How This Briefing Works
This dossier opens with key findings, then maps the gap between what Hotjar discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection evidence underneath. BLACKOUT observes runtime browser behavior and cites the regulations that address each pattern — legal determinations are your counsel's call.
At a Glance
across 71 sites
vendor fires before consent
1 CRIT · 2 HIGH
Briefing
Hotjar is a behavior analytics platform acquired by Contentsquare in 2021, providing heatmaps, session recordings, and surveys to over 1.3 million websites. Despite extensive compliance certifications (SOC 2 Type II, ISO 27001, GDPR/CCPA claims), runtime analysis reveals a 52.7% pre-consent tracking rate across 50 detected sites. More critically, Hotjar's own website loads 27 third-party vendors before consent, including advertising pixels (Meta, Google, LinkedIn, Reddit, Twitter) and B2B enrichment tools (Apollo.io) that are not disclosed in their subprocessor list. This creates significant gaps between their privacy marketing (GDPR-ready, CCPA-ready) and actual data collection practices, representing material misrepresentation risk for customers relying on Hotjar's compliance claims.
What This Means For You
If Hotjar is deployed on your site, their session recording captures detailed behavioral data — clicks, scrolls, form interactions, and page content. The 52.7% pre-consent rate means over half of observed implementations record sessions before users consent. Under GDPR Art 7 and ePrivacy Art 5(3), this creates direct liability for you as the site operator. Hotjar's own website loads Apollo.io (B2B visitor identification) and advertising pixels from Meta, Google, LinkedIn, Reddit, and Twitter before consent — none of which appear in their subprocessor list. Following Contentsquare's acquisition, your behavioral data may flow across the broader CS ecosystem including Heap. Hotjar's SOC 2 and ISO certifications cover their infrastructure, not your specific deployment or the undisclosed vendors on their own site.
Risk Channel Breakdown
Hotjar captures detailed behavioral data (clicks, scrolls, form interactions) that feeds into customer analytics decisions. When this same data is simultaneously shared with undisclosed advertising platforms and B2B enrichment services, it corrupts the measurement chain. Customers believe they are getting first-party behavioral insights, but the data is also flowing to third parties who may use it for competitive intelligence or cross-site tracking.
The presence of Apollo.io (B2B visitor identification) and multiple advertising pixels on Hotjar's own website demonstrates the platform participates in the demand signal leakage ecosystem. Website visitors—including Hotjar's own customers and prospects—have their data captured and potentially enriched for sales outreach by third parties. This same infrastructure may be present on customer sites using Hotjar.
Session recordings and heatmaps capture detailed user interactions that could include sensitive information inadvertently displayed or entered. With 27 third-party vendors loading pre-consent on their own site, the attack surface extends to every undisclosed data recipient. Each advertising pixel and analytics tool represents a potential data breach vector that Hotjar has not disclosed to users.
The gap between Hotjar's compliance marketing (SOC 2, ISO 27001, GDPR-ready, CCPA-ready) and their actual 52.7% pre-consent tracking rate creates direct liability for customers. Organizations using Hotjar while representing GDPR compliance to their own users may be inadvertently making false statements. The undisclosed subprocessors on Hotjar's own website demonstrate they do not practice what they market.
Threat Indicators
Runtime-observed (BTI-C)
Evasion infrastructure, auditor bypass
Keystroke/mouse tracking
Full session replay
Identity stitching
Ignoring CMP signals
Device identification
Long-lived identifiers
PII deanonymization
Container/loader (neutral)
Claims-vs-Reality (BTI-X)
Not in privacy policy
Hidden data recipients
Behavior contradicts marketing
False certification claims
Data to undisclosed regions
Collection exceeds disclosed scope
Gated or missing due diligence docs
Per-code narrative explanations of what each detected behavior means for your organization
Per-code evidence with full attribution chain, severity rankings, and consequence narratives See pricing →
Claims vs. Reality
BLACKOUT analyzed Hotjar's public claims against observed runtime behavior and identified 4 contradictions.
"SOC 2 Type II, ISO 27001, GDPR-ready, CCPA-ready"
52.7% pre-consent tracking rate across 50 sites. Own website loads 27 vendors pre-consent including advertising pixels
3 more gaps — with regulatory citations and evidence pointers — available with subscription.
Full claim-vs-reality gap analysis with claim text, observed behavior, severity, regulatory citations (GDPR, CCPA, ePrivacy), and evidence pointers per gap See pricing →
What To Do
5 for current users · 5 for evaluators
contractual leverage points
Role-specific actions (security / legal / marketing / procurement), full negotiation brief with contractual language, and BTI-code-specific consequences See pricing →
Supply Chain & Pairings
Claims 11, observed 11
googletagmanager, googleanalytics4, linkedinads…
Full supply-chain mapping (loads / loaded-by lists with vendor identities) and the undisclosed-subprocessor list with observation evidence See pricing →