All Vendors
session_replay
Hotjar

Hotjar

52.7% pre-consent tracking rate across 50 sites despite SOC 2 Type II, ISO 27001, and GDPR/CCPA-ready certifications. Own website loads 27 third-party vendors before consent including advertising pixels (Meta, Google, LinkedIn, Reddit, Twitter) and Apollo.io for B2B enrichment — none disclosed in their subprocessor list.

131 IOCs73 detections53% pre-consent50 sites
90
Vendor Risk Score

How This Briefing Works

This report opens with key findings, then maps the gaps between what Hotjar discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.

Key Findings

Key Findings

73 detections across 50 sites53% pre-consent activity1 critical disclosure gap
CRITICAL

Compliance Claim Mismatch

52.7% pre-consent tracking rate across 50 sites. Own website loads 27 vendors pre-consent including advertising pixels

GDPR Art 6(1)(a)GDPR Art 28CCPA 1798.100FTC Act Section 5
CRITICAL

Pre-Consent Activity

Hotjar was observed loading and executing before user consent was obtained on 53% of sites where it was detected.

GDPRePrivacy
HIGH

Undisclosed Subprocessors

14 vendors detected on hotjar.com not in subprocessor list: Apollo.io, MetaPixel, DoubleClick, LinkedIn, Reddit, Twitter, Optimizely, Segment, etc.

GDPR Art 28(2)GDPR Art 28(4)
HIGH

Privacy Marketing Discrepancy

Own website deploys pre-consent advertising pixels and B2B enrichment tools

FTC Act Section 5EU Unfair Commercial Practices Directive
HIGH

Undisclosed Party

Not in privacy policy

Disclosure Gaps

Claims vs. Observed Behavior

4 gaps
1 CRIT2 HIGH1 MED
Classified:BTI-X01BTI-X02BTI-X04BTI-X05BTI-X06BTI-X08BTI-X12

Compliance Claim Mismatch

GDPR Art 6(1)(a) · GDPR Art 28 · CCPA 1798.100 · FTC Act Section 5CRITICAL
They Claim

“SOC 2 Type II, ISO 27001, GDPR-ready, CCPA-ready”

Observed Behavior

52.7% pre-consent tracking rate across 50 sites. Own website loads 27 vendors pre-consent including advertising pixels

Runtime detection data shows systematic pre-consent loading; homepage screenshot shows privacy marketing claims

Undisclosed Subprocessors

GDPR Art 28(2) · GDPR Art 28(4)HIGH
They Claim

“Comprehensive subprocessor list at contentsquare.com/privacy-center/subprocessors/”

Observed Behavior

14 vendors detected on hotjar.com not in subprocessor list: Apollo.io, MetaPixel, DoubleClick, LinkedIn, Reddit, Twitter, Optimizely, Segment, etc.

Runtime scan vs subprocessor list comparison

Privacy Marketing Discrepancy

FTC Act Section 5 · EU Unfair Commercial Practices DirectiveHIGH
They Claim

“GDPR- & CCPA-ready displayed prominently on homepage”

Observed Behavior

Own website deploys pre-consent advertising pixels and B2B enrichment tools

Homepage states GDPR-ready; runtime scan shows MetaPixel, GoogleAds, LinkedIn, Apollo.io loading pre-consent

Gated Security Documentation

MEDIUM
They Claim

“SOC 2 Type II certified”

Observed Behavior

Report requires authenticated access or NDA

Trust Center shows certification badge but actual report behind authentication wall

Customer Impact

What This Means For You

If Hotjar is deployed on your site, their session recording captures detailed behavioral data — clicks, scrolls, form interactions, and page content. The 52.7% pre-consent rate means over half of observed implementations record sessions before users consent. Under GDPR Art 7 and ePrivacy Art 5(3), this creates direct liability for you as the site operator. Hotjar's own website loads Apollo.io (B2B visitor identification) and advertising pixels from Meta, Google, LinkedIn, Reddit, and Twitter before consent — none of which appear in their subprocessor list. Following Contentsquare's acquisition, your behavioral data may flow across the broader CS ecosystem including Heap. Hotjar's SOC 2 and ISO certifications cover their infrastructure, not your specific deployment or the undisclosed vendors on their own site.
Recommended Actions

What To Do About It

Role-specific actions based on observed behavior

If You Use Hotjar

  • →Audit your CMP configuration to ensure Hotjar script loads only after consent — 52.7% pre-consent rate indicates most deployments are non-compliant
  • →Review what data attributes you are passing to Hotjar — session recordings capture everything visible on screen including form inputs
  • →Do not rely on Hotjar's compliance certifications alone — request their SOC 2 report directly and review controls relevant to your data
  • →Monitor network requests on your site to verify no undisclosed third-party calls originate from the Hotjar script
  • →Consider whether Contentsquare (parent company) has access to your behavioral data following the acquisition

If You're Evaluating Hotjar

  • →Request the full SOC 2 Type II report before signing — do not accept compliance badge claims without verification
  • →Conduct a runtime scan of hotjar.com to understand their actual data practices versus their subprocessor disclosures
  • →Compare their subprocessor list against the 27 vendors detected on their own website — the gap is a transparency red flag
  • →Factor in the Contentsquare acquisition — your data may flow across the broader CS and Heap ecosystem
  • →Consider alternatives if your vendor approval requires demonstrable alignment between compliance claims and runtime behavior

Negotiation Leverage

  • →Pre-consent SLA: 52.7% pre-consent rate across 50 sites contradicts GDPR-ready claims. Require contractual guarantee that Hotjar script loads only after consent on your property, with consent mode verification before deployment.
  • →Subprocessor transparency: 27 vendors on hotjar.com including Apollo.io, Meta, and LinkedIn are not in their subprocessor list. Require complete enumeration of all data recipients including marketing vendors on their corporate site.
  • →Contentsquare data isolation: Following the 2021 acquisition, your behavioral data may flow across the Contentsquare/Heap ecosystem. Require contractual commitment that your Hotjar data is not shared with other Contentsquare products or customers.
  • →SOC2 scope verification: Request Hotjar's SOC 2 Type II report directly — do not accept certification claims alone. Verify controls cover client-side session recording behavior, not just server infrastructure.
  • →Session masking audit: Session recordings capture sensitive user interactions. Require Hotjar to provide documented masking configuration for your deployment and verify no PII leaks through recording gaps.
Runtime Detections

Runtime Detections

9 BTI-C CODES

BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.

BTI-C01Defeat Device

Evasion infrastructure, auditor bypass

BTI-C06Behavioral Biometrics

Keystroke/mouse tracking

BTI-C07Session Recording

Full session replay

BTI-C08Cross-Domain Sync

Identity stitching

BTI-C09Consent Bypass

Ignoring CMP signals

BTI-C10Fingerprinting

Device identification

BTI-C13Persistence Mechanisms

Long-lived identifiers

BTI-C14Identity Resolution

PII deanonymization

BTI-C15Tag Manager

Container/loader (neutral)

IOC Manifest

IOC Manifest

128 INDICATORS

Indicators of compromise across 6 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.

TRACK
*www.hotjar.com/_next/static/chunks/webpack-*.js*
Tracking script
TRACK
*www.hotjar.com/_next/static/chunks/*-*.js*
Tracking script
TRACK
*www.hotjar.com/_next/static/4o2p3r8oJS3nS5XeesMiL/_ssgManifest.js*
Tracking script
TRACK
*www.hotjar.com/_next/static/chunks/pages/index-*.js*
Tracking script
TRACK
*www.hotjar.com/_next/static/chunks/pages/_app-*.js*
Tracking script
TRACK
*www.hotjar.com/_next/static/chunks/main-*.js*
Tracking script
TRACK
*www.hotjar.com/_next/static/4o2p3r8oJS3nS5XeesMiL/_buildManifest.js*
Tracking script
TRACK
*www.hotjar.com/ensureSegmentId.js*
Tracking script
TRACK
*www.hotjar.com/_next/static/chunks/*.*.js*
Tracking script
TRACK
*www.hotjar.com/_next/static/chunks/framework.*.js*
Tracking script
TRACK
*www.hotjar.com/persistUtmParams.js*
Tracking script
TRACK
*www.hotjar.com/_next/static/chunks/pages/%5B...slug%5D-*.js*
Tracking script
TRACK
*www.hotjar.com/_next/static/chunks/*.undefined.js*
Tracking script
TRACK
*static.hotjar.com/c/hotjar-14.js*
Tracking script
TRACK
*script.hotjar.com/modules.*.js*
Tracking script
TRACK
*script.hotjar.com/survey-v2.*.js*
Tracking script
TRACK
static.hotjar.com
Tracking script
TRACK
www.hotjar.com/_next/static/chunks/webpack-335d2a52901dfa46.js
Auto-extracted from scan
TRACK
www.hotjar.com/_next/static/chunks/main-ad9e582a0c8a04bf.js
Auto-extracted from scan
TRACK
www.hotjar.com/_next/static/chunks/pages/_app-99dcf00c18f5e975.js
Auto-extracted from scan
TRACK
www.hotjar.com/_next/static/chunks/c78d26b1-f23f81ca8a2508b9.js
Auto-extracted from scan
TRACK
www.hotjar.com/_next/static/chunks/8847-6a9d34edb742e6b5.js
Auto-extracted from scan
TRACK
www.hotjar.com/_next/static/chunks/2665-d206e42ae94c9ee0.js
Auto-extracted from scan
TRACK
www.hotjar.com/_next/static/chunks/1278-7684c647ed111794.js
Auto-extracted from scan
TRACK
www.hotjar.com/_next/static/chunks/4248-d1a490e36324bbff.js
Auto-extracted from scan
TRACK
www.hotjar.com/_next/static/chunks/3613-4d29e21719e3359a.js
Auto-extracted from scan
TRACK
www.hotjar.com/_next/static/chunks/8092-354e5c6bcceee5c3.js
Auto-extracted from scan
TRACK
www.hotjar.com/_next/static/chunks/4813-11774f7c76799b23.js
Auto-extracted from scan
TRACK
www.hotjar.com/_next/static/chunks/1996-e1a4cf5f2bbbdad6.js
Auto-extracted from scan
TRACK
www.hotjar.com/_next/static/chunks/pages/index-ad273bec1a8decc5.js
Auto-extracted from scan
TRACK
www.hotjar.com/_next/static/4o2p3r8oJS3nS5XeesMiL/_buildManifest.js
Auto-extracted from scan
TRACK
www.hotjar.com/_next/static/4o2p3r8oJS3nS5XeesMiL/_ssgManifest.js
Auto-extracted from scan
TRACK
www.hotjar.com/persistUtmParams.js
Auto-extracted from scan
TRACK
www.hotjar.com/ensureSegmentId.js
Auto-extracted from scan
TRACK
www.hotjar.com/_next/static/chunks/framework.5566999d9841ed98.js
Auto-extracted from scan
TRACK
www.hotjar.com/_next/static/chunks/6037.bbdac128d4068cb1.js
Auto-extracted from scan
TRACK
www.hotjar.com/_next/static/chunks/4337.410eaccbe8b658a2.js
Auto-extracted from scan
TRACK
www.hotjar.com/_next/static/chunks/7034.4402244d45375c91.js
Auto-extracted from scan
TRACK
www.hotjar.com/_next/static/chunks/5270.6053dc0aef1a0eda.js
Auto-extracted from scan
TRACK
www.hotjar.com/_next/static/chunks/2732.b0fa70619ed35fbe.js
Auto-extracted from scan
TRACK
www.hotjar.com/_next/static/chunks/6749.7f1f5817ccfe9d48.js
Auto-extracted from scan
TRACK
www.hotjar.com/_next/static/chunks/1756.04038dd20b4d4385.js
Auto-extracted from scan
TRACK
www.hotjar.com/_next/static/chunks/3686-efe87ab45fbddff0.js
Auto-extracted from scan
TRACK
www.hotjar.com/_next/static/chunks/2321-26d5f6fad0b3fdaf.js
Auto-extracted from scan
TRACK
www.hotjar.com/_next/static/chunks/8271-54883f1632c758df.js
Auto-extracted from scan
TRACK
www.hotjar.com/_next/static/chunks/pages/%5B...slug%5D-2f05781b1c84bd85.js
Auto-extracted from scan
TRACK
www.hotjar.com/_next/static/chunks/2321.undefined.js
Auto-extracted from scan
TRACK
www.hotjar.com/_next/static/chunks/8271.undefined.js
Auto-extracted from scan
TRACK
static.hotjar.com/c/hotjar-14.js
Auto-extracted from scan
TRACK
script.hotjar.com/modules.5af39c695063f61775c4.js
Auto-extracted from scan
TRACK
script.hotjar.com/survey-v2.aedb8bf0b3069e2d06f4.js
Auto-extracted from scan
Ecosystem

Ecosystem & Supply Chain

Hotjar sits at a critical junction in the GTM surveillance ecosystem. As a behavior analytics platform deployed on 1.3+ million websites, it has deep visibility into user interactions. The platform was acquired by Contentsquare (parent company of Heap) in 2021, consolidating multiple analytics vendors under one umbrella. Hotjar is commonly loaded via Google Tag Manager and integrates with major marketing platforms (HubSpot, Segment, Salesforce). The presence of Apollo.io and advertising pixels on their own website suggests potential integration with B2B demand generation pipelines. Customers deploying Hotjar should understand that while the Hotjar script itself may be configured responsibly, the broader Contentsquare ecosystem includes data sharing relationships not fully disclosed in customer-facing documentation. Hotjar data flows to: AWS (hosting), Microsoft Azure (LLM), Snowflake (data warehouse), and potentially to the undisclosed advertising and enrichment vendors observed on their own website.
Loads (8)
Apollo IoAdaGoogleanalytics4OnetrustContentsquareRedditLinkedinSegment
Loaded By (10)
GoogletagmanagerAdbeatBasisBuyercaddyContactoutSegmentDigitalremedyJungroupReachinboxSojern
Evidence

Evidence Artifacts

Artifacts collected during analysis, available with evidence-tier access.

HAR Capture

Complete network capture with all requests and responses

IOC Manifest

131 detection signatures across scripts, domains, cookies, and network endpoints

Vendor Details