Hotjar

Overview

Hotjar is a behavioral analytics and user feedback platform used by product and UX teams to understand how visitors interact with websites. It provides heatmaps, scroll maps, session recordings, and on-site surveys. Hotjar is one of the most widely deployed analytics tools and processes significant volumes of user interaction data.

What This Script Does

• Session recording: Captures full session replays including mouse movements, clicks, taps, scrolling behavior, and DOM changes. Records what users see and do on every page during a session.
• Heatmaps and scroll maps: Aggregates click, tap, and scroll position data across all visitors to generate visual heatmaps showing interaction hotspots.
• Form analytics: Tracks form field interactions including time spent per field, drop-off points, and refill rates.
• User feedback: Renders on-site survey widgets, feedback polls, and incoming feedback buttons.
• Cookies set:
  • _hjSessionUser_* — persistent cookie (365 days) that assigns a unique Hotjar User ID to identify returning visitors
  • _hjSession_* — session cookie that tracks the current session
  • _hjIncludedInSessionSample — controls session recording sampling
  • _hjAbsoluteSessionInProgress — detects the first pageview of a session
  • _hjFirstSeen — identifies new vs. returning visitors
• Network requests: Sends recorded session data, heatmap coordinates, and survey responses to Hotjar's servers (*.hotjar.com). Data is transmitted continuously during a session.
• DOM observation: Uses MutationObserver to track DOM changes in real time for accurate session replay rendering.
• Keystrokes: By default, Hotjar suppresses keystroke recording in input fields, but this can be configured per-site. When suppression is disabled, typed content is captured.

Consent & Compliance

• Consent category: Analytics
• GDPR/ePrivacy: Hotjar sets persistent cookies that identify returning visitors and captures detailed behavioral data. Requires explicit opt-in consent under both the ePrivacy Directive (cookie consent) and GDPR (processing of personal data). Hotjar acts as a data processor; a Data Processing Agreement (DPA) is available and should be signed.
• CCPA: Session recordings, heatmap data, and visitor identification constitute personal information. Must be disclosed in your privacy policy. Honor opt-out requests.
• Data residency: Hotjar processes data in the EU (Ireland), which simplifies GDPR compliance but does not eliminate the consent requirement.
• Sensitive data risks: Session recordings may inadvertently capture sensitive information displayed on screen (personal details, financial data, health information). Configure Hotjar's suppression rules to mask sensitive page elements.

Should You Block This Without Consent?

Yes. Hotjar sets persistent identification cookies, records detailed user sessions including mouse movements and clicks, and transmits this behavioral data to external servers. It is firmly in the analytics consent category and must not load until the user has granted consent. This applies even though Hotjar is not used for advertising — the depth of behavioral data collected requires informed consent under GDPR and ePrivacy.