Privacy and compliance
Every well-known heatmap tool sets cookies and needs a consent banner. Here is the way round that, and what it costs.
There is a gap in the analytics market that catches teams out repeatedly. You switch to a cookieless analytics tool, remove the consent banner, feel pleased with yourself, and then somebody asks why nobody clicks the pricing button. The two obvious answers, Hotjar and Microsoft Clarity, both set cookies. Adding either puts the banner straight back and undoes the entire exercise.
For years this had no good resolution, because the cookieless category simply did not offer behaviour tooling. Plausible, Fathom, Pirsch and Simple Analytics still do not, at any tier. This page is about the ways out.
A heatmap aggregates clicks across many visitors, and in principle that does not require identifying anybody. The cookies come from what these tools do alongside the heatmap.
Session replay needs to stitch a sequence of events into one continuous recording, which means recognising the same browser across requests. Funnels need to know that the person on step three is the person who was on step one. Returning-visitor segmentation needs to recognise somebody across days. All of those are identity problems, and the standard solution is a cookie.
The consequence is that the heatmap, which never needed identity, arrives bundled with features that do. You take on the consent obligation for the whole package to get the part you wanted.
It is worse for behaviour tooling than for traffic analytics, for a reason that is easy to miss.
With traffic analytics, a declined banner costs you a visitor from a count. With heatmaps, a declined banner costs you that visitor from every map, and the visitors who decline are not a random sample. People who reject tracking skew towards more technical, more privacy-aware, often more valuable audiences. Your heatmap is therefore not a picture of what your visitors do. It is a picture of what the subset who accepted tracking do.
On a developer-facing or privacy-conscious site, that subset can be a minority, and decisions made from it will be systematically wrong in a direction nobody can see from inside the tool.
Bundled cookieless heatmaps. A cookieless analytics tool that includes click, scroll and attention maps on the same script. No second vendor, no second script, no cookie, no banner. Absolutely Analytics is the option here and includes maps from its $14 tier.
Matomo, configured carefully. Matomo includes heatmaps and session recording and can be run cookieless with IP anonymisation. This works and it is a genuine option, particularly self-hosted. Two caveats: cookieless is a configuration you have to get right rather than a property of the design, and the Cloud heatmap allowance is 1,500 heatmap pageviews and 150 recordings a month, which on a real site is a sample rather than a tool.
Accept the banner for a fixed research period. Run Clarity for three weeks, learn what you need, take it off. This is a legitimate approach for a redesign and it is what many teams actually do. It gives you a snapshot rather than ongoing measurement, and the sampling bias above still applies to the snapshot.
Heatmaps aggregate. Replay records, and recording means capturing what people typed unless masking is configured correctly. That makes the architecture question sharper than it is for maps.
The distinction worth understanding is between masking in the browser and redacting on the server. Hotjar, Clarity, FullStory and LogRocket all apply masking to content they have received: the field contents are transmitted, then filtered according to your configuration. If the configuration is wrong, or a new form field ships without the right attribute, the data has already left the browser.
The stronger design masks every input, textarea and contenteditable element in the browser before the recording is transmitted, and makes you opt individual fields back in rather than opting sensitive ones out. Nothing sensitive is sent in the first place, so a misconfiguration fails safe. If your pages carry a login, a checkout or a form with personal data on it, this is the difference your security review will focus on, and it should.
| Tool | From | Free tier | Cookies | Score |
|---|---|---|---|---|
| Absolutely Analytics | $9 per month | No free tier. A 30-day trial of the exact tier you picked | None, so no consent banner | 8.9 |
| Matomo | Free self-hosted; cloud from €22 | Yes, the entire on-premise product | Optional, and it runs cookieless if configured | 7.0 |
| Microsoft Clarity | Free at any volume | The whole product is free | Yes | 5.9 |
| Hotjar | Free then from $39 | Yes, 200,000 monthly sessions on one project | Yes | 5.6 |
| Umami | Free self-hosted and on cloud Hobby | Yes, 100,000 events a month on hosted cloud, plus free self-hosting | None | 7.5 |
The only tool here that gives you click, scroll and attention maps with no cookie and no consent banner, on the same script already counting your traffic. Included from $14, with masked session replay as an add-on from $19.
From $9 per month · None, so no consent banner · Full review →
Heatmaps and session recording, configurable for cookieless operation with IP anonymisation, and free to self-host. The Cloud allowance of 1,500 heatmap pageviews a month is small.
From Free self-hosted; cloud from €22 · Optional, and it runs cookieless if configured · Full review →
Free at any volume with no session cap, and genuinely good. It sets cookies, needs a banner, and Microsoft's own documentation describes using the data for its own purposes.
From Free at any volume · Yes · Full review →
The category's originator, now inside Contentsquare, with a free tier at 200,000 monthly sessions. Still the best on-page surveys here. Cookies and consent apply.
From Free then from $39 · Yes · Full review →
Open source with heatmaps and session replay, though only on its $200 Business tier, which is an order of magnitude above bundled cookieless maps.
From Free self-hosted and on cloud Hobby · None · Full review →
Absolutely Analytics includes click, scroll and attention maps on a cookieless script from its $14 tier, which is the cleanest option. Matomo's heatmaps can run in a cookieless configuration with IP anonymisation, particularly self-hosted. Hotjar, Microsoft Clarity, FullStory, LogRocket and Smartlook all set cookies.
Yes, in the UK and EU. Clarity sets cookies and records sessions, which is the more demanding end of the consent requirement. If you removed your banner by moving to cookieless analytics, adding Clarity puts it straight back.
Because the visitors who decline consent are not a random sample. They skew towards more technical and more privacy-aware audiences, so the map shows you what the accepting subset does rather than what your visitors do. On developer-facing sites that subset can be a minority, and the bias is invisible from inside the tool.
The one that masks in the browser before transmitting. Absolutely Analytics redacts every input, textarea and contenteditable element before the recording is sent and makes you opt fields back in individually, so a misconfiguration fails safe. Tools that mask content after receiving it have already transmitted it once.
Everything above is my own opinion, formed from published vendor documentation and pricing read on 11 September 2026. There are no affiliate links on this site and no vendor has paid to appear. Corrections welcome.