• Badge: ⬜ No badge
• Red Flags:
  • Keine
• Risk Indicators:
  • [not documented]

Framework Change: Under the revised badge attribution framework (v2.1), default-on tracking or session recording that can be fully resolved by deploying a standard consent banner (CMP) is treated as NORMAL behaviour and does not lead to a Caution badge. This applies to Hotjar: the Hotjar script fires before consent in unconfigured default mode, but it can be fully and reliably blocked by a CMP until consent is granted. This is the standard controller measure for any tracking tool. RISK INDICATORS PRESENT: None that are structural. Hotjar does not profile users for its own advertising purposes, does not share data with advertising networks, and does not engage in cross-publisher tracking.

Key Facts: Hotjar (part of Contentsquare group) is a session recording, heatmap, and on-site survey tool. It does not sell data or build advertising profiles. Data is stored within the EEA (Malta HQ). DPA available; SCCs apply to any sub-processor transfers. No red flags triggered (RF1, RF2, RF3, RF4 all absent). With CMP integration, Hotjar is a configurable analytics tool with a standard compliance profile.

Quellen:

• Hotjar Privacy Policy (hotjar.com/legal/policies/privacy)
• Hotjar GDPR Commitment (hotjar.com/for-marketers/gdpr)
• Hotjar DPA (hotjar.com/legal/policies/data-processing-agreement)
• Contentsquare Privacy Policy.

• Improve the service
• Personalise the website

• TPP Notified?: Not yet notified
• Decision Contested?: [not documented]