Using Hotjar in a GDPR-compliant way

Hotjar records mouse movements, clicks, scroll behaviour and partly input, and creates heatmaps. This is a deep behavioural analysis.

Is this a risk?

Session recording requires consent (§ 25 (1) TDDDG). Because of the depth of intrusion, supervisory authorities demand informed, granular consent and strict masking of personal input. Without consent, use is regularly unlawful.

What you can do

• Load Hotjar only after explicit consent.
• Mask all form fields and personal areas server-side (“suppress”).
• Keep the retention period short, conclude a data-processing agreement.
• In the privacy policy, explain the purpose, scope of recording and how to withdraw.

How consentglass helps

The free scan checks the delivered HTML and shows which services are embedded, whether a cookie banner is detected and whether privacy-policy and legal-notice links are present — with context for each finding. It is not a substitute for legal advice.