I promise I'm not a shill, but yes I do indeed love HotJar and find it essential for getting new sites off the ground. I've uncovered countless UX improvements by watching HotJar recordings. And thanks for your generous free tier!

I wonder what your users would think of the fact that their every click was being recorded. I suspect the reason most people are not worried about this kind of stuff is that they're not aware how creepy it actually is.

I can respect that some people find it creepy, and I personally use AdBlock, which blocks HotJar as others mentioned. That said, I find a tool that records anonymous sessions detached from any sort of PII or even IP address much less offensive than something like Google Analytics, social login, or literally any advertising pixel.

What matters is consent.

Can I do the opposite and only record events from known bots to determine their level of interactivity?

I sometimes buy fraudulent ad traffic and point it ad landing pages that should drive away humans, trying to fingerprint anything that sticks around. I'd be very interested in tracking bots that actually send you events.

Sounds creepy af. It's stuff like this that makes me keep javascript disabled whenever possible.

Naah, just install adnauseum [1] and thank advertisers for forcing you to use adblocker. Let them pay for all the manace they couse to you and help ad networks to build completely wrong profile on you.

[1] https://adnauseam.io/

Hehe yes since i installed adnauseum i love ad's...and i love that they have to pay for it, atm at 5732$ ;)

Make sure you keep all your software up to date. Malvertising is pretty common, and adnauseum does a great job at firing payloads on your machine.

It is the equivalent of installing an app that silently opens every attachment that is emailed to you.

They deny this, but I have no idea how accurate the denial is.

https://github.com/dhowe/AdNauseam/wiki/FAQ#does-adnauseams-...

They should make it so that it talks to a VM (with no persistent storage) and sends the links to be opened to it (with the current browser's context such as cookies, etc so attribution still works).

Had the same idea, but my OS is so uncommon that malware probably does not exist (if it's not a targeted attack).

It's also blocked by default by uBlock Origin, fortunately.

Funny you should say that, I just blacklisted hotjar this morning in noscript!

I think it goes so far as to be unethical, because it takes advantage of a gap in understanding[1] where most users aren't even aware of the possibility of this being possible.

[1] https://quinnkeast.com/writing/the-possibility-gap-its-time-...

On the one hand, I agree that the capability is concerning, but if it only records the behavior within a single visit and doesn't correlate it with an account, or across multiple visits, or across websites at all, I think that that probably wouldn't be much of an issue, for me at least.

However, I don't see a way to allow that without also making the aforementioned unwanted connections also possible.

Here's the documentation for passing a user identifier to Hotjar:

https://help.hotjar.com/hc/en-us/articles/360033640653-Ident...

This is a bit better than it used to be. At one point the documentation had a field for User Email Address, and only a footnote in some documentation suggested it be hashed. Still, for a company that chooses to use the feature, the session recording can be tied back to the user account and any data already associated with it.

Hashing email addresses doesn't really work. Most people don't use unique addresses per service and its easy to get a large list of email addresses that you can hash and do lookups in.

thanks