What is the _hjSessionUser_ cookie?
_hjSessionUser_ is an HTTP cookie used by Hotjar, a behavioral analytics service offering heatmaps, session recordings, and on-site surveys. The name shown in the browser is not exactly this string — it also contains a numeric ID of the site registered in the owner's Hotjar account, for example _hjSessionUser_1234567.
The cookie appears on a site as soon as the Hotjar tracking script loads and starts monitoring the visitor, typically on the first interaction with the page. It is set by Hotjar's JavaScript snippet, added to the site by its administrator.
What data it stores
The cookie stores a unique user identifier (UUID) generated by Hotjar to recognize the same visitor on repeat visits. The exact internal format of the value is not publicly documented in detail by the provider and may vary.
Data linked to this identifier is sent to Hotjar's servers (part of Contentsquare), where it is combined with behavioral data such as pages visited, mouse movement, clicks, and scrolling.
What it is used for
The main purpose is recognizing the same user across multiple sessions and visits, so Hotjar can build consistent behavioral statistics — aggregated heatmaps, funnels, session recordings — without counting the same person more than once.
For the site owner, this cookie underlies the usage reports Hotjar provides, helping them understand how visitors navigate and interact with pages.
Does it require consent?
In CookieFix's classification, _hjSessionUser_ falls under statistics (analytics). Under the ePrivacy Directive (2002/58/EC, transposed in Romania via Law 506/2004) and GDPR, behavioral analytics cookies are not strictly necessary for the site to function, so they require the visitor's prior consent before being set.
- The site administrator must disclose this cookie in the cookie policy, including provider, purpose, and duration.
- The Hotjar script should load only after the visitor accepts the statistics category, not by default.
- A data processing agreement (DPA) with Hotjar/Contentsquare is advisable, especially if features like session recordings are used.
How to block or delete _hjSessionUser_
A visitor can delete or block this cookie via browser settings (Chrome, Firefox, Edge, and Safari all allow removing cookies per site or blocking third-party/tracking cookies), or through tracker-blocking browser extensions.
For the site administrator, the correct approach is preventing the Hotjar script from running at all before consent. A consent management platform (CMP) such as CookieFix automatically blocks the Hotjar script until the visitor agrees to the statistics category, preventing the _hjSessionUser_ cookie from being set without authorization.
Frequently asked questions
It's a cookie set by Hotjar to uniquely identify a visitor across multiple sessions for behavioral analytics such as heatmaps and session recordings.
It typically lasts 1 year from being set, though the exact duration can vary depending on the site's Hotjar account configuration.
Yes, since it's a statistics/analytics cookie, it requires the visitor's prior consent under GDPR and the ePrivacy rules.
The number in the cookie name (e.g. _hjSessionUser_1234567) is the site ID within the owner's Hotjar account, used to separate data between different websites.