Map — a heatmap of how far down the page users actually scroll. Why it matters: it settles arguments about the fold with data instead of opinion.

Session Replay — a reconstructed playback of a single user's session. Why it matters: it's the qualitative heart of this whole field, and the reason Loeb & Loeb flags legal scrutiny. A replay is a recording of a person, so consent and masking aren't optional polish.

T–Z

Tap Map — the mobile equivalent of a click map, aggregating touch points. Why it matters: fat-finger patterns near small targets show up here before your support queue does.

Thrashed Cursor — erratic back-and-forth mouse movement that signals confusion. Why it matters: Fullstory counts it among frustration signals because it catches struggle that never becomes a click at all.

Thrashing — the broader pattern of repeated, unproductive interaction, of which thrashed cursor is one case. Why it matters: it's a tell that the interface is asking the user to guess.

Viewport — the visible region of the page on a given device at a given moment. Why it matters: heatmaps only mean something relative to the viewport they were captured in, so mixing devices lies to you.

Data Retention — how long replays are stored before deletion. Why it matters: Pendo states plainly that "replays are automatically deleted after 30 days, or 90 days if your subscription includes extended retention," which is a good reminder that retention is a dial, and every extra day is extra risk you're holding.

Zero-Result State — a screen where a search or filter returns nothing. Why it matters: it's a high-frustration, high-abandonment moment that's trivial to detect and often signals a content or synonym gap.

Zone Map / Zone-Based View — an aggregate heatmap that reports metrics per defined region of a page rather than pixel by pixel. Why it matters: zones scale where pixel-level maps get noisy, and they let you compare a card against a banner without arguing about individual clicks.

The frustration signals ledger

Definitions stay abstract until you put a number on them, so here's a worked example. Imagine a checkout flow that sees 10,000 sessions in a month. I'm applying two real prevalence rates from Contentsquare's 2025 retail benchmark to that hypothetical volume — the sessions are invented, the rates are not.

Signal	~Sessions affected	What a replay reviewer actually sees
Rage clicks (5.3%)	~530	Fast repeated taps on one element — a disabled button, a broken coupon field
Load-time frustration (11.6%)	~1,160	A user waiting, cursor still, then leaving before the page paints

Two things fall out of this. First, load-time frustration is more than twice as common: Contentsquare's 2025 data put it at 11.6% of retail sessions, "the second most prevalent frustration factor in retail sessions in 2025." Second, and this is the part teams get wrong, prevalence isn't priority. The 1,160 load-time sessions are diffuse. Fixing them means infrastructure and third-party script work, which is real but slow. The 530 rage-click sessions usually point at one specific broken element you can ship a fix for this week. Sequence accordingly: chase the specific bug first, then grind on the systemic latency.

One honest caveat. These are benchmarks, not your numbers, and rage-click thresholds differ per tool. If you run this exercise, use your own instrumented rates, and never line up a rage-click count from one vendor against another's as if they agreed on what "rapid" means.

The creepy-line audit for every term

Before you enable any term in this glossary, run it through three questions. I use these as a literal checklist when I review a capture config.

One: does capturing this need the user's content, or just their gesture? A rage click needs the coordinates and timing, not the text under the cursor. If a signal only needs the gesture, don't let the content ride along.

Two: is it masked client-side before transmission? This is where Datadog's wording earns its keep — masked data "is not collected in its original form by Datadog's SDKs and thus is not sent to the backend." In plain speech: the sensitive characters never leave the device, so there's nothing to breach on the server. Anything masked only after arrival has already crossed the line once.

Three: how long is it retained? Pendo's default is the cleanest illustration. Replays "are automatically deleted after 30 days, or 90 days if your subscription includes extended retention." In plain speech: pick the shortest window that still lets you investigate, because data you deleted can't be subpoenaed, leaked, or re-watched out of context.

Hovering over all three is the CIPA context Loeb & Loeb raised: tools that track "mouse movements, clicks, scrolls, keystrokes and page views" are drawing legal attention precisely because that capture can look like interception without consent. Translated: get consent, mask by default, retain briefly, and you've answered most of the question before a regulator asks it.

Where these terms come from

None of this vocabulary is a neutral standard. "Frustration signals" is Fullstory's framing. "Rage-click map" and "zone-based view" trace to Contentsquare and Hotjar. And the privacy language — masking, blocking, privacy levels, DOM-based capture, retention windows — comes from vendor docs at Datadog, Sentry, Pendo, Amplitude, and Mixpanel. I attribute rather than launder these into house terms, because knowing who coined a word tells you what it was designed to sell. When two tools use the same word for different thresholds, attribution is the only thing that keeps you honest.

Related reading

For the deeper mechanics behind the terms clustered above, a guide to reading heatmaps without fooling yourself covers the map types here in detail, and a walkthrough of masking replays before they leave the device expands the client-side capture points from the creepy-line audit. Both go past definition into how to configure the thing.

FAQ

What's the difference between a dead click and a rage click? A dead click produces no page response, per Fullstory's definition. A rage click is a burst of rapid clicks in the same spot signaling frustration. They often appear together — users rage-click because the first click was dead.

Are rage-click counts comparable between tools? No. Vendors treat the detection threshold (how fast, how many, how close) as configurable or proprietary, so the same user behavior can register differently in each tool. Compare within one product over time, not across products.

Does session replay require user consent? Loeb & Loeb's 2025 alert ties replay to CIPA scrutiny specifically because it can capture keystrokes and clicks. Consult counsel for your jurisdiction, but the safe posture is explicit consent plus client-side masking by default.

How long should I keep session replays? Shorter than you think. Pendo's 30-day default (90 with extended retention) is a reasonable baseline; keep only what a real investigation needs, since every retained day is retained risk.