Session replay records visitors before they consent
Hotjar is initialised on every page load, so keystrokes and clicks are captured before any consent is given. In California that pattern is the basis of a wave of wiretap class actions; in the EU it is unlawful access to terminal equipment.
Hand off the fix
Send an engineering brief to your coding agent. Lawpatch re-scans to verify.
Analysis
The scan found the Hotjar SDK declared in package.json and initialised unconditionally in src/lib/analytics.ts, with no consent-management platform anywhere in the repository. Under CIPA §631 the Ninth Circuit has held that consent must precede recording — asking later does not cure it. In the EU, Fashion ID makes the site operator a joint controller for data a third-party script collects on page load, and Planet49 requires an affirmative, informed opt-in before non-essential storage or access.
Because Acme Fit is B2C and sells in California, plaintiff-firm exposure is the most immediate risk; EU enforcement usually follows a user complaint.
Evidence from your codebase
package.json:7Session replay SDK: @hotjar/browsersrc/lib/analytics.ts:4Session replay initialised (records user interactions) (Hotjar.init)repository-wideTrackers / session replay found but no consent management was detected
References only. Lawpatch never received or stored the contents of these files.
Matched precedents
Javier v. Assurance IQ, LLC
No. 21-16351, 2022 WL 1744107 (9th Cir. May 31, 2022) (unpublished) · U.S. Court of Appeals for the Ninth Circuit
Same fact pattern: a session-recording script captured form interactions before consent; retroactive consent was held insufficient.
Fashion ID GmbH & Co. KG v Verbraucherzentrale NRW
Case C-40/17, ECLI:EU:C:2019:629 · Court of Justice of the European Union
Embedding a third-party script that collects data on load makes Acme a joint controller for that collection.
Planet49 GmbH v Bundesverband der Verbraucherzentralen
Case C-673/17, ECLI:EU:C:2019:801 · Court of Justice of the European Union (Grand Chamber)
Consent for non-essential storage/access must be an active opt-in given before the script runs.
How this could play out
CIPA demand letter from a plaintiff firm
A firm running automated tests of California-facing sites detects Hotjar firing before consent and sends a pre-suit demand, followed by a putative class action under §631 and §637.2.
Exposure: Statutory damages of USD 5,000 per violation under Cal. Penal Code §637.2 claimed per class member, plus defence costs.
Complaint to an EU data protection authority
An EU user notices recording on the signup page and complains. The DPA asks for the legal basis and consent records for Hotjar; none exist for pre-consent sessions.
Exposure: Order to stop processing and delete recordings; administrative fine under GDPR Art. 83 up to EUR 20m or 4% of worldwide turnover.
Remediation · hours
Gate Hotjar (and every non-essential script) behind an opt-in consent manager; never record before consent.
- 1
Add a consent manager
Install a CMP (or a lightweight in-house banner) that exposes an `analytics` consent category defaulting to denied.
src/app/layout.tsx
- 2
Load Hotjar only after consent
Move `Hotjar.init` into a hook that runs when `analytics` consent is granted, and call Hotjar's opt-out when consent is withdrawn.
src/lib/analytics.ts
- 3
Mask sensitive inputs
Add `data-hj-suppress` to email, password and payment inputs even for consenting users.
src/app/signup/page.tsx
Done when
- With no stored consent, no request to *.hotjar.com is made on any page
- Granting analytics consent starts recording without a reload; withdrawing it stops recording
- Consent choice is stored with timestamp and banner version