What click heatmaps show — and why you need them
A heatmap aggregates clicks, scroll depth and mouse movements across many visitors into a coloured map overlaid on your page. Red zones mark high activity; blue zones get ignored. Unlike raw click logs, a heatmap answers questions A/B tests alone cannot.
- Which CTAs get clicked — and which stay invisible?
- Where do users click into nothing (apparent buttons that aren't buttons)?
- How far do visitors actually scroll?
- Where do mobile users drop off vs. desktop users?
- Which images grab attention — and which get ignored?
- Are navigation elements placed where visitors look for them?
Microsoft Clarity research found that UI improvements based on heatmap insights typically lift conversion rates by double-digit percentages (Source: Microsoft Research). Heatmaps are among the most powerful conversion tools — when used correctly.
GDPR and heatmaps: when is consent required?
The legal assessment doesn't depend on the tool — it depends on the actual data processing. Three questions decide it: are cookies or similar storage techniques used? Are personal data (full IP, fingerprint, ID) transferred? Does data leave the EU to insecure third countries?
| Setup | Banner needed? | Legal basis | Third-country transfer |
|---|---|---|---|
| Classic heatmap vendors with cookies | Yes (ePrivacy / TDDDG) | Only with explicit consent | Often US-based |
| Cookieless first-party + IP anonymisation | Typically no | Legitimate interest (Art. 6 (1) f) | None — EU hosting |
| Session recording with plaintext input fields | Yes (even without cookies) | Consent recommended | Depends on host |
EU ePrivacy and German TDDDG since 2021 require prior consent for storing or reading information on a user's device. Cookieless tracking that writes nothing to localStorage falls outside this rule, provided no other identifying data is processed (Source: BfDI / TDDDG).
How cookieless heatmaps work technically
Instead of a unique user ID stored in a cookie, a GDPR-compliant heatmap stack uses a rotating daily key on the server. This key, combined with the anonymised IP and the user agent, produces a short-lived hash that recognises a session — but cannot be reconstructed after 24 hours. Result: no personal data, no re-identification risk.
No Set-Cookie, no localStorage write. ePrivacy / § 25 TDDDG doesn't apply.
Last octet (IPv4) or last 80 bits (IPv6) zeroed out server-side before processing.
Session recognition without personal reference — the key rotates every 24 hours automatically.
Tracker script delivered from your own domain — no cross-origin, no browser blocking.
5 steps to a GDPR-compliant heatmap setup
- Embed the tracker: a single script tag in
<head>is enough — no tag manager, no second vendor. Script lives on your own domain (first-party). - Verify server-side IP anonymisation: ensure your provider anonymises the IP before writing to logs — not just at reporting time. Document this explicitly in your data-processing agreement (DPA).
- Confirm EU hosting: data location must be contractually limited to EU/EEA. Hetzner (DE + FI), OVH (DE + FR) or comparable European providers qualify. AWS Frankfurt alone is not sufficient because of CLOUD Act exposure.
- Update your privacy policy: even without consent obligation, the privacy policy must explain what is collected, on what legal basis, and how long data is retained. A short, plain section on "reach measurement & heatmaps" suffices.
- Review the first heatmap after 24 h: with the tracker active, data accumulates. Reliable insights typically require ~1,000 click events per analysed element. Below that, heatmaps are statistically inconclusive.
Some vendors advertise as "cookieless" but still transfer data to US servers. Without explicit consent, that's not permissible under post-Schrems II case law. Always verify the actual data flow, not just the marketing copy.
Reading heatmap data correctly
The map is only the first step. Effective optimisation starts with the right question. Not "where do they click?" but: which clicks lead to conversion — and which don't? Always pair heatmap data with conversion events.
- Top click elements: do they match your planned conversion paths? If a hot zone sits on a non-clickable image, you're frustrating visitors.
- Scroll depth vs. CTA position: if 60 % of visitors don't scroll to the main action, move it closer to the top.
- Mobile and desktop separately: usage patterns differ significantly. A combined heatmap hides the most important differences.
- Find the click deserts: zones with zero activity signal that nothing important is there — or that what's there appears invisible.
- Combine with form analytics: heatmaps show where users click into a form; form analytics show at which field they drop off. Only the combination provides the answer.
Common heatmap pitfalls
- Interpreting too early: clusters under 1,000 events are often noise. Collect data first, conclude later.
- Ignoring seasonal effects: Black Friday heatmaps don't reflect everyday behaviour — always compare similar traffic periods.
- Testing on too many pages at once: focus each sprint on 1-2 high-value pages (homepage, key product page, checkout).
- Confusing heatmaps with A/B tests: heatmaps show what happens, A/B tests prove what works better. You need both.
- Trusting privacy claims unverified: ask for a written DPA with IP-anonymisation clause and EU hosting — not just a slide deck.
Heatmaps with XICTRAQ — ready out of the box
XICTRAQ ships click heatmaps, scroll heatmaps and session recordings as part of the privacy analytics suite — without cookies, without banner, with IP anonymisation and hosting in German data centres. The tracker snippet is a single HTML tag, served from your own domain. Data is visible in the dashboard within 60 seconds.
No cookies, no fingerprinting, no third party. Legal basis: legitimate interest.
Per-URL click heatmap, scroll depth, optional session recording with DOM replay.
Data-processing agreement with IP anonymisation and EU data location ready to sign.
Anyone already running cookieless analytics gets heatmaps included — no second snippet, no extra privacy policy section. Anyone still wrestling with classical analytics issues or rebuilding their GDPR foundation starts here.
Heatmaps with a sloppy third-party integration are, incidentally, one of the most common triggers of GDPR cease-and-desist letters — much like the prominent Google Fonts case. Switching to cookieless, EU-hosted tools removes this class of risk almost entirely. Concrete examples of fines and strategies for avoiding them are collected in our guide to avoiding GDPR fines.
Frequently asked questions about GDPR heatmaps
Do I really not need a cookie banner for heatmaps?
localStorage/sessionStorage, and transfers no personal data. The burden of proof rests on the website operator: get written confirmation from the vendor that no data point falls under ePrivacy / § 25 TDDDG. A blanket marketing claim is not enough.What's the difference vs. conventional analytics tools?
localStorage and transfers data to US servers (as of 2026). It therefore still falls under ePrivacy and post-Schrems II rules — a consent banner is normally required. Cookieless EU-only tools sidestep both by design.When do heatmaps deliver reliable data?
What must session recordings NOT contain?
data-private attributes or class allowlists. When in doubt, manually verify input fields are masked.Is IP anonymisation really sufficient?
What does a GDPR-compliant heatmap stack cost?
This article is based on data from: Clarity Research (Microsoft).