On a HubSpot-hosted site (Content Hub, formerly CMS Hub), the FlowConsent snippet goes at the top of the Site header HTML field, under Settings → Content → Pages, which adds it to the <head> of every page on the domain. Installation takes three steps: copy the snippet, paste it into Site header HTML, then turn off HubSpot's native cookie banner. That last step is the main trap: skip it and your visitors see two banners.
Before you start
- An account on app.flowconsent.com (the Free plan is free, no credit card, up to 25,000 sessions per month).
- A banner created and deployed: through your own Cloudflare account on the Free plan (Cloudflare guide), in one click on Pro and Enterprise.
- In HubSpot, the Website settings permission and a subscription that allows custom header code. HubSpot lists Content Hub Starter, Professional and Enterprise, as well as Marketing Hub Professional and Enterprise.
Step 1: Copy the snippet
In FlowConsent, open Builder → Deployment → Integration, HTML / No-code tab. The snippet has two parts: the Google Consent Mode v2 stub (denied defaults), then the banner script.
Step 2: Paste the snippet in Site header HTML
- In HubSpot, click the settings icon (gear) in the top navigation bar.
- In the left sidebar menu, go to Content → Pages.
- In the Choose a domain to edit its settings dropdown, keep the default settings to cover all your domains, or pick a specific domain and click Override default settings in the Site header HTML section.
- Paste the snippet at the very top of the Site header HTML field, before any existing code, adding the line that turns off the HubSpot banner (see step 3):
<script>
// FlowConsent Loader - place BEFORE any other script in the <head>
window.dataLayer=window.dataLayer||[];
function gtag(){dataLayer.push(arguments);}
gtag('consent','default',{
'ad_storage':'denied',
'analytics_storage':'denied',
'ad_user_data':'denied',
'ad_personalization':'denied',
'wait_for_update':500
});
gtag('set','url_passthrough',true);
gtag('set','ads_data_redaction',true);
</script>
<!-- FlowConsent CMP -->
<script src="https://YOUR-LICENSE-CODE.consent.flowconsent.com/cookie-manager.js?code=YOUR_LICENSE_CODE"></script>
<!-- Turns off HubSpot's native cookie banner -->
<script>window.disableHubSpotCookieBanner = true;</script>- Click Save in the bottom left.
Any tracking script already in that field (Google Analytics, Meta Pixel, Google Tag Manager…) must stay below the snippet: anything placed above it escapes prior blocking.
Step 3: Turn off HubSpot's native banner
According to HubSpot, this flag also turns off HubSpot's consent management. The HubSpot tracking code, which HubSpot adds automatically to its pages, sets its own cookies (__hstc, hubspotutk…): to make them follow the visitor's choice, HubSpot provides the setHubSpotConsent function in its Cookie Banner API, which a developer needs to wire up. The refusal scan (see below) shows whether these cookies are set without consent.
The native integrations trap
Never load FlowConsent from GTM: a banner loaded by GTM arrives too late for prior blocking. GTM tags then honor the Consent Mode v2 signals; non-Google tags need "Additional consent settings" (Consent Mode guide).
Verify the installation
- Open a published page in a private window: only the FlowConsent banner appears.
- In the Network tab, no third-party request before Accept.
- Run the installation assistant (Builder → Integration): loader present with your license code, Consent Mode stub present, stub placed before every Google tag (guide).
- Finish with a refusal scan from the Compliance tab (compliance verification).
Do it from your AI agent (MCP)
FlowConsent's official MCP server, https://mcp.flowconsent.com, works with Claude, ChatGPT or any MCP client, through an OAuth 2.0 connection to your FlowConsent account (no API key). Your agent fetches the snippet and placement instructions (get_banner_snippet, get_setup_instructions), verifies the installation with a real scan (verify_consent_compliance) and can set up recurring monitoring (monitor_compliance). It does not change your HubSpot settings: pasting the snippet stays on your side.
Example request: "Give me my banner snippet for my HubSpot site and check that it is installed correctly on https://mysite.com".
See the MCP server guide and the FlowConsent MCP page.
Frequently asked questions
Does the snippet also cover HubSpot landing pages and the blog?
The Site header HTML field applies to HubSpot-hosted content on the selected domain. After saving, check a landing page and a blog post with the installation assistant.
My site is not hosted on HubSpot, only the tracking code is installed. What should I do?
This page does not apply: install FlowConsent on the platform that hosts the site, then declare HubSpot in Builder → Services.
Can I keep the HubSpot banner alongside FlowConsent?
It is not recommended: two banners get in the visitor's way and can record different choices. Keep a single banner, FlowConsent, with the disableHubSpotCookieBanner flag.
Why can't I access the Site header HTML field?
You need the Website settings permission and a HubSpot subscription that allows header code. Ask a super admin on your HubSpot account.