Do heatmap tools (Hotjar, Microsoft Clarity) need consent?
Heatmaps and session recordings feel harmless, but they capture how real people move, click and sometimes type on your site. That is behavioural data, often personal data, so in the EU and UK they generally need consent before they run.
Why they need consent
Tools like Hotjar and Microsoft Clarity set cookies and record user behaviour, which falls under the same PECR and GDPR rules as analytics. Session recordings can even capture what people type, so they carry more privacy risk than a page-view counter, not less.
The setup that keeps you compliant
- Gate the tool behind consent, so it does not record until the visitor agrees, exactly like GA4.
- Turn on the tool's input-masking so form fields and sensitive data are never captured.
- Disclose it in your cookie policy.
The common mistake
People add a heatmap tool "just to see" and paste its snippet straight into the site, firing on load, ignoring the banner. That means it records before consent, the same problem as cookies loading after reject. Run it through your CMP like any other marketing or analytics tag.
Want us to check your tracking in 10 seconds?
Pop in your domain and we will show you what is firing, what is not, and where data is leaking. Free, no signup.
Check my tracking freeGet a plain-English audit
We check your live GA4, Google Tag Manager and consent setup by hand and tell you exactly what is wrong. The audit comes off any build.
See how it works & pricingDatahound are analytics and ad-tracking specialists. We fix broken GA4, Google Tag Manager and server-side tracking so every sale, form and call gets counted. Back to datahound.agency · All tracking guides · Does GTM itself need consent?