Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Mieruca is a heatmap and behaviour analytics tool from Faber Company, based in Japan. It records scroll, click and attention heatmaps and tracks on site behaviour so teams can optimise their pages. It relies on a first party analytics cookie and behavioural event capture. Because the heatmaps record detailed behaviour, the cookie goes beyond strictly necessary and requires consent under the ePrivacy rules in the European Union.
Mieruca is a heatmap and behaviour analytics tool developed by Faber Company and based in Japan. It helps website teams understand how visitors actually use a page by recording scroll, click and attention heatmaps. Alongside the heatmaps it tracks on site behaviour so that designers and marketers can optimise layout and content. It is a conversion and user experience tool rather than a pure traffic counter.
Mieruca relies on a first party analytics cookie, typically named _mieruca_id, and a session cookie, together with behavioural event capture. It records where visitors move, click and pause, and aggregates this into heatmaps. Because the recording is granular and can describe how an individual interacts with a page over a session, the data is personal data. Heatmaps that capture detailed behaviour therefore go beyond strictly necessary processing.
The ePrivacy rules require prior consent before the analytics and heatmap cookie is stored, under art. 5(3), because it is not strictly necessary. The GDPR then governs the behavioural data that results. Heatmaps record more detail than a simple page count, so regulators expect a clear consent step. You should also be careful to mask form fields and any sensitive areas so that the recording does not capture content that users type.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
The lawful basis is consent under art. 6(1)(a) of the GDPR, paired with ePrivacy consent for the cookie. Consent must be freely given, specific, informed and as easy to withdraw as to give. Mieruca should load only after the visitor accepts the analytics category in your consent banner. Until consent is given, no heatmap cookie should be written and no behavioural events should be recorded.
Mieruca processes data in Japan, which is a transfer outside the EEA. Japan benefits from a European Commission adequacy decision that has been in force since 2019, so transfers can take place under the supplementary rules without additional Standard Contractual Clauses in most cases. You should still verify that your specific data flows fall within the scope of the adequacy decision and the supplementary rules, and record this in your documentation.
Load Mieruca through a consent management platform so it runs only after analytics consent. Configure masking for form fields and sensitive areas, and limit recording to what you need. List the _mieruca_id and session cookies in your cookie policy with purpose and lifetime, and explain that data is processed in Japan under the adequacy decision. Sign the data processing agreement and document your retention periods and your DPIA.
Websites using Mieruca must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is advisable because Mieruca captures detailed behavioural data through scroll, click and attention heatmaps that can reveal how individuals interact with a page. Assess the granularity of the recording, whether any input or sensitive areas are captured, retention periods, and reliance on the Japan adequacy decision. Masking sensitive fields and limiting recording reduce the residual risk.
Sample consent text
We use Mieruca to see how visitors scroll, click and read our pages so we can improve them. With your consent, Mieruca sets a first party analytics cookie and records anonymised behaviour through heatmaps. You can accept or decline, and you may withdraw consent at any time in our cookie settings.
Third-party domains contacted
mieruca.commieruca-heatmap.comcdn.mieruca.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| _mieruca_id | analytics | persistent (up to 1 year) | Mieruca first party visitor identifier used to build scroll, click and attention heatmaps and to analyse on site behaviour. |
| _mieruca_session | analytics | session | Session cookie used to group behavioural events within a single visit for heatmap analytics. |
| _mieruca_hm | analytics | persistent (up to 1 year) | Heatmap helper cookie used to aggregate scroll, click and attention data across pages. |
Mieruca collects user analytics data — you legally need a consent banner. Try FlowConsent free.
Mieruca uses a first party setup. It typically sets a persistent analytics cookie called _mieruca_id and a session cookie called _mieruca_session. They store an identifier and behavioural data used to build scroll, click and attention heatmaps. They are analytics cookies, not strictly necessary ones.
Yes. The heatmap and analytics cookie is not strictly necessary, so ePrivacy art. 5(3) requires prior consent before it is set. Because heatmaps record detailed behaviour, Mieruca should load only after the visitor accepts the analytics category in your consent banner.
The lawful basis is consent under art. 6(1)(a) of the GDPR, combined with ePrivacy consent for the cookie. Heatmaps that capture detailed behaviour go beyond strictly necessary processing, so consent is the appropriate basis rather than legitimate interest.
Yes. Data is processed in Japan, which is outside the EEA. Japan benefits from a European Commission adequacy decision in force since 2019, so transfers can take place under the supplementary rules without extra Standard Contractual Clauses in most cases, but you should verify coverage for your flows.
A DPIA is advisable. Mieruca captures detailed behavioural data through scroll, click and attention heatmaps that can show how individuals interact with a page. The assessment should review the recording granularity, masking of sensitive fields, retention and reliance on the Japan adequacy decision.
Load Mieruca through a consent management platform so it runs only after analytics consent. Enable masking for form fields and sensitive areas, list the _mieruca_id and session cookies in your cookie policy, sign the data processing agreement and note that data is processed in Japan under the adequacy decision.
Other heatmap and behaviour analytics tools exist, including European options and privacy first tools that aggregate data without persistent identifiers. The right choice depends on whether you need detailed scroll, click and attention heatmaps and on how much consent dependent recording you want to run.
Add Mieruca as an analytics provider in your cookie policy. Describe the _mieruca_id analytics cookie and the session cookie, their purpose and duration, and the heatmap processing. State that data is processed in Japan under the adequacy decision and explain how visitors can withdraw consent.