On 4 of 32 Sites Running the Bing Ads Tag, It Was the Only Thing Loading Clarity

On October 27 I opened 131 well-known retail, home-goods, home-services, legal and medical sites in a clean browser and logged every request to Microsoft’s ad and analytics hosts. The Microsoft Ads tag loaded on 32 of them on two separate visits. On 7 of those 32, the tag also asked for Microsoft Clarity, the session-recording tool, on both visits. Three of the 7 also loaded a separate Clarity tag. On the other 4, nothing else on the page loaded Clarity on either visit, so the ads tag was the only route in. On 1 of those 4, the recorder started on the page itself and sent session data to Clarity within 15 seconds, on both visits.

Quick Take

Microsoft’s Universal Event Tracking (UET) tag can load Clarity by itself, so a site can record visitors’ sessions with no Clarity code in its source or its tag manager. If you run Microsoft Ads, open your browser’s network panel, reload your homepage and filter for clarity.ms/tag/uet/. If it’s there and nobody on your side chose it, your privacy policy probably doesn’t mention it, and a cookie banner that gates replay tools in your tag manager won’t be the thing deciding whether it runs. The fix is a setting on the tag. If the live page still loads it afterward, a short head script blocks it.

How an ads tag ends up recording sessions

The UET tag is Microsoft’s equivalent of the Google Ads tag. It loads bat.js from bat.bing.com, and bat.js fetches a small config file for your tag ID. When Clarity is enabled on the tag, that config inserts a second script from www.clarity.ms/tag/uet/<your tag ID>, and that one loads clarity.js, which records the session. Each step is a script inserting a script, so none of it shows in your page source or your tag manager, only in the browser’s network panel.

This is a documented feature. Microsoft’s Clarity docs describe using “a single UET tag” for heatmaps, session playbacks and conversion tracking. In October 2021 Microsoft announced it would migrate existing UET tags to include Clarity from mid-November that year, with some accounts excluded, and would turn Clarity on by default for newly created tags from November. So any tag created or migrated since late 2021 may be recording today without anyone at the business having decided it should.

What the spot check shows

The request chain, and on one site the recording itself. On the 7 sites, the browser asked for the clarity.ms/tag/uet/ address on both visits, which only happens when the UET config tells it to. Of the 4 where the ads tag was the only route, one is a Shopify store that runs one of its UET tags as a custom pixel. There the whole chain, recorder included, ran inside Shopify’s sandboxed pixel frame, which isn’t the page the shopper sees. On the other 2, the recorder didn’t send any session data inside my 15-second visits, so I’m not counting them as recording.

Headless visits are noisy. A few tags loaded on one visit and not the other, so I only counted sites that behaved the same way twice.

The check, and the fix

The check takes two minutes. Open your site in a private window, open the browser’s network panel, reload, wait ten seconds, and filter for clarity. A request to clarity.ms/tag/uet/ means the ads tag brought it in. A request to clarity.ms/tag/ followed by something other than uet means someone installed Clarity on its own.

If you want Clarity, keep it on purpose. I recommend it on top ad landing pages, because ten recordings show a broken form faster than any report. Name it in your privacy policy, and hold the recording until the visitor clicks a consent choice, which is how my own site runs replay. Keep it off health and legal intake pages unless your counsel has signed off. Recordings can capture what people type if masking is loosened, and Microsoft’s own 2021 announcement says Clarity shouldn’t be used on sites with sensitive data, health care included.

If you don’t want it, turn it off on the tag. Microsoft’s FAQ says you “might uncheck the Enable Microsoft Clarity box” under the tag’s settings, and newer screens label the toggle “Enable Clarity”. Before you do, check your conversion goals: Microsoft lets you build goals with Clarity’s code-free event setup, and I’d expect those to stop counting when Clarity stops loading. Then reload the live page and run the same filter, because that’s what your visitors load.

While you’re in the tag’s settings, look for a second one. Microsoft documents a separate feature called UET Insights, announced in May 2023 with its own toggle. It loads from bat.bing.com/p/insights/, so a filter for clarity won’t show it. Four to eight of the sites in my check requested it, depending on the visit. I haven’t tested what it collects, so I’m not calling it recording, but if you want the tag to measure conversions and nothing else, check both settings.

If the page still loads it, or you don’t want the ad account deciding what runs on your site, block it on the site. Here’s a head script that does it, tested in a browser before I published it. Place it before the tag manager so it’s in place before the UET tag runs:

(function () {
  function isClarity(url) {
    try {
      var host = new URL(String(url), location.href).hostname;
      return host === 'clarity.ms' || host.endsWith('.clarity.ms');
    } catch (err) {
      return false;
    }
  }

  var srcProp = Object.getOwnPropertyDescriptor(HTMLScriptElement.prototype, 'src');
  if (srcProp && srcProp.set) {
    Object.defineProperty(HTMLScriptElement.prototype, 'src', {
      configurable: true,
      enumerable: srcProp.enumerable,
      get: srcProp.get,
      set: function (url) {
        if (!isClarity(url)) srcProp.set.call(this, url);
      }
    });
  }

  var originalSetAttribute = Element.prototype.setAttribute;
  Element.prototype.setAttribute = function (name, value) {
    var isScriptSrc = this instanceof HTMLScriptElement && String(name).toLowerCase() === 'src';
    if (isScriptSrc && isClarity(value)) return;
    return originalSetAttribute.apply(this, arguments);
  };

  window.clarity = function () {};
})();

It refuses any script whose address is on a clarity.ms host, through the two routes the UET chain uses to set one, and it gives window.clarity an empty function so the tag’s own calls to it land somewhere harmless. The UET page-load beacon keeps firing. It also blocks a Clarity install you made on purpose, so don’t use it if you want Clarity. It doesn’t touch UET Insights. And it only protects the page it runs on: if your UET tag runs as a Shopify custom pixel, a script in the theme’s head never reaches it, and the setting on the tag is the control that counts.

It has no backslashes for a reason. If your site assembles inline scripts as JavaScript template literals, a regular expression like /^https?:\/\// loses its backslashes on the way out, and the build passes a script that either won’t parse or quietly matches something else. Read what the build emitted, and parse it with new Function(), before you deploy.

What I did not claim

• That any of these sites did something wrong. Loading Clarity is often deliberate, and some of these businesses may name it in their privacy policies. I can see the requests, not the decision behind them, which is also why I haven’t named the sites.
• A prevalence rate. This is 32 tags on sites I picked, not a random sample, checked twice in one day, so 4 of 32 describes this set and nothing wider.
• That the off switch fails. I’m describing the documented switches and telling you to check the live page after using them.
• What UET Insights collects. I saw its requests and checked its script’s size and name. I didn’t test what it records.
• Anything about the law. I’m not a lawyer. Whether a gap between what your page loads and what your policy says is a legal problem where you operate is a question for your counsel.

Keep going

If this hit, the next three pieces in the same universe:

• The Bing pixel that said YOUR_VALUE_HERE. Another UET tag that looked configured and wasn’t: three conversion tags sending placeholder text for six months.
• What your website sends before anyone says yes. The five-minute browser test for every tag on your site, not only UET, and a dated table of where tracking claims stand.
• The STACK Audit. The five tracking layers I check before touching a bid, and where a misbehaving tag shows up.

Free PDF: The 25-page Tracking Stack. Where a tag like UET fits in the eight-layer stack, and the dedup key it has to match. No email gate.

If you run Microsoft Ads and haven’t looked at what your UET tag loads, request the free ads audit and say Microsoft Ads in the form. I’ll email the read-only access steps, start with the UET tag on the account and on your live page, and write it up within 24 hours. No call.

See how I fix conversion tracking.