Hotjar Incoming Feedback

What Hotjar Incoming Feedback is

Hotjar Incoming Feedback is the always on widget from the Hotjar Insights suite (now part of Contentsquare) that lets visitors rate a page through a smiley or emoji scale, then optionally leave a comment, attach a screenshot and share an email address. The widget loads as a JavaScript snippet from Hotjar domains and writes the response to your Hotjar workspace. Although it is marketed as a lightweight tool, it shares the same Hotjar identifier with Heatmaps, Recordings and Surveys when those are active on the same site, which links the feedback to a visitor profile.

Cookies and identifiers it sets

Once initialised, the widget drops several first party cookies in the visitor browser, including _hjSessionUser_* (one year), _hjSession_* (30 minutes), _hjFirstSeen, _hjIncludedInSessionSample_* and _hjAbsoluteSessionInProgress. These identifiers, together with the user agent, IP address and page URL, are sent to in.hotjar.com and static.hotjar.com. Even if the visitor never opens the widget, the Hotjar script generally executes on every page load and sets identifiers, which is the trigger for ePrivacy and GDPR obligations.

GDPR and ePrivacy implications

The Hotjar identifier is personal data because it singles out a device across sessions, and the optional email plus free text answer often qualify as personal data too. Article 5(3) of the ePrivacy Directive requires prior informed consent before storing or reading information on a terminal, and Article 6(1)(a) GDPR is the natural legal basis. Several EU regulators, including the CNIL and the Italian Garante, have published guidance treating Hotjar style tools as requiring opt in consent rather than legitimate interest.

Consent and configuration in the EU

In the European Economic Area and the United Kingdom, you must block the Hotjar script until consent is captured. Use a CMP that maps the widget to the analytics or feedback purpose, suppress sensitive form fields with the Hotjar suppress class, anonymise IP addresses, and disable user attributes that would carry CRM identifiers. Provide a clear way to withdraw consent that immediately removes the cookies. Avoid combining feedback responses with logged in user data unless a separate explicit consent has been collected.

Data transfers and Schrems II

Hotjar processes EU data in Dublin but Contentsquare and its sub processors operate from the United States and other countries. Confirm in your records of processing that Standard Contractual Clauses are in place, that the recipient is certified under the EU US Data Privacy Framework where applicable, and that you have run a transfer impact assessment. Document supplementary measures such as pseudonymisation of identifiers and short retention of screenshots.

Practical compliance steps

List _hjSessionUser_*, _hjSession_*, _hjFirstSeen and the related identifiers in your cookie policy with their purpose and duration, expose Hotjar as a third party recipient in your privacy notice, and align retention with the workspace setting (default 365 days). Train product teams to apply the data suppression class to forms, run periodic checks with browser dev tools to confirm the script does not fire before consent, and re prompt users when retention or sub processors change.