> HubSpot sets CRM and marketing tracking cookies across multiple sessions. GDPR guide: blocking, DPA, forms and data retention configuration. > > Canonical: https://www.flowconsent.com/en/blog/hubspot-cookies-gdpr-compliance [Marketing tools](https://www.flowconsent.com/en/blog?category=tools) # HubSpot and GDPR cookies: compliance guide Published 13 May 2026 · 4 min read In short HubSpot sets CRM and marketing tracking cookies across multiple sessions. This guide explains how to block the HubSpot script, sign the DPA, and configure forms for GDPR compliance. ## TL;DR HubSpot sets several tracking cookies on sites that include its script (hs-script.hubspot.com). These cookies serve analytics and marketing purposes that require prior visitor consent under GDPR. Without blocking the HubSpot script before consent, the site is non-compliant. ## What cookies does HubSpot set? HubSpot is a CRM and marketing platform offering email marketing, forms, chat, contact tracking, and web analytics tools. To function, HubSpot injects a tracking script (\_hsq) that sets several cookies on the visitor's device. The [HubSpot entry in our third-party services catalog](https://www.flowconsent.com/en/services/customer-support/hubspot) lists its documented cookies, domains and consent requirements. ### The main HubSpot cookies - \_\_hstc: primary tracking cookie, follows contact visits and sessions (180 days) - hubspotutk: unique visitor identifier for the HubSpot CRM (180 days) - \_\_hssc: tracks current sessions (30 minutes) - \_\_hssrc: determines if the visitor opened a new tab or restarted the session (session) - messagesUtk: identifier for HubSpot chat (1 year) - \_\_ptq.gif: HubSpot tracking pixel (session) These cookies allow HubSpot to track visitors across multiple sessions, identify them in the CRM once they fill out a form, and measure marketing campaign conversions. They fall under the analytics and marketing categories, which are subject to consent requirements. ## HubSpot and GDPR compliance HubSpot processes personal data (IP address, cookie identifiers, browsing behaviour) as a data processor. As the data controller, the business using HubSpot is responsible for the compliance of that data collection. The ICO and EDPB have clearly stated that CRM and marketing automation cookies that track visitor behaviour across multiple sessions require prior consent. HubSpot cookies enable individual identification and multi-session tracking, placing them outside any analytics exemption. ### HubSpot and the right to object HubSpot offers an opt-out page at legal.hubspot.com/privacy-policy, but this opt-out mechanism does not replace the obligation to collect prior consent on your site. GDPR requires a consent mechanism before cookies are set, not after. ## How to configure HubSpot for GDPR compliance ### Step 1: block the HubSpot script before consent The HubSpot script (hs-script.hubspot.com) must be blocked by a CMP until the user consents to the analytics or marketing category. With FlowConsent, this blocking is automatic and requires no manual HubSpot script configuration. The [HubSpot installation guide](https://www.flowconsent.com/en/doc/install-hubspot) shows where to paste the FlowConsent snippet and how to turn off HubSpot's native cookie banner. ### Step 2: use the HubSpot Cookie Consent Banner (optional complement) HubSpot offers a built-in cookie banner in its portals. This banner has two important limitations for GDPR compliance: it is only available on HubSpot portal pages (not your main site), and it does not technically block HubSpot scripts before consent. It can complement your CMP but does not replace it. ### Step 3: configure data retention in HubSpot In your HubSpot account settings, define the retention period for contact and activity data. The ICO recommends not retaining tracking data beyond 13 months. In HubSpot CRM, configure archiving and automatic deletion rules for inactive contacts. For the reasoning behind this 13-month ceiling, see our guide to [cookie retention duration under GDPR](https://www.flowconsent.com/en/blog/cookie-retention-duration-gdpr-13-months). ### Step 4: sign the HubSpot DPA HubSpot acts as a data processor under GDPR. A Data Processing Agreement (DPA) must be signed with HubSpot. This DPA is available in HubSpot account settings under Legal > Data Processing Agreement. Signing it is mandatory for compliance. ### Step 5: manage HubSpot forms HubSpot forms trigger visitor identification in the CRM (linking the hubspotutk cookie to a contact). Before any form submission, the user must have consented to the marketing use of their data. A separate marketing consent checkbox, distinct from cookie consent, is recommended on each form. That checkbox must also meet the [7 requirements for valid GDPR consent](https://www.flowconsent.com/en/blog/gdpr-consent-validity-requirements), starting with being unticked by default. ## Common mistakes The HubSpot script loads without consent. The standard HubSpot code integration in the site \ loads the script on every visit. Without a CMP blocking this script, cookies are set before any consent. Confusing the HubSpot banner with a CMP. The native HubSpot banner does not technically block HubSpot cookies before display. It does not replace a GDPR-compliant CMP. Forgetting to sign the DPA. The absence of a signed DPA with HubSpot exposes the business to GDPR non-compliance risk on the data processor relationship. Check in HubSpot settings that the DPA is signed. Not disclosing HubSpot chat cookies. The HubSpot chat widget sets the messagesUtk cookie (1 year). If this widget is used, chat cookies must be listed in the cookie policy and included in the consent request. Our [cookie policy guide](https://www.flowconsent.com/en/blog/cookie-policy-gdpr-guide) explains what to include for each tracker you declare. Linking CRM identity without marketing consent. When a visitor fills out a form, HubSpot links their browsing history (via hubspotutk) to their CRM profile. This linking constitutes marketing processing requiring explicit consent separate from cookie consent. ## HubSpot GDPR compliance checklist 1. The HubSpot script is blocked by a CMP before consent. 2. The analytics/marketing category is explicitly presented in the banner. 3. HubSpot cookies (including messagesUtk if chat is used) are listed in the cookie policy. 4. The HubSpot DPA is signed in the account settings. 5. CRM data retention is configured (maximum 13 months for tracking data). 6. HubSpot forms include a separate marketing consent checkbox. 7. The privacy policy mentions HubSpot as a data processor. 8. Consent records are stored with timestamp and banner version. 9. A contact data deletion mechanism is in place. 10. Configuration is reviewed after each major HubSpot script update. ## Conclusion HubSpot is a powerful CRM and marketing tool, but its tracking script sets multi-session tracking cookies by default without requesting consent. GDPR compliance requires blocking the script via a CMP, signing the HubSpot DPA, and configuring forms with explicit marketing consent. Check whether the HubSpot script and other trackers are properly blocked on your site with the [FlowConsent cookie scanner](https://www.flowconsent.com/en/scan). [Back to the blog](https://www.flowconsent.com/en/blog) Share this article · [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.flowconsent.com%2Fen%2Fblog%2Fhubspot-cookies-gdpr-compliance) · [X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.flowconsent.com%2Fen%2Fblog%2Fhubspot-cookies-gdpr-compliance) Questions ## Common questions on this topic. Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does HubSpot set? HubSpot sets several cookies including: \_\_hstc (visit tracking, 13 months), hubspotutk (visitor identification, 13 months), \_\_hssc (HubSpot session, 30 minutes), \_\_hssrc (session identification, session duration), messagesUtk (chat widget). Some are analytical, others functional. All must be declared in your cookie policy. ### Do HubSpot cookies require GDPR consent? Yes for analytical and tracking cookies (hubspotutk, \_\_hstc). These cookies identify visitors and track their journey between visits, requiring prior consent. Strictly necessary cookies for technical operation may be exempt. ### How to make HubSpot GDPR compliant? Use a CMP that blocks non-essential HubSpot cookies before consent. In HubSpot, enable the privacy module (GDPR settings) to manage email subscriptions. Configure HubSpot tracking to load only after consent. Document processing activities in your DPO register. ### Does HubSpot have a cookie consent feature? HubSpot offers a native cookie banner, but it is not designed to fully satisfy European GDPR requirements (no one-click rejection, no category-level granularity). A dedicated CMP like FlowConsent is recommended as it technically blocks scripts until consent is given. ### What is the hubspotutk cookie? The hubspotutk cookie is a unique identifier generated by HubSpot to track visits from the same visitor on your website. It is used to associate form submissions with a HubSpot contact and for marketing tracking. Its duration is 13 months. It requires prior consent as it enables visitor identification and tracking. Read next ## Keep reading. [All articles](https://www.flowconsent.com/en/blog) [Platform guides · 13 July 2026](https://www.flowconsent.com/en/blog/nextjs-cookies-gdpr-compliance-guide) ### [Next.js cookie consent and GDPR: the complete compliance guide](https://www.flowconsent.com/en/blog/nextjs-cookies-gdpr-compliance-guide) [How to collect valid cookie consent in a Next.js app, from App Router installation and SPA navigation to Google Consent Mode v2 and server-side consent checks.](https://www.flowconsent.com/en/blog/nextjs-cookies-gdpr-compliance-guide) [Read the article ](https://www.flowconsent.com/en/blog/nextjs-cookies-gdpr-compliance-guide)· [Marketing tools · 5 May 2026](https://www.flowconsent.com/en/blog/tiktok-pixel-cookies-gdpr-consent) ### [TikTok Pixel and GDPR: cookies, consent and compliance](https://www.flowconsent.com/en/blog/tiktok-pixel-cookies-gdpr-consent) [The TikTok Pixel sets marketing cookies on your site as soon as it loads. How to block it before consent, Events API, data transfers: the complete guide.](https://www.flowconsent.com/en/blog/tiktok-pixel-cookies-gdpr-consent) [Read the article ](https://www.flowconsent.com/en/blog/tiktok-pixel-cookies-gdpr-consent)· [Marketing tools · 7 April 2026](https://www.flowconsent.com/en/blog/meta-pixel-cookies-gdpr-compliance) ### [Meta Pixel and GDPR: the complete guide to cookies and consent](https://www.flowconsent.com/en/blog/meta-pixel-cookies-gdpr-compliance) [The Meta Pixel sets advertising cookies that require prior consent in Europe. Here is how to block it until consent, handle the Conversions API and stay GDPR compliant.](https://www.flowconsent.com/en/blog/meta-pixel-cookies-gdpr-compliance) [Read the article](https://www.flowconsent.com/en/blog/meta-pixel-cookies-gdpr-compliance) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)