Does Hotjar require disclosure in a privacy policy?

Yes. Hotjar collects session recordings and interaction data that constitutes personal data under GDPR and CCPA. You must disclose Hotjar's use, explain what data it collects, identify Hotjar Ltd as the data processor, and describe users' rights. Failure to disclose exposes you to regulatory penalties.

What specific data does Hotjar collect?

Hotjar records mouse movements, clicks, scroll depth, form field focus (but not keystroke content by default), full session video replays, device information, and geographic location. These recordings create a visual replay of user sessions. Keystrokes are suppressed by default, but you should verify this setting in your Hotjar configuration.

Does Hotjar require a cookie consent banner?

Yes. Hotjar uses cookies (_hjSessionUser_, _hjSession_, _hjIncludedInSessionSample_) and session recording is intrusive tracking under GDPR and CCPA. You must obtain explicit prior consent via a cookie banner before loading Hotjar, unless users opt-in to non-essential tracking.

Who processes Hotjar data and where?

Hotjar Ltd, based in Malta (EU), is the data processor. Data is transferred to and processed within the EU. You must ensure a Data Processing Agreement (DPA) is signed with Hotjar and disclose the processor and location in your privacy policy.

Analytics

Privacy policy clauses for Hotjar

Hotjar is a user behavior analytics platform that records website visitor sessions, including mouse movements, clicks, and scroll patterns, displayed as heatmaps and video replays. Websites use Hotjar to understand how users interact with pages and identify usability issues.

Scan my site free →Copy sample clause ↓

Free scan · No signup · Results in 60 seconds

What data Hotjar collects

Your privacy policy must disclose each of the following data types when you use Hotjar.

Mouse movements and click patterns (heatmaps)

Scroll depth

Form interaction (fields focused — not content by default)

Full session recordings (visual replay of user sessions)

Device info

Geographic location

When does Hotjar trigger privacy obligations?

Installation starts data collection immediately

The moment Hotjar's SDK loads on your site, it begins collecting personal data without waiting for consent. Hotjar sets three analytics cookies (_hjSessionUser_*, _hjSession_*, _hjIncludedInSessionSample_*) and starts recording mouse movements, clicks, scroll depth, and full session replays—including visual recordings of user behavior. Under GDPR Article 4(1), session recordings and device identifiers are personal data. Under GDPR Article 5(1)(a), processing requires a lawful basis.

Cookie	Duration	Category	Purpose
_hjSessionUser_*	1 year	analytics	Unique user ID
_hjSession_*	30 minutes	analytics	Session data
_hjIncludedInSessionSample_*	2 minutes	analytics	Sampling control

Privacy policy clauses for Hotjar

What data Hotjar collects

When does Hotjar trigger privacy obligations?

Installation starts data collection immediately

Jurisdictional thresholds

First concrete step

Where data goes

Cookies set by Hotjar

Common compliance pitfalls

Pitfall 1: Assuming keystroke suppression is automatic

Pitfall 2: Missing DPA or relying on outdated Data Processing Agreements

Pitfall 3: Failing to disclose session recording in privacy policies

Legal note

Sample privacy policy clause

What regulators look for

GDPR Data Protection Authorities (DPAs)

CCPA Attorney General (California)

Recent enforcement signals

Frequently asked questions

Does Hotjar require disclosure in a privacy policy?

What specific data does Hotjar collect?

Does Hotjar require a cookie consent banner?

Who processes Hotjar data and where?

Don't ship without Bandit.