Does Hotjar Work in China? Session Replay, Sensitive Data & PIPL Residency
Hotjar records your visitors — their clicks, mouse movements, scrolls and the pages they see — and stores those session replays on Amazon Web Services in Ireland (EU), with no mainland-China region. For mainland China that is a PIPL cross-border transfer of behavioral personal data, and a data-residency question Hotjar can't answer. A compliance-first look.
Does Hotjar work in China?
Whether you can use Hotjar for mainland China is first a cross-border-data and residency question, not a speed one. Hotjar is a session-recording and heatmap tool you embed as a script, and it works by recording your visitors — so the moment it runs for a mainland user, you are handling that person's behavioral data.
In Hotjar's own documentation a recording "continuously records ... live user actions, such as mouse movements, clicks, scrolls, and keystrokes," and "this data is then stored and processed by Hotjar's servers." Hotjar does suppress keystrokes typed into input fields before they leave the browser, but it also states that eliminating the remaining personal data in a recording is "the responsibility of Hotjar customers." And it stores that data "in Ireland, European Union (EU) on the Amazon Web Services infrastructure," with "sub-processors, some of which are located outside of the EU" and no mainland-China region. So your China visitors' session replays are held offshore — a cross-border transfer of personal information that PIPL governs, needing notice, separate consent, a transfer mechanism, and — for a CIIO or large-volume handler — in-country storage. The table below is Hotjar's own wording and the rules it triggers.
This is a risk picture, not a verdict — your duties turn on what your recordings capture, your data volumes and your role. Our China team can map your Hotjar exposure with you →
What Hotjar's own documentation says about China
| Fact | Primary source |
|---|---|
| In Hotjar's own words, a recording reconstructs what each visitor did. Its technical guide says Hotjar "captures the initial HTML content and DOM tree" of the page and then, "as the user interacts with the webpage, the DOM captures various user actions, including clicks, mouse movements, scroll behavior, and keystrokes." The result is "not a screen-recording but a reconstruction of events" in which Hotjar "continuously records these live user actions ... This data is then stored and processed by Hotjar's servers." A reconstruction of what a person did on your site, session after session, is behavioral personal information under Chinese law. | Hotjar Documentation — How do Recordings Work: Advanced Explanation, retrieved 2026-10-07 |
| Hotjar hides typed keystrokes by default — but puts the rest of the personal data on you. Its Data Safety page states that "when collecting data with Recordings, Hotjar automatically suppresses keystroke data on all input fields," client-side, so it "never reaches our servers," and that "no end-user IP addresses are stored at rest." Its recordings guide is then explicit that "while Hotjar automatically suppresses some personally identifiable information before it is sent to our servers, it's the responsibility of Hotjar customers to ensure that any collected data is suppressed to eliminate any personally identifiable information." So personal data that is on the page — not typed into a suppressed field — can still be captured unless you suppress it yourself. | Hotjar Documentation — Data Safety, Privacy & Security; How do Recordings Work, retrieved 2026-10-07 |
| Those recordings are stored offshore, in the EU. Hotjar states that "user and usage data that Hotjar collects through its software is stored in Ireland, European Union (EU) on the Amazon Web Services infrastructure, eu-west-1 data centers," and that it has "designated sub-processors, some of which are located outside of the EU." It describes itself as "a company based in the European Union" and is now part of the Contentsquare group. [Inference: Hotjar names only Ireland (eu-west-1) and sub-processors outside the EU, and publishes no mainland-China region — so a mainland visitor's recordings are held outside China.] | Hotjar Documentation — Data Safety, Privacy & Security, retrieved 2026-10-07 |
| Sending that data out of China is a cross-border transfer under PIPL. Session recordings and behavioral data captured from mainland visitors are personal information, and exporting them to Hotjar's EU-hosted servers is a cross-border transfer governed by PIPL: the personal-information handler — you, Hotjar's customer, not Hotjar — must give notice, obtain separate consent, and satisfy one transfer mechanism (a CAC security assessment, the CAC standard contract, or certification). Where a recording captures sensitive personal information, PIPL adds further consent and necessity duties on top. | PIPL Chapter III, Articles 38–43 |
| The exposure scales with volume and role. Since the CAC's March 2024 cross-border rules, a non-CIIO transferring fewer than 100,000 individuals' non-sensitive personal information in a calendar year is exempt from the security assessment, standard contract and certification. But for a CIIO or large-volume handler, personal information collected in China must be stored inside the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — and because Hotjar runs no mainland region, the only way to keep that data on Chinese soil is to capture and store it on infrastructure inside the mainland. | CAC — Regulations on Promoting and Regulating Cross-border Data Flows, March 2024; PIPL Article 40; CSL Article 39 (formerly Article 37) |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the deciding question about Hotjar is not how quickly its heatmaps render — it is whose behavior has to leave the country for them to exist. Hotjar is a session-recording and heatmap tool, and the way it works is by recording your visitors: it reconstructs what they did on each page, then stores and plays that session back to you from its own servers. Point it at your mainland visitors and you are exporting their session replays and behavioral data across the border — something China’s privacy law governs directly. Whether Hotjar’s recording script happens to reach a given browser on a given day is a delivery detail; where the recordings are stored, and what they capture, is the exposure.
Hotjar in China at a glance
| What decides it | In Hotjar's own terms |
|---|---|
| What it records | Hotjar “continuously records ... live user actions, such as mouse movements, clicks, scrolls, and keystrokes,” captured from the page's DOM and reconstructed into a replay that is “not a screen-recording but a reconstruction of events.” That is behavioral personal data. |
| What it hides | “Hotjar automatically suppresses keystroke data on all input fields,” client-side, so typed text “never reaches our servers,” and “no end-user IP addresses are stored at rest” — but eliminating any remaining personal data is “the responsibility of Hotjar customers.” |
| Where it's stored | “Stored in Ireland, European Union (EU) on the Amazon Web Services infrastructure, eu-west-1 data centers,” with “sub-processors, some of which are located outside of the EU.” No mainland-China region is named. |
| Who holds it | Recordings stream over a WebSocket “to Hotjar's servers”; Hotjar is “a company based in the European Union,” now part of the Contentsquare group. The data lands outside the mainland. |
| The residency rule | Exporting China users' session and behavioral data is a cross-border transfer under PIPL (notice, separate consent, a transfer mechanism); CIIOs and large-volume handlers must store it in the mainland — which an EU-hosted Hotjar cannot do. |
A session replay is behavioral personal data
Hotjar doesn’t wait for you to gather anything extra — the recording is the data collection. In Hotjar’s own technical guide, a recording begins when Hotjar “captures the initial HTML content and DOM tree” of the page, and then, “as the user interacts with the webpage, the DOM captures various user actions, including clicks, mouse movements, scroll behavior, and keystrokes.” The result, Hotjar is careful to say, is “not a screen-recording but a reconstruction of events” — Hotjar “continuously records these live user actions … This data is then stored and processed by Hotjar’s servers.” A reconstruction of what a person did on your site, session after session, is behavioral personal information under China’s law. So the instant Hotjar runs for a mainland visitor, you are handling that visitor’s personal data — and handling it by shipping it to Hotjar.
Hotjar hides keystrokes — but hands you the rest
Hotjar is more conservative than some peers about typed text: its Data Safety page states that “when collecting data with Recordings, Hotjar automatically suppresses keystroke data on all input fields,” and that this happens “client-side, the user’s browser, which means it never reaches our servers.” It also assigns each visitor a “unique user identifier, UUID” instead of storing their address, noting that “no end-user IP addresses are stored at rest.” That genuinely lowers how much sensitive data a recording carries, and it is worth saying plainly. But Hotjar draws the line in its recordings guide: “while Hotjar automatically suppresses some personally identifiable information before it is sent to our servers, it’s the responsibility of Hotjar customers to ensure that any collected data is suppressed to eliminate any personally identifiable information.” In other words, suppression of typed fields is automatic; eliminating the personal data that simply appears on the page — a name, an order detail, an account number rendered in a layout the visitor scrolled past — is left to you. A recording can therefore still carry personal, and sometimes sensitive, information, and PIPL attaches heightened duties to sensitive personal information wherever it does.
The recordings live in the EU, on AWS — outside the mainland
Asked plainly where it keeps this data, Hotjar answers in its Data Safety documentation: user and usage data “is stored in Ireland, European Union (EU) on the Amazon Web Services infrastructure, eu-west-1 data centers,” inside an “Amazon Virtual Private Cloud,” with “designated sub-processors, some of which are located outside of the EU.” Hotjar describes itself as “a company based in the European Union” and is now part of the Contentsquare group; nowhere does it name a region inside mainland China. So your China visitors’ session data sits on Hotjar’s cloud outside the mainland. Under China’s Personal Information Protection Law that is a cross-border transfer, and the handler — you, not Hotjar — must give notice, obtain separate consent, and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification, under Articles 38–43. For a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty an EU-hosted Hotjar cannot meet, and one no setting inside Hotjar changes.
Whether the script loads is not what decides it
Hotjar runs by embedding a script that opens, in its own words, “a WebSocket connection … between the user’s browser and Hotjar’s servers,” over which the “captured data is then transmitted … to Hotjar’s servers.” Whether that connection forms cleanly from any given mainland line is a delivery question, and not the one that decides whether you may use Hotjar. Even on the sessions where the script loads perfectly, it loads in order to stream your visitors’ behavior offshore; a faster or steadier path would only export those recordings more efficiently, not make the transfer lawful. The half that settles whether Hotjar is usable for China is the legal one — what the recordings capture, where they are stored, and under whose law — not the network one.
This is a risk map, not a verdict: whether you owe separate consent, a transfer mechanism, in-country storage, or all three turns on what your recordings capture, how much personal data you hold, and who your users are — worth settling with counsel before you rely on it.
Where 21YunBox fits — a compliant overlay, not a migration
You keep running Hotjar exactly as you do now. What we add is the piece Hotjar leaves to you: ICP-filed, in-country delivery placed in front of your existing origin inside mainland China — no rebuild, no second codebase, and no move off your current analytics. Our China team traces where your visitors’ recordings travel today, weighs your PIPL cross-border and data-residency duties against your entity and your data volumes, and builds the lawful, in-mainland foundation a compliant China presence needs — while Hotjar and the rest of your stack keep running where they already are.
Related reading:
