> How Hotmart checkout, the embedded player and affiliate pixel set cookies, how data reaches Brazil and the US, GDPR consent duties and how to stay compliant. > > Canonical: https://www.flowconsent.com/en/services/ecommerce/hotmart E-commerce # Hotmart Preferences · [Official website](https://hotmart.com) Hotmart is a digital products and online course platform that lets creators sell courses, ebooks and memberships, with a built in affiliate marketplace, checkout and video player. When its checkout, player or tracking pixel is embedded, it sets cookies for affiliate attribution, sales tracking and video playback. Under the GDPR and the ePrivacy Directive, prior consent is required for its non essential cookies. [Block Hotmart until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=ecommerce) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [E-commerce](https://www.flowconsent.com/en/services/ecommerce) - Consent Preferences - Prior consent Required - Documented cookies 4 - Third-party domains 3 - Servers Brazil and United States (Amazon Web Services), global CDN Overview ## What does Hotmart do? ## **What is Hotmart?** Hotmart is a digital commerce platform founded in Brazil in 2011 that lets creators host, sell and deliver online courses, ebooks, memberships and other digital products. It provides a checkout, a membership area, a video player and a large affiliate marketplace. Websites integrate Hotmart through embedded checkouts, course players or affiliate links. ## **What data and cookies does it collect?** When a Hotmart checkout, player or affiliate link is loaded, it sets cookies and reads device data such as IP address, browser and operating system. Persistent identifiers attribute a sale to the affiliate that referred the buyer, remember the cart and measure how learners watch course videos. Some cookies support advertising and retargeting of buyers. ## **GDPR and ePrivacy implications** The identifiers Hotmart stores qualify as personal data under the GDPR, and storing them is governed by Article 5(3) of the ePrivacy Directive. Affiliate, analytics and advertising cookies are not strictly necessary, so they require freely given, specific, informed and unambiguous consent before they are set. The strictly necessary checkout cookies may rely on a different basis. ## **Consent requirements** Block Hotmart affiliate and tracking scripts until the visitor accepts the relevant cookie categories in a Consent Management Platform, while allowing genuinely essential checkout cookies. Log consent so you can demonstrate compliance, and make refusal as easy as acceptance. The embedded player should defer non essential identifiers until opt in. ## **Data transfers** Hotmart is operated from Brazil with infrastructure in the United States, so personal data of EU visitors may be transferred outside the European Economic Area. These transfers must rely on Standard Contractual Clauses or another valid safeguard under Chapter V of the GDPR, supported by a Transfer Impact Assessment. Brazil also applies its own data protection law, the LGPD. ## **Practical compliance steps** Document every Hotmart cookie and domain in your cookie policy, classify them and gate non essential ones behind consent. Clarify whether you act as controller and Hotmart as processor, sign the appropriate data processing terms, and record your transfer safeguards. Review the integration whenever Hotmart updates its checkout or player. Compliance ## Hotmart and the GDPR Hotmart is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent (Art. 6(1)(a) GDPR) - Risk level medium - Applicable regulations GDPR, ePrivacy Directive (Cookie Law), LGPD ### Impact assessment (DPIA) Hotmart processes IP addresses, device data, purchase information and persistent identifiers used to attribute sales to affiliates and to track video engagement. Key DPIA considerations: (1) affiliate cookies enable cross site attribution and profiling of buyer behaviour; (2) the embedded player and checkout load third party scripts that can set identifiers before consent; (3) personal data is processed in Brazil and the United States, requiring a Transfer Impact Assessment; (4) creators acting as controllers must clarify roles with Hotmart as processor. A DPIA is advisable for large catalogues or sensitive course topics. ### Sample text for your banner > We use Hotmart to host and sell our digital courses and to process checkout. Hotmart sets cookies for affiliate attribution, sales tracking and video playback, and may process data in Brazil and the United States. You can withdraw your consent at any time through our cookie settings. Cookies and trackers ## What Hotmart sets and contacts - Tracking method JavaScript tracking pixel, checkout embed and cookies - Server location Brazil and United States (Amazon Web Services), global CDN - Data transferred outside the EU Hotmart is operated from Brazil with infrastructure in the United States. Personal data of EU visitors may be processed in both countries, so transfers rely on Standard Contractual Clauses under Article 46 GDPR, supported by a Transfer Impact Assessment, as neither country has a full EU adequacy decision for this processing. ### Cookies set (4) | Name | Type | Duration | Purpose | | --------------- | ------------------------- | -------- | --------------------------------------------------------------------------------------------------------------- | | \_hm\_aff | Attribution / Advertising | 90 days | Stores the affiliate identifier so a later purchase can be credited to the affiliate that referred the visitor. | | hmCheckout | Functional | Session | Preserves cart and checkout state while a buyer completes a purchase. | | player\_session | Functional / Analytics | 1 year | Remembers video playback position and measures how learners engage with course videos. | | \_fbp | Advertising | 3 months | Set by an integrated Meta pixel to retarget buyers and measure advertising conversions. | ### Third-party domains contacted (3) - `hotmart.com` - `checkout.hotmart.com` - `static.hotmart.com` Questions ## Frequently asked questions about Hotmart Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does Hotmart set? Hotmart sets cookies for affiliate attribution, cart and checkout, video playback and, in some cases, advertising. The affiliate and advertising cookies are persistent identifiers that track buyers across sites and are not strictly necessary, so they require consent. Essential checkout cookies may be exempt. ### Does Hotmart require cookie consent? Yes for the non essential cookies. The affiliate, analytics and advertising cookies set by Hotmart require prior consent under the GDPR and the ePrivacy Directive, so the relevant scripts should not load until the visitor accepts. Strictly necessary checkout cookies can load without consent. ### What is the legal basis for Hotmart cookies? Consent under Article 6(1)(a) GDPR is the basis for affiliate and advertising cookies, together with Article 5(3) ePrivacy for storage. The processing strictly necessary to complete a purchase the user requested can rely on contract under Article 6(1)(b), but tracking cannot. ### Does Hotmart transfer data outside the EU? Yes. Hotmart operates from Brazil with US infrastructure, so EU personal data may be transferred to both countries. These transfers must be covered by Standard Contractual Clauses or another Chapter V mechanism, supported by a Transfer Impact Assessment, as neither country benefits from a full EU adequacy decision for this processing. ### Do I need a DPIA for Hotmart? A DPIA is recommended when you sell at scale, run affiliate campaigns or handle sensitive course subjects. The combination of buyer profiling, cross site attribution and international transfers raises the risk enough that documenting the processing is good practice and may be required. ### How do I implement Hotmart compliantly? Integrate Hotmart through a CMP that blocks affiliate and advertising scripts until consent, keep essential checkout cookies separate, and disclose everything in your cookie policy. Sign Hotmart data processing terms, record consent and transfer safeguards, and test the checkout and player after updates. ### Are there alternatives to Hotmart? Comparable platforms include Gumroad, Teachable, Podia, Kajabi and Digistore24, each with similar cookie and transfer considerations. There is no fully cookieless equivalent for an affiliate driven checkout, so focus on consent gating and clear disclosure rather than expecting a tracking free option. ### How do I update my cookie policy for Hotmart? Add entries for the Hotmart affiliate, checkout, player and advertising cookies with their purpose and duration, list the Hotmart domains, and state that data may be processed in Brazil and the United States. Keep the policy aligned with the current integration and link to Hotmart privacy notice. Same category ## More services: E-commerce [See the whole category](https://www.flowconsent.com/en/services/ecommerce) ### [Network for Good](https://www.flowconsent.com/en/services/ecommerce/network-for-good) [Network for Good is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Network for Good integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Network for Good helps organizations maintain robust websites that meet user expectations and.](https://www.flowconsent.com/en/services/ecommerce/network-for-good) [Preferences](https://www.flowconsent.com/en/services/ecommerce/network-for-good) · ### [Zip](https://www.flowconsent.com/en/services/ecommerce/zip) [Zip is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Zip supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Zip ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/ecommerce/zip) [Preferences](https://www.flowconsent.com/en/services/ecommerce/zip) · ### [Addi](https://www.flowconsent.com/en/services/ecommerce/addi) [Addi is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Addi supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Addi ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/ecommerce/addi) [Preferences](https://www.flowconsent.com/en/services/ecommerce/addi) · ### [RETISIO](https://www.flowconsent.com/en/services/ecommerce/retisio) [Retisio is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Retisio supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Retisio ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/ecommerce/retisio) [Preferences](https://www.flowconsent.com/en/services/ecommerce/retisio) · ### [Walla](https://www.flowconsent.com/en/services/ecommerce/walla) [Walla is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Walla integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Walla helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/ecommerce/walla) [E-commerce](https://www.flowconsent.com/en/services/ecommerce/walla) · ### [Beddy](https://www.flowconsent.com/en/services/ecommerce/beddy) [Beddy is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Beddy provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Beddy helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/ecommerce/beddy) [Marketing](https://www.flowconsent.com/en/services/ecommerce/beddy) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)