FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Analytics

HubSpot Analytics

Analytics

HubSpot Analytics is the website tracking layer of the HubSpot CRM and Marketing Hub. A JavaScript snippet sets first party cookies (__hstc, hubspotutk, __hssc) to measure traffic, sessions, and sources, and links visits to CRM contacts. Data is processed in the United States and requires prior consent under the GDPR and the ePrivacy Directive.

Block HubSpot Analytics until consentScan my site
Overview

What does HubSpot Analytics do?

What HubSpot Analytics is

HubSpot Analytics is the traffic and behaviour analytics layer built into the HubSpot CRM and Marketing Hub. A small JavaScript snippet, often called the HubSpot tracking code, loads on each page and records page views, sessions, traffic sources, and form interactions. The data feeds HubSpot dashboards, contact timelines, and marketing attribution reports, allowing businesses to connect anonymous website activity with known CRM contacts.

What data and cookies it collects

The tracking code sets first party cookies such as __hstc, hubspotutk, __hssc, and __hssrc. Together they store a visitor identifier, the original traffic source, session counts, and session state. HubSpot also processes IP addresses, browser and device information, pages viewed, and, once a visitor submits a form, directly identifying data such as name and email address that is linked back to the analytics history.

GDPR and ePrivacy implications

Because the cookies are read from and written to the visitor terminal and are used for analytics rather than strictly necessary functions, Article 5(3) of the ePrivacy Directive requires prior consent. The linkage between behavioural data and identifiable contacts also makes the processing personal data under the GDPR, so a lawful basis, transparency, and a record of processing activities are required.

Consent requirements

HubSpot provides a native cookie banner and a consent management API, but the analytics cookies must not load before the visitor has actively accepted the analytics or statistics category. Pre ticked boxes, implied consent from continued browsing, and cookie walls do not meet the GDPR standard. Consent must be freely given, specific, informed, granular, and as easy to withdraw as to give.

Data transfers and practical compliance steps

HubSpot processes data in the United States, so you must document the transfer under the Data Privacy Framework and the Standard Contractual Clauses, sign the HubSpot Data Processing Agreement, and list the cookies and their durations in your cookie policy. In practice, gate the tracking code behind your consent management platform, enable HubSpot consent banner integration, and review retention settings so that analytics data is not kept longer than necessary.

Compliance

HubSpot Analytics and the GDPR

HubSpot Analytics is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

Legal basis
Consent (Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy Directive)
Risk level
medium
Applicable regulations
GDPR, ePrivacy Directive, EU US Data Privacy Framework

Impact assessment (DPIA)

HubSpot Analytics assigns a persistent visitor token (hubspotutk) and a main analytics cookie (__hstc) with a 6 month lifetime, links anonymous browsing to identifiable CRM contacts once a form is submitted, and processes IP addresses on US infrastructure. A DPIA should assess the scale of behavioural profiling, the combination of analytics and CRM data, the international transfer to the United States, and retention periods, together with mitigations such as consent gating, IP minimisation, and shortened data retention.

Sample text for your banner

We use HubSpot Analytics to measure how visitors find and use our website and to connect this activity with our customer relationship records. HubSpot places cookies on your device to recognise your browser, count sessions, and identify the source of your visit. These cookies load only after you accept the analytics category, and the data may be processed in the United States. You can withdraw your consent at any time through our cookie settings.
Cookies and trackers

What HubSpot Analytics sets and contacts

Tracking method
JavaScript tracking code with first party cookies
Server location
United States (EU data residency available on some plans)
Data transferred outside the EU
Analytics data is processed by HubSpot, Inc. on infrastructure located in the United States. Transfers rely on the EU US Data Privacy Framework and Standard Contractual Clauses.

Cookies set (4)

NameTypeDurationPurpose
__hstcanalytics6 monthsMain HubSpot analytics cookie. Stores the visitor token, the timestamp of the first visit, the previous visit, and the current visit, and is used to count sessions and identify the original traffic source.
hubspotutkanalytics6 monthsStores the visitor identity token used to deduplicate contacts and to link form submissions back to the visitor analytics history.
__hsscanalytics30 minutesTracks the current session and determines whether HubSpot should increment the session count and update the session timestamp.
__hssrcanalyticsSessionUsed to determine whether the visitor has restarted their browser. If this cookie is absent, HubSpot treats the activity as a new session.

Third-party domains contacted (4)

  • js.hs-analytics.net
  • js.hs-scripts.com
  • track.hubspot.com
  • api.hubspot.com
Questions

Frequently asked questions about HubSpot Analytics

Can't find your question? Write to us, we answer fast.

Which cookies does HubSpot Analytics set?

HubSpot Analytics sets first party cookies including __hstc, hubspotutk, __hssc, and __hssrc. The __hstc and hubspotutk cookies last about 6 months and identify the visitor and traffic source, while __hssc and __hssrc track the current session and last around 30 minutes or until the browser is closed.

Do I need consent to use HubSpot Analytics?

Yes. The analytics cookies are not strictly necessary, so under Article 5(3) of the ePrivacy Directive and the GDPR you must obtain prior, opt in consent before the tracking code loads. Loading HubSpot tracking before consent is a common cause of supervisory authority complaints.

What is the legal basis for HubSpot Analytics?

The storage and reading of cookies relies on consent under the ePrivacy Directive, and the subsequent processing of personal data relies on consent under Article 6(1)(a) of the GDPR. Legitimate interest is generally not available because consent is already required to place the cookies.

Does HubSpot Analytics transfer data to the United States?

Yes. HubSpot, Inc. processes data on infrastructure in the United States, although some plans offer EU data residency. Transfers are covered by the EU US Data Privacy Framework and Standard Contractual Clauses, which you should reference in your privacy notice.

Do I need a DPIA for HubSpot Analytics?

A full DPIA is not always mandatory, but it is strongly recommended because HubSpot combines behavioural analytics with identifiable CRM contacts and transfers data internationally. Document the purposes, data categories, retention, and safeguards, and reassess if you enable advanced profiling or scoring.

How do I implement HubSpot Analytics in a compliant way?

Load the HubSpot tracking code only after the visitor accepts the analytics category in your consent management platform, and use the HubSpot consent banner or consent API to keep cookies blocked until then. Sign the Data Processing Agreement, set sensible data retention, and document the cookies in your cookie policy.

Are there alternatives to HubSpot Analytics?

Privacy focused analytics such as Matomo, Plausible, or Fathom keep data in the EU and can run with reduced or no cookies. They do not offer the same CRM integration, so the right choice depends on whether you need website measurement alone or combined marketing and sales attribution.

How do I update my cookie policy for HubSpot Analytics?

List each HubSpot cookie, its purpose, and its duration, name HubSpot, Inc. as a recipient, and disclose the transfer to the United States. Keep the entries in sync with a regular cookie scan so that new or renamed HubSpot cookies are reflected accurately.

Same category

More services: Analytics

See the whole category

Funnelytics

Funnelytics is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Funnelytics enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Funnelytics empowers marketing teams to achieve measurable growth.

Marketing

Quantcast Measure

Quantcast Measure is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Quantcast Measure supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Quantcast Measure enables informed decisions that improve experience and drive results.

Analytics

Baidu Analytics

Baidu Analytics is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Baidu Analytics offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Baidu Analytics empowers organizations to optimize strategy and maximize return on investment.

Analytics

51.LA

51.LA is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. 51.LA supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, 51.LA enables informed decisions that improve experience and drive results.

Analytics

Dimml

Dimml is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Dimml supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Dimml enables informed decisions that improve experience and drive results.

Analytics

Rudderstack

Rudderstack is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Rudderstack supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Rudderstack enables informed decisions that improve experience and drive results.

Analytics

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site