Hotjar

Hotjar is a behaviour analytics and user feedback platform. It provides heatmaps (showing where visitors click, move, and scroll), session recordings (anonymised video replays of individual visits), surveys, and on-page feedback widgets. It is used by product and UX teams to understand how real visitors interact with a website, not to track behaviour for advertising purposes. Hotjar has no ad-targeting functionality and does not share data with any advertising network.

Hotjar is designed with GDPR compliance in mind. EU customer data is stored in the EU (AWS Ireland), Hotjar acts as a data processor under a Data Processing Agreement, and it provides tools to mask sensitive data in recordings. However, compliance depends on the operator's configuration: you must obtain valid consent before loading the Hotjar script (since it sets persistent cookies), correctly suppress all sensitive form fields from recordings, and maintain an up-to-date DPA with Hotjar.

Yes, in its default configuration. Hotjar sets persistent identification cookies (_hjid, _hjSessionUser) that are used to track individual visitors across sessions. Under the ePrivacy Directive and GDPR, these require prior informed consent via a compliant Consent Management Platform (CMP). However, Hotjar v3+ offers a cookieless mode in which no persistent cookies are set, in this mode, consent requirements are significantly reduced and legitimate interest may be a valid legal basis in some jurisdictions.

For EU customers, Hotjar stores all behavioural data (heatmaps, session recordings, survey responses) in the European Union on AWS eu-west-1 (Ireland). This migration was completed in 2022 as a deliberate privacy-by-design decision to eliminate EU-to-US data transfer concerns. This is a key compliance advantage over tools like Google Analytics or Meta Pixel, which transfer data to the United States. Some operational sub-processors (e.g. for billing or support) may be US-based, but these do not process session or heatmap data.

Hotjar sets four main cookies: _hjid (365-day lifetime), assigns a unique visitor ID persisted across sessions to identify returning users; _hjSessionUser_<site_id> (365-day lifetime), stores the unique session user identifier; _hjSession_<site_id> (30-minute lifetime), stores current session data including session number and timestamps; _hjAbsoluteSessionInProgress (30-minute lifetime), detects the first pageview of a session. All cookies are first-party (set on the operator domain) and stored in the EU.

By default, Hotjar automatically suppresses all HTML input fields in session recordings, replacing their content with asterisks. However, this suppression relies on correct HTML markup, non-standard input implementations or dynamically rendered fields may not be caught automatically. Operators must review their recordings and use Hotjar's suppress class (data-hj-suppress) or element-level suppression settings to explicitly exclude any sensitive fields. Particular attention is required on checkout pages, account registration forms, and any page handling health, financial, or identity data.

Hotjar v3+ introduced a cookieless tracking mode in which no persistent cookies are set in the visitor browser. In this mode, Hotjar collects only aggregated, non-identifiable session data, it cannot link multiple visits to the same individual. This significantly reduces privacy risk and may allow use under legitimate interest (Art. 6(1)(f) GDPR) rather than consent, depending on the specific processing and applicable DPA guidance. Note that session recordings are still available in cookieless mode, but without cross-session user identification.

Google Analytics and Hotjar serve complementary but different purposes. Google Analytics focuses on quantitative metrics: how many visitors, from where, which pages, conversion rates. It transfers data to Google servers in the United States and requires consent. Hotjar focuses on qualitative behaviour: why visitors behave as they do, visualised through heatmaps and session recordings. Hotjar stores EU data in the EU, has no advertising use, and acts purely as a processor. Many teams use both tools together, Google Analytics for traffic reporting, Hotjar for UX optimisation.