I wonder what your users would think of the fact that their every click was being recorded. I suspect the reason most people are not worried about this kind of stuff is that they're not aware how creepy it actually is.

I can respect that some people find it creepy, and I personally use AdBlock, which blocks HotJar as others mentioned. That said, I find a tool that records anonymous sessions detached from any sort of PII or even IP address much less offensive than something like Google Analytics, social login, or literally any advertising pixel.

What matters is consent.