Why HubSpot Tracking Needs a Real Consent Signal

HubSpot deposits a number of first-party cookies on a visitor's device as soon as the tracking script (the HubSpot JavaScript snippet, typically hs-scripts.com/{hub_id}.js) executes. The most consequential are __hstc, hubspotutk, and __hssc, which together identify the visitor across sessions, link form submissions back to anonymous browsing history, and feed lead-scoring models in the CRM. Under the GDPR and the ePrivacy Directive, all three are non-essential cookies that require freely given, specific, informed, and unambiguous prior consent. Loading the snippet in the document head — which is HubSpot's default integration pattern — places those cookies before the visitor has been asked anything at all.

The consequences are not theoretical. Data protection authorities in France, Italy, and Spain have all issued enforcement actions in the last two years against organizations whose marketing stacks set tracking cookies prior to consent. The fines have ranged from five-figure penalties for small publishers to multi-million-euro penalties for large enterprises. HubSpot's native cookie banner exists, but it is intentionally lightweight and does not, on its own, block the snippet from firing. Most compliance reviewers treat it as a notice layer rather than a control layer.

What HubSpot Actually Tracks

Before deciding how to gate HubSpot, it helps to be precise about which categories of processing are in play. HubSpot's tracking surface splits into four overlapping buckets, each with its own consent implications.

Behavioral analytics

Pageview, click, scroll, and session-duration events are collected automatically once the tracking code loads. These events build the visitor timeline you see inside HubSpot's contact records and are the foundation of every lead-scoring or workflow rule. From a regulator's perspective this is straightforward analytics tracking and requires opt-in consent in the EU and EEA. In the UK the ICO's 2023 guidance treats it identically.

Forms and chat

HubSpot forms and the HubSpot chat widget (formerly Drift integration) can be configured to load independently of the main tracking script. Form submissions are, in most legal analyses, considered a separate processing activity with its own lawful basis — typically contract performance or legitimate interest. Chat that records transcripts on a third-party server, however, generally requires consent for the recording itself.

Cross-domain identity stitching

If you use the same HubSpot portal across multiple domains, the snippet will attempt to set and read cookies in a way that links visitors across those properties. This crosses into what the EDPB calls "tracking" in the strict sense and is the highest-risk category. It is also the one most likely to be flagged during a DPIA.

Marketing integrations

HubSpot can push events to Google Ads, Meta, LinkedIn, and other ad networks via its integrations. Each of those onward transfers carries its own consent requirement and, in the EU, its own data transfer assessment.

Native HubSpot Banner vs. Third-Party CMP

HubSpot ships a built-in cookie consent banner that you can enable from Settings > Privacy & Consent. It will display a configurable notice, log a consent record against the contact, and respect a single opt-out for analytics. For very small organizations operating in low-risk jurisdictions, it can be enough. For anyone serious about compliance — or anyone running consent-mode-aware advertising — it is not.

The reasons to move to a third-party CMP are practical:

• Granular categories. The native banner does not separate strictly necessary, functional, analytics, and marketing cookies into distinct toggles, which is the structure regulators expect.
• IAB TCF and GPP support. If you participate in programmatic advertising, you need a Google-certified CMP that emits a valid TC string. The native HubSpot banner does not do this.
• Consent Mode v2. Google now requires consent signals delivered in the v2 format for EEA traffic. A dedicated CMP wires this end-to-end, including the default-deny configuration.
• Multi-language and accessibility. Most CMPs ship with 30+ language packs and WCAG-compliant defaults. HubSpot's built-in banner is more limited.
• Audit-grade logging. A dedicated CMP records each consent decision with timestamp, banner version, and choice — the evidence regulators ask for in investigations.

Step-by-Step Integration with a Third-Party CMP

The integration pattern that works reliably is to keep the HubSpot snippet on the page but prevent it from executing until a consent decision is recorded. Below is the canonical approach, written generically so it applies to any modern CMP including FlexyConsent.

1. Remove the default snippet from the document head

In your site template, delete the inline <script> tag that loads hs-scripts.com/{hub_id}.js. Replace it with a placeholder that your CMP can activate later, typically by setting the type attribute to text/plain and adding a category data attribute such as data-category="marketing".

2. Map HubSpot to the correct consent category

Most CMPs use the IAB TCF or a four-bucket model: necessary, functional, analytics, marketing. HubSpot's tracking script touches both analytics and marketing categories because of the CRM integration. The conservative mapping is to gate the entire snippet behind the marketing category, which is the most restrictive bucket. If your CMP allows fine-grained mapping, you can split: load forms under functional, load analytics events under analytics, and load CRM identity stitching under marketing.

3. Configure the activation callback

Your CMP exposes an event or callback that fires when a user grants consent for a category. In that callback, rewrite the placeholder script tag's type attribute back to text/javascript and append it to the document. The script will then load and execute normally. For an SPA, register the callback on every route change so newly mounted pages also receive the activation.

4. Wire Consent Mode v2

If you use Google Ads or GA4 alongside HubSpot, your CMP needs to push the v2 consent signals — ad_storage, analytics_storage, ad_user_data, ad_personalization — into the dataLayer before any Google tag fires. HubSpot itself does not consume these signals, but the rest of your stack does, and inconsistency between HubSpot and Google will show up in your reporting as a measurable revenue gap.

5. Sync consent state into the HubSpot CRM

When a known contact updates their consent (for example, by revisiting the banner and revoking marketing consent), you should reflect that in the HubSpot record so workflow logic stops sending marketing emails. The HubSpot API exposes a communication-preferences endpoint that accepts subscription-level updates. Most CMPs can be configured to call this endpoint from a server-side hook.

Common Pitfalls and How to Avoid Them

Three integration mistakes account for most of the audit findings we see on HubSpot-heavy stacks.

Loading the snippet too early

Some teams put the HubSpot tag inside a tag manager and assume the tag manager handles consent. Google Tag Manager does honor consent mode, but only for tags that explicitly require a granted state. If the HubSpot tag is configured without that requirement, GTM will fire it regardless. Always set the Additional consent field on the tag to require marketing consent before firing.

Forgetting the form scripts

HubSpot forms are served from a separate domain (forms.hsforms.com) and can be embedded with their own script. If you gate the main tracking snippet but leave the form script loading on initial render, you have not really solved the problem — the form library sets identifying cookies of its own. Gate both, and let the CMP load them together.

Treating opt-out as opt-in

HubSpot's native settings include a Do Not Track option and a one-click opt-out. Some teams interpret these as a sufficient mechanism to comply with the GDPR. They are not — the GDPR requires affirmative opt-in for non-essential cookies, and an opt-out checkbox buried in a privacy page does not meet that bar. Make the CMP the authoritative source of consent state, and configure HubSpot to defer to it.

Audit-Ready Documentation

After the technical integration is in place, the final step is making sure your evidence trail can withstand a regulator request. At minimum, keep a record of: the categories your CMP maps HubSpot to, the consent banner version live at any given date, sample TC strings showing valid consent, and the API logs that prove HubSpot did not fire any tracking call before consent was granted. Most enforcement actions stall not on the technology but on the documentation — organizations that can produce a clear paper trail typically resolve investigations far faster than those that cannot. A consent management platform that exports these artifacts on demand turns the audit from a multi-week scramble into a one-afternoon response.