Free account
CIPA § 631 Risk

Is Hotjar legal in California?

Session Replay & Heatmaps · Updated 2026

Hotjar records full session replays — mouse movement, scrolling, clicks, and form input — plus heatmaps of visitor behavior. Whether a particular implementation is lawful depends on its configuration, the information transmitted, disclosures, consent, and other facts. A request observed before a recorded consent choice is a technical signal to investigate, not a legal conclusion.

Is this tracker on your site? Find out free in 30 seconds.

Real browser scan, no signup to run it. You see a summary of the findings; the full report with every tracker unlocks with your email.

Why Hotjar can trigger CIPA claims

California's Invasion of Privacy Act (CIPA), Penal Code § 631, addresses specified forms of interception and related conduct. Plaintiffs have asserted that some website session-replay, chat, and pixel implementations fall within the statute when they capture interactions without valid consent. Courts assess the statute's application to the particular parties, data flow, timing, and other facts. Hotjar records full session replays (mouse, scroll, clicks, and form input), which California courts have treated as wiretapping under CIPA § 631 when done without consent.

CIPA § 637.2 authorizes statutory damages of up to $5,000 for a qualifying violation. Plaintiffs may argue that multiple sessions support multiple counts; RegSentry does not determine whether a violation occurred or predict recoverable damages.

Real-world enforcement

The California Attorney General reached a $1.2M CCPA settlement with Sephora over allegations involving sale disclosures and opt-out (Global Privacy Control) signals. That was a CCPA enforcement action, not a session-replay or CIPA case. Separately, private CIPA complaints involving session-replay and chat tools have named businesses in several industries. Those matters arise under different laws and facts and should not be treated as proof that a particular technical finding is unlawful.

How to reduce consent-timing risk involving Hotjar

  1. Do NOT load the Hotjar tracking snippet on page load. Gate it behind your CMP so it only initializes after the visitor consents to analytics/session recording.
  2. In Hotjar, enable form field suppression so input contents are never captured even when recording is allowed (Settings → Suppression).
  3. If you use GTM, set the Hotjar tag to require consent before firing.
  4. Re-scan with 'Verify fix' to confirm no requests go to *.hotjar.com before consent.

Consent-gating snippet

// Only call this AFTER your CMP reports consent — never on initial load.
function loadHotjar(h,o,t,j,a,r){
  h.hj=h.hj||function(){(h.hj.q=h.hj.q||[]).push(arguments)};
  h._hjSettings={hjid:YOUR_HJID,hjsv:6};
  a=o.getElementsByTagName('head')[0];
  r=o.createElement('script');r.async=1;
  r.src=t+h._hjSettings.hjid+j+h._hjSettings.hjsv;
  a.appendChild(r);
}
// cmp.onConsent('analytics', () => loadHotjar(window,document,'https://static.hotjar.com/c/hotjar-','.js?sv='));

Move the standard Hotjar snippet into a function and only call it from your CMP's consent callback.

Hotjar's official privacy/consent documentation →

Check your own site

RegSentry runs a browser against authorized public pages and records when supported Hotjar and other third-party requests are observed relative to the test's consent state. Where supported, test-generated form interactions can help show the technical data flow. The scan does not decide whether a provider intercepted a communication or whether applicable law was violated.

Is this tracker on your site? Find out free in 30 seconds.

Real browser scan, no signup to run it. You see a summary of the findings; the full report with every tracker unlocks with your email.

← See all tracker compliance guides