Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
HubSpot Analytics is the website tracking layer of the HubSpot CRM and Marketing Hub. A JavaScript snippet sets first party cookies (__hstc, hubspotutk, __hssc) to measure traffic, sessions, and sources, and links visits to CRM contacts. Data is processed in the United States and requires prior consent under the GDPR and the ePrivacy Directive.
HubSpot Analytics is the traffic and behaviour analytics layer built into the HubSpot CRM and Marketing Hub. A small JavaScript snippet, often called the HubSpot tracking code, loads on each page and records page views, sessions, traffic sources, and form interactions. The data feeds HubSpot dashboards, contact timelines, and marketing attribution reports, allowing businesses to connect anonymous website activity with known CRM contacts.
The tracking code sets first party cookies such as __hstc, hubspotutk, __hssc, and __hssrc. Together they store a visitor identifier, the original traffic source, session counts, and session state. HubSpot also processes IP addresses, browser and device information, pages viewed, and, once a visitor submits a form, directly identifying data such as name and email address that is linked back to the analytics history.
Because the cookies are read from and written to the visitor terminal and are used for analytics rather than strictly necessary functions, Article 5(3) of the ePrivacy Directive requires prior consent. The linkage between behavioural data and identifiable contacts also makes the processing personal data under the GDPR, so a lawful basis, transparency, and a record of processing activities are required.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
HubSpot provides a native cookie banner and a consent management API, but the analytics cookies must not load before the visitor has actively accepted the analytics or statistics category. Pre ticked boxes, implied consent from continued browsing, and cookie walls do not meet the GDPR standard. Consent must be freely given, specific, informed, granular, and as easy to withdraw as to give.
HubSpot processes data in the United States, so you must document the transfer under the Data Privacy Framework and the Standard Contractual Clauses, sign the HubSpot Data Processing Agreement, and list the cookies and their durations in your cookie policy. In practice, gate the tracking code behind your consent management platform, enable HubSpot consent banner integration, and review retention settings so that analytics data is not kept longer than necessary.
Websites using HubSpot Analytics must obtain user consent under GDPR regulations.
DPIA considerations
HubSpot Analytics assigns a persistent visitor token (hubspotutk) and a main analytics cookie (__hstc) with a 6 month lifetime, links anonymous browsing to identifiable CRM contacts once a form is submitted, and processes IP addresses on US infrastructure. A DPIA should assess the scale of behavioural profiling, the combination of analytics and CRM data, the international transfer to the United States, and retention periods, together with mitigations such as consent gating, IP minimisation, and shortened data retention.
Sample consent text
We use HubSpot Analytics to measure how visitors find and use our website and to connect this activity with our customer relationship records. HubSpot places cookies on your device to recognise your browser, count sessions, and identify the source of your visit. These cookies load only after you accept the analytics category, and the data may be processed in the United States. You can withdraw your consent at any time through our cookie settings.
Third-party domains contacted
js.hs-analytics.netjs.hs-scripts.comtrack.hubspot.comapi.hubspot.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| __hstc | analytics | 6 months | Main HubSpot analytics cookie. Stores the visitor token, the timestamp of the first visit, the previous visit, and the current visit, and is used to count sessions and identify the original traffic source. |
| hubspotutk | analytics | 6 months | Stores the visitor identity token used to deduplicate contacts and to link form submissions back to the visitor analytics history. |
| __hssc | analytics | 30 minutes | Tracks the current session and determines whether HubSpot should increment the session count and update the session timestamp. |
| __hssrc | analytics | Session | Used to determine whether the visitor has restarted their browser. If this cookie is absent, HubSpot treats the activity as a new session. |
HubSpot Analytics collects user analytics data — you legally need a consent banner. Try FlowConsent free.
HubSpot Analytics sets first party cookies including __hstc, hubspotutk, __hssc, and __hssrc. The __hstc and hubspotutk cookies last about 6 months and identify the visitor and traffic source, while __hssc and __hssrc track the current session and last around 30 minutes or until the browser is closed.
Yes. The analytics cookies are not strictly necessary, so under Article 5(3) of the ePrivacy Directive and the GDPR you must obtain prior, opt in consent before the tracking code loads. Loading HubSpot tracking before consent is a common cause of supervisory authority complaints.
The storage and reading of cookies relies on consent under the ePrivacy Directive, and the subsequent processing of personal data relies on consent under Article 6(1)(a) of the GDPR. Legitimate interest is generally not available because consent is already required to place the cookies.
Yes. HubSpot, Inc. processes data on infrastructure in the United States, although some plans offer EU data residency. Transfers are covered by the EU US Data Privacy Framework and Standard Contractual Clauses, which you should reference in your privacy notice.
A full DPIA is not always mandatory, but it is strongly recommended because HubSpot combines behavioural analytics with identifiable CRM contacts and transfers data internationally. Document the purposes, data categories, retention, and safeguards, and reassess if you enable advanced profiling or scoring.
Load the HubSpot tracking code only after the visitor accepts the analytics category in your consent management platform, and use the HubSpot consent banner or consent API to keep cookies blocked until then. Sign the Data Processing Agreement, set sensible data retention, and document the cookies in your cookie policy.
Privacy focused analytics such as Matomo, Plausible, or Fathom keep data in the EU and can run with reduced or no cookies. They do not offer the same CRM integration, so the right choice depends on whether you need website measurement alone or combined marketing and sales attribution.
List each HubSpot cookie, its purpose, and its duration, name HubSpot, Inc. as a recipient, and disclose the transfer to the United States. Keep the entries in sync with a regular cookie scan so that new or renamed HubSpot cookies are reflected accurately.