Hotjar: Tracking Behavior & Litigation Context

Published by Crandall Consulting · Informational litigation intelligence · Last substantive update: August 8, 2026

What Hotjar Is

Hotjar is a behavior analytics suite offering session recordings, heatmaps, surveys, and feedback widgets, widely used by marketing and UX teams.

What It Does

Hotjar's script records visitor sessions — mouse movement, clicks, scrolling, and page interactions — and reconstructs them as replays. It suppresses keystroke capture by default for input fields but configuration and custom widgets can change what is captured.

Browser Communications Generally Observed

Batched requests to hotjar.com/hotjar.io endpoints containing serialized interaction data, page URLs, viewport data, and a visitor identifier. Recording generally begins at page load unless gated by a consent integration.

How Our Scanner Detects It

Our scanner identifies Hotjar's script and traffic, tests recording start relative to consent state, and uses synthetic marker input in forms to observe whether entered values are transmitted before submission.

Common Implementation Behavior

Typically installed via tag manager. Observed issues mirror other replay tools: recording on sensitive or form-heavy pages, incomplete masking for custom components, and consent banners that do not actually gate the recorder.

Litigation & Risk Context

As a session replay technology, Hotjar has been named in website tracking complaints under state interception statutes. Presence on a site — particularly where forms or sensitive content are involved — is a potential risk indicator that warrants review of masking, consent gating, and page-level exclusions. It is not a finding of illegality.

Tracked Cases Involving This Technology

Remediation Options Operators Commonly Consider

• Inventory every third-party script, pixel, and embed on the site and document what each transmits, to whom, and when (page load, pre-consent, during interaction, pre-submission).
• Gate non-essential tracking behind a consent management platform configured to actually block network transmission before consent — not merely hide a banner.
• Review and, where appropriate, disable optional data-capture features (advanced matching, automatic event capture, input/keystroke capture, session recording of form fields).
• Update the privacy policy and any consent language to accurately describe the third-party technologies in use and the data they receive.
• Re-scan after every tag manager or website change; tracking configurations drift over time.

Whether any option is appropriate for a specific website is a decision for the operator and qualified counsel.

Frequently Asked Questions

Does Hotjar capture form input?

Hotjar suppresses input capture by default, but custom implementations and non-standard form controls can leak entered values. Our scanner tests this empirically rather than relying on vendor documentation.

Related Intelligence

Sources

This page is based on direct technical observation by our scanner and vendor documentation; tracked litigation sources will be listed as the intelligence engine links them to this technology.

About This Page

Publisher: Inspection-Ready Institute, Inc. (DBA Crandall Consulting), an independent website compliance and risk consultancy. We are not a law firm and nothing on this page is legal advice.

How this content is produced: Facts are extracted from publicly available sources — court and government materials, recognized legal press, professional analysis, and industry reports — by our litigation intelligence engine, stored with full source provenance, and rendered from the database. Risk guidelines are computed by a deterministic formula, never by an AI model directly. See the full methodology.

Limitations: Counts labeled "Tracked" reflect matters identified in our source set and are not official court statistics. We report what courts decided and did not decide; we do not predict outcomes.

Corrections: If you believe anything on this page is inaccurate, contact us via the contact page and we will review the underlying sources promptly.