Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Hotmart is a digital products and online course platform that lets creators sell courses, ebooks and memberships, with a built in affiliate marketplace, checkout and video player. When its checkout, player or tracking pixel is embedded, it sets cookies for affiliate attribution, sales tracking and video playback. Under the GDPR and the ePrivacy Directive, prior consent is required for its non essential cookies.
Hotmart is a digital commerce platform founded in Brazil in 2011 that lets creators host, sell and deliver online courses, ebooks, memberships and other digital products. It provides a checkout, a membership area, a video player and a large affiliate marketplace. Websites integrate Hotmart through embedded checkouts, course players or affiliate links.
When a Hotmart checkout, player or affiliate link is loaded, it sets cookies and reads device data such as IP address, browser and operating system. Persistent identifiers attribute a sale to the affiliate that referred the buyer, remember the cart and measure how learners watch course videos. Some cookies support advertising and retargeting of buyers.
The identifiers Hotmart stores qualify as personal data under the GDPR, and storing them is governed by Article 5(3) of the ePrivacy Directive. Affiliate, analytics and advertising cookies are not strictly necessary, so they require freely given, specific, informed and unambiguous consent before they are set. The strictly necessary checkout cookies may rely on a different basis.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Block Hotmart affiliate and tracking scripts until the visitor accepts the relevant cookie categories in a Consent Management Platform, while allowing genuinely essential checkout cookies. Log consent so you can demonstrate compliance, and make refusal as easy as acceptance. The embedded player should defer non essential identifiers until opt in.
Hotmart is operated from Brazil with infrastructure in the United States, so personal data of EU visitors may be transferred outside the European Economic Area. These transfers must rely on Standard Contractual Clauses or another valid safeguard under Chapter V of the GDPR, supported by a Transfer Impact Assessment. Brazil also applies its own data protection law, the LGPD.
Document every Hotmart cookie and domain in your cookie policy, classify them and gate non essential ones behind consent. Clarify whether you act as controller and Hotmart as processor, sign the appropriate data processing terms, and record your transfer safeguards. Review the integration whenever Hotmart updates its checkout or player.
Websites using Hotmart must obtain user consent under GDPR regulations.
DPIA considerations
Hotmart processes IP addresses, device data, purchase information and persistent identifiers used to attribute sales to affiliates and to track video engagement. Key DPIA considerations: (1) affiliate cookies enable cross site attribution and profiling of buyer behaviour; (2) the embedded player and checkout load third party scripts that can set identifiers before consent; (3) personal data is processed in Brazil and the United States, requiring a Transfer Impact Assessment; (4) creators acting as controllers must clarify roles with Hotmart as processor. A DPIA is advisable for large catalogues or sensitive course topics.
Sample consent text
We use Hotmart to host and sell our digital courses and to process checkout. Hotmart sets cookies for affiliate attribution, sales tracking and video playback, and may process data in Brazil and the United States. You can withdraw your consent at any time through our cookie settings.
Third-party domains contacted
hotmart.comcheckout.hotmart.comstatic.hotmart.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| _hm_aff | Attribution / Advertising | 90 days | Stores the affiliate identifier so a later purchase can be credited to the affiliate that referred the visitor. |
| hmCheckout | Functional | Session | Preserves cart and checkout state while a buyer completes a purchase. |
| player_session | Functional / Analytics | 1 year | Remembers video playback position and measures how learners engage with course videos. |
| _fbp | Advertising | 3 months | Set by an integrated Meta pixel to retarget buyers and measure advertising conversions. |
Hotmart uses cookies for user preferences — inform visitors with a consent banner.
Hotmart sets cookies for affiliate attribution, cart and checkout, video playback and, in some cases, advertising. The affiliate and advertising cookies are persistent identifiers that track buyers across sites and are not strictly necessary, so they require consent. Essential checkout cookies may be exempt.
Yes for the non essential cookies. The affiliate, analytics and advertising cookies set by Hotmart require prior consent under the GDPR and the ePrivacy Directive, so the relevant scripts should not load until the visitor accepts. Strictly necessary checkout cookies can load without consent.
Consent under Article 6(1)(a) GDPR is the basis for affiliate and advertising cookies, together with Article 5(3) ePrivacy for storage. The processing strictly necessary to complete a purchase the user requested can rely on contract under Article 6(1)(b), but tracking cannot.
Yes. Hotmart operates from Brazil with US infrastructure, so EU personal data may be transferred to both countries. These transfers must be covered by Standard Contractual Clauses or another Chapter V mechanism, supported by a Transfer Impact Assessment, as neither country benefits from a full EU adequacy decision for this processing.
A DPIA is recommended when you sell at scale, run affiliate campaigns or handle sensitive course subjects. The combination of buyer profiling, cross site attribution and international transfers raises the risk enough that documenting the processing is good practice and may be required.
Integrate Hotmart through a CMP that blocks affiliate and advertising scripts until consent, keep essential checkout cookies separate, and disclose everything in your cookie policy. Sign Hotmart data processing terms, record consent and transfer safeguards, and test the checkout and player after updates.
Comparable platforms include Gumroad, Teachable, Podia, Kajabi and Digistore24, each with similar cookie and transfer considerations. There is no fully cookieless equivalent for an affiliate driven checkout, so focus on consent gating and clear disclosure rather than expecting a tracking free option.
Add entries for the Hotmart affiliate, checkout, player and advertising cookies with their purpose and duration, list the Hotmart domains, and state that data may be processed in Brazil and the United States. Keep the policy aligned with the current integration and link to Hotmart privacy notice.