Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
HubSpot CMS Hub is HubSpot content management system that powers websites and integrates the HubSpot tracking code, setting analytics and marketing cookies tied to the HubSpot CRM.
HubSpot CMS Hub, part of the HubSpot platform now branded as Content Hub, is a content management system for building websites and landing pages tightly integrated with the HubSpot CRM and marketing tools. It includes the HubSpot tracking code, which connects visitor activity to contact records. HubSpot is a United States company that also offers an EU data hosting region.
A HubSpot CMS site sets functional cookies and the HubSpot analytics cookies such as __hstc, hubspotutk, __hssc and __hssrc. These identify the visitor, track sessions and link behaviour to a CRM contact. It processes the visitor IP address, pages viewed, form submissions and, once known, contact details. The analytics and marketing cookies are non essential.
Functional cookies can be treated as strictly necessary, but the HubSpot analytics and marketing cookies are not and require consent under Article 5(3) of the ePrivacy Directive. Linking behaviour to an identified contact is profiling under the GDPR, so transparency and a lawful basis are essential.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Use the HubSpot consent banner or a connected consent tool so the tracking code and its cookies only load after the visitor opts in. Make sure form data and tracking are clearly explained, and keep refusal as easy as acceptance.
HubSpot is based in the United States and offers an EU hosting region. Where data is processed in the United States, transfers rely on the EU US Data Privacy Framework or Standard Contractual Clauses. Confirm your hosting region and sign the data processing agreement.
Enable opt in consent for the HubSpot tracking code, choose the EU hosting region if available, document the cookies and the CRM linkage, and sign the HubSpot data processing agreement. Disclose the United States transfer in your privacy policy.
Websites using HubSpot CMS Hub must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is advisable where HubSpot CMS Hub is used for large scale lead profiling or combines website behaviour with CRM data. Assess the tracking cookies, the profiling and the United States transfer.
Sample consent text
This site runs on HubSpot CMS and uses analytics and marketing cookies linked to our CRM. These load only if you accept. Strictly necessary cookies keep the site working.
Third-party domains contacted
js.hs-scripts.comhs-analytics.nethsforms.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| __hstc | Analytics | 6 months | Main HubSpot analytics cookie that tracks visitors using a timestamp for the first visit, last visit and current visit. |
| hubspotutk | Analytics | 6 months | Tracks the visitor identity and links it to a HubSpot CRM contact across forms and pages. |
| __hssc | Analytics | 30 minutes | Tracks the current session for HubSpot analytics. |
This service may collect user data. Ensure GDPR compliance with FlowConsent.
Yes, it sets functional cookies and the HubSpot analytics cookies such as __hstc, hubspotutk, __hssc and __hssrc, which track sessions and link behaviour to a CRM contact. The analytics and marketing cookies are non essential.
You need consent for the HubSpot analytics and marketing cookies before the tracking code loads, but not for strictly necessary functional cookies.
Core CMS functionality relies on contract or legitimate interest, while the tracking and marketing cookies require consent under Article 6(1)(a) and the ePrivacy rules.
HubSpot is a US company and offers an EU hosting region. Where processing happens in the US, it relies on the EU US Data Privacy Framework or Standard Contractual Clauses.
Consider a DPIA where HubSpot CMS Hub supports large scale lead profiling or links website behaviour with CRM data. Assess the cookies, the profiling and the transfer.
Gate the HubSpot tracking code behind opt in consent, choose EU hosting if available, sign the data processing agreement and document the cookies and the CRM linkage.
European CMS and marketing platforms, or self hosted content management, can keep data in the EU. The right choice depends on your CRM and marketing needs.
List the HubSpot cookies such as __hstc and hubspotutk with their purpose and duration, state that the tracking code loads only after consent and disclose the United States transfer.