Is consent required before loading Hotjar on my site?

Yes. Hotjar sets persistent identification cookies, records full session replays of mouse movements and clicks, and transmits detailed behavioral data externally. This requires explicit opt-in consent under GDPR and ePrivacy, regardless of the fact that Hotjar is used for UX analysis rather than advertising.

What cookies and data does Hotjar collect?

Hotjar sets _hjSessionUser_* (365-day visitor ID), _hjSession_* (current session tracker), _hjIncludedInSessionSample (recording sampling flag), and _hjFirstSeen (new vs. returning). It records mouse movements, clicks, scrolls, and form interactions, streaming session replay data continuously to hotjar.com during each session.

How does ConsentStack manage Hotjar on my site?

ConsentStack blocks the Hotjar script until the visitor grants analytics consent. Once consent is given, ConsentStack releases the script and Hotjar begins recording. If consent is later withdrawn, ConsentStack suppresses Hotjar on subsequent page loads. Consent records with timestamps are stored for GDPR audit purposes.

What tracker domains does Hotjar use?

ConsentStack has catalogued tracker domains for Hotjar including hotjar.com. These are the network destinations Hotjar's scripts contact, which a consent platform blocks until a visitor agrees.

What cookies does Hotjar set?

Hotjar sets cookies such as _hjid, _hjSessionUser_, _hjSession_ and _hjFirstSeen. ConsentStack identifies these and classifies them so they can be blocked or allowed based on the visitor's consent choice.

Hotjar - Session Recording Cookies & Consent Guide

Back to Vendor Library

Overview

Hotjar is a behavioral analytics and user feedback platform used by product and UX teams to understand how visitors interact with websites. It provides heatmaps, scroll maps, session recordings, and on-site surveys. Hotjar is one of the most widely deployed analytics tools and processes significant volumes of user interaction data.

What This Script Does

Session recording: Captures full session replays including mouse movements, clicks, taps, scrolling behavior, and DOM changes. Records what users see and do on every page during a session.
Heatmaps and scroll maps: Aggregates click, tap, and scroll position data across all visitors to generate visual heatmaps showing interaction hotspots.
Form analytics: Tracks form field interactions including time spent per field, drop-off points, and refill rates.
User feedback: Renders on-site survey widgets, feedback polls, and incoming feedback buttons.
Cookies set:
- _hjSessionUser_* — persistent cookie (365 days) that assigns a unique Hotjar User ID to identify returning visitors
- _hjSession_* — session cookie that tracks the current session
- _hjIncludedInSessionSample — controls session recording sampling
- _hjAbsoluteSessionInProgress — detects the first pageview of a session
- _hjFirstSeen — identifies new vs. returning visitors
Network requests: Sends recorded session data, heatmap coordinates, and survey responses to Hotjar's servers (*.hotjar.com). Data is transmitted continuously during a session.
DOM observation: Uses MutationObserver to track DOM changes in real time for accurate session replay rendering.
Keystrokes: By default, Hotjar suppresses keystroke recording in input fields, but this can be configured per-site. When suppression is disabled, typed content is captured.

Consent & Compliance

Consent category: Analytics
GDPR/ePrivacy: Hotjar sets persistent cookies that identify returning visitors and captures detailed behavioral data. Requires explicit opt-in consent under both the ePrivacy Directive (cookie consent) and GDPR (processing of personal data). Hotjar acts as a data processor; a Data Processing Agreement (DPA) is available and should be signed.
CCPA: Session recordings, heatmap data, and visitor identification constitute personal information. Must be disclosed in your privacy policy. Honor opt-out requests.
Data residency: Hotjar processes data in the EU (Ireland), which simplifies GDPR compliance but does not eliminate the consent requirement.
Sensitive data risks: Session recordings may inadvertently capture sensitive information displayed on screen (personal details, financial data, health information). Configure Hotjar's suppression rules to mask sensitive page elements.

Should You Block This Without Consent?

Yes. Hotjar sets persistent identification cookies, records detailed user sessions including mouse movements and clicks, and transmits this behavioral data to external servers. It is firmly in the analytics consent category and must not load until the user has granted consent. This applies even though Hotjar is not used for advertising — the depth of behavioral data collected requires informed consent under GDPR and ePrivacy.

Is Hotjar GDPR compliant?

Hotjar typically loads analytics trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So Hotjar can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads Hotjar, not on Hotjar itself.

Visit website

Consent Categories

Analytics

Also Known As

hotjar GDPRhotjar cookiessession recording consenthotjar heatmap privacyhotjar trackingHotjar compliance

Industries

Computers Electronics and Technology

Tracked Domains (1)

Hotjar's trackers are common, seen on about 4% of the sites ConsentStack has scanned. Scan your own site to see which of these are firing before consent.

hotjar.comAnalytics

hotjar.com is an analytics domain operated by Hotjar, used to measure visits, sessions, and on-site behavior. Seen on about 4% of scanned sites.