Hotjar on your website.
Does it record before anyone is asked?
Hotjar records clicks, mouse movement and scrolling and sets cookies such as _hjSessionUser. The script starts as soon as it loads, so before the choice if the banner does not hold it back.
Your account after the first check

Sample shop. Every point opens its fix with the steps for your tool.
Where Hotjar loads past the banner
The banner only holds Hotjar back if it knows the code. It usually sits right in the theme or comes through a plugin.
- 01
Code hard-coded in the theme
The Hotjar code loads static.hotjar.com/c/hotjar-….js from the header. It runs with every page, regardless of the banner.
Art. 5(3) Directive 2002/58/EC
- 02
Plugin or Tag Manager
The Hotjar plugin for WordPress or a Hotjar tag in Tag Manager without a consent check starts recording on the first page view.
Art. 5(3) Directive 2002/58/EC
- 03
Recording on every page
If Hotjar also runs on cart, checkout or account pages, it sees inputs and page content there. Where you do not need the analysis, it does not belong at all.
Art. 5(3) Directive 2002/58/EC
Step by step
Measure
Open the page in a private window, developer tools (F12), Network tab, filter for “hotjar” and reload without touching the banner. Under Application, Cookies look for _hj. The report does this for every page it reads.
Only after consent
In the banner tool assign Hotjar to the statistics category (script address static.hotjar.com) or tie the tag to consent in Tag Manager.
Only where needed
Load Hotjar only on the pages you want to analyse and leave out checkout and account.
Measure again
Check again without consent and after “Reject”. Only when no request to hotjar.com is left in the list and no _hj cookie appears does Hotjar no longer record before the choice.
Questions
Which cookies does Hotjar set?
Among others _hjSessionUser_ and _hjSession_ with your site ID. Before the choice they only appear if the script loads without waiting for consent.
Does this apply to Microsoft Clarity too?
Yes, Clarity records as well. What is different there is in the <a href="/en/guides/microsoft-clarity-consent">Microsoft Clarity</a> guide.
How does this work in my banner tool?
See the guides for <a href="/en/guides/google-tag-manager-consent">Google Tag Manager</a>, <a href="/en/guides/cookiebot-not-blocking">Cookiebot</a>, <a href="/en/guides/usercentrics-not-blocking">Usercentrics</a>, <a href="/en/guides/borlabs-cookie-not-blocking">Borlabs Cookie</a>, <a href="/en/guides/real-cookie-banner-not-blocking">Real Cookie Banner</a> and <a href="/en/guides/complianz-not-blocking">Complianz</a>.
What a scan shows
It opens your website without consenting, also reads subpages, then clicks Reject and measures again. If Hotjar loads in advance, the report names the page, where it comes from and the fix for your banner tool. Right away for your website: cookie check.
As of 15 November 2026. We name the reference so you can read it yourself; this is not legal advice.
More guides
- Cookies before consent: what ePrivacy requires
- Price information in web shops: unit price and shipping
- European Accessibility Act checker for web shops (WCAG)
- Cookiebot not working or not blocking?
- Usercentrics not blocking?
- Borlabs Cookie not blocking?
- Real Cookie Banner not blocking?
- Complianz not blocking?
- Check your cookie banner yourself in three steps
- Google Fonts self-hosted but still loading?
- Dark patterns in online shops: five patterns and the fix
- EU withdrawal button 2026: what your shop needs
- Unit price and the “order with obligation to pay” button
- GPSR: manufacturer information in your web shop
- OneTrust not blocking cookies?
- CookieYes not blocking or not working?
- Wix cookie banner check: does it really block?
- GTM consent: fire tags only after consent in Tag Manager
- Google Maps embed and GDPR: load the map only after a click
- YouTube embed and GDPR: load the video only after a click
- Google Analytics without consent?
- Meta Pixel before consent?
- TikTok Pixel before consent?
- Microsoft Clarity consent mode: check what it sends
- Google reCAPTCHA and GDPR: load it only on the form page
- HubSpot cookie banner not showing?
- Shopify cookie banner check: does it really block?
- Google Consent Mode v2 checker: test and set it up
- Cookie checker for websites: free, with the reject test
- Security headers check: free website security checker