Hotjar is now Contentsquare: what the merger means for GDPR and pricing

Contentsquare had already acquired Hotjar in 2021; on 1 July 2025, Hotjar Ltd. (Malta) was fully merged into the Contentsquare Group. According to Hotjar's own help documentation, existing customers are being migrated to the Contentsquare platform step by step through 2026; new sign-ups land there directly (as of July 2026).

The most visible sign: hotjar.com/pricing now permanently redirects to contentsquare.com — verified by us with our own request on 13 July 2026.

In fairness: Contentsquare is a French company, founded in Paris in 2012 — not a purely American vendor. The group does, however, maintain a large US arm (Content Square, Inc., New York), which remains relevant for the privacy assessment.

The former Hotjar bundle was split into three separately priced product lines: Experience Analytics (heatmaps, session replay, funnels — Growth from 49 US dollars per month), Voice of Customer (surveys and feedback — Growth from 99 US dollars per month) and Product Analytics with custom pricing. This is documented by Quackback's analysis and Contentsquare's own support documentation (as of July 2026).

A curious detail: two entry prices are communicated in parallel — the Hotjar-path Growth at 49 US dollars and Contentsquare's own Growth tier, launched in late 2025, at 40 US dollars, for comparable features (per SaaS Price Pulse and getspike, as of July 2026).

The free tier deserves a second look too: 200,000 sessions per month sounds huge, but it is an analytics number — only around 5 percent of sessions are actually recorded, capped at roughly 10,000 replays per month (per Quackback, as of July 2026). A verified Capterra review from October 2025 describes price increases and hard-to-follow tiers after the acquisition as the reason for switching.

The positive first: Contentsquare lets customers choose their data location — AWS regions in Ireland and Frankfurt (at-rest there) are available alongside US East, and there is public data processing documentation including a subprocessor list (as of July 2026). That is a professional setup.

But: the infrastructure runs on AWS, a US cloud provider, and the official subprocessor list names US services with data access — including OpenAI as the LLM provider for the Sense Chat AI assistant, Zendesk and Salesforce (as of July 2026). A US cloud stack means the usual CLOUD Act debate — a structural legal consideration, not a documented incident.

And one thing has not changed: the tracking code sets cookies, none of which qualifies as strictly necessary. For EU traffic, opt-in consent before loading remains mandatory — Hotjar's own documentation recommends exactly that (as of July 2026).

If you are an existing Hotjar customer, the migration is coming your way regardless. That makes this the right moment to review your setup: which of the three product lines do you actually need, what will your path cost after the migration — and are your DPA, consent integration and data-location choice still correct?

Budget for friction, too: there is more platform to learn than before, the packaging is spread across several modules, and for paid plans one third-party source estimates two to four weeks of implementation effort for event mapping and PII configuration (per getspike, as of July 2026) — while the free entry remains a simple script snippet.

The GDPR question in 2026 is less “is it legal?” — it is, with consent and a DPA — and more “how much effort and how much dependency?”. US subprocessors mean transfer safeguards and a dependency on the Data Privacy Framework; the details are in the guide.

And the honest visz.ai angle: we host EU-only with Hetzner in Germany, the snippet is cookieless-capable, and visz.ai is free. But you need consent for session replay with us too — EU hosting does not replace consent. Anyone selling you otherwise is selling you a problem.