Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsent
Free plan · 10-min setup
HubSpot is a leading US-based CRM, marketing, sales, and customer service platform. It combines contact management, email marketing, website analytics, live chat, landing pages, and marketing automation in a single suite. GDPR compliance for HubSpot is complex because different HubSpot tools require different legal bases: consent for marketing emails and tracking cookies, legitimate interest for CRM contact records, and contract performance for customer service. EU data hosting (Frankfurt) is available on certain plans.
HubSpot is an all-in-one CRM, marketing, sales, and customer service platform. Its product suite includes Marketing Hub (email marketing, landing pages, SEO, social media), Sales Hub (CRM, email sequences, deal pipelines), Service Hub (help desk, live chat, knowledge base), CMS Hub (website management), and Operations Hub (data sync, workflow automation). HubSpot is one of the most comprehensive marketing technology platforms, and its breadth means GDPR compliance spans many different data processing activities.
Different HubSpot features require different legal bases. Marketing emails and tracking cookies: consent. CRM contacts from existing customers: legitimate interest. CRM contacts from contracts or service delivery: contract performance. Sales outreach to business prospects: legitimate interest (with opt-out). Live chat initiated by users: legitimate interest for the session, consent for tracking cookies. HubSpot''s built-in legal basis field in contact records helps document this per-contact.
HubSpot''s tracking script sets the __hstc cookie (persistent visitor ID, 13 months) and __hssc (session cookie). These require consent under the ePrivacy Directive. HubSpot provides a built-in cookie consent banner, but many organisations prefer to use their own CMP and configure HubSpot to load conditionally after consent. HubSpot also supports cookie-less tracking for privacy-conscious implementations.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
HubSpot offers EU data hosting (Frankfurt) for customers on certain plans. When configured, CRM data, marketing contacts, and most HubSpot data is stored within the EU. This eliminates SCCs for primary data flows and significantly simplifies the transfer compliance picture.
Sign the HubSpot DPA. Enable EU data hosting if available on your plan. Configure cookie consent for HubSpot tracking. Use HubSpot''s GDPR features: legal basis tracking per contact, consent records, subscription management. Implement double opt-in for marketing emails. Configure the legal basis field for each contact. Use HubSpot''s data deletion tools for erasure requests. Add HubSpot to your privacy policy covering CRM, email, and analytics processing.
Websites using HubSpot must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is recommended for large-scale HubSpot deployments combining CRM profiling, marketing automation, behavioural tracking, and lead scoring across many EU contacts. The breadth of data processing across the HubSpot suite warrants a comprehensive DPIA covering each Hub.
Sample consent text
By submitting this form, you consent to HubSpot storing your contact information and to [Company] contacting you about relevant products and services. You can withdraw consent at any time. See our privacy policy for details.
Third-party domains contacted
hubspot.comjs.hs-scripts.comapi.hubspot.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| __hstc | persistent | 13 months | HubSpot persistent visitor ID for cross-session analytics and contact de-duplication |
| __hssc | session | 30 minutes | HubSpot session identifier tracking page views within a single session |
| hubspotutk | persistent | 13 months | HubSpot visitor identity cookie linking form submissions to existing CRM contacts |
HubSpot uses cookies for user preferences — inform visitors with a consent banner.
Yes for marketing emails and tracking cookies. The HubSpot tracking script requires cookie consent. Marketing emails require valid opt-in. CRM contacts may rely on legitimate interest or contract performance. HubSpot has built-in GDPR tools.
HubSpot sets __hstc (13 months), hubspotutk (13 months), and __hssc (30 minutes session). These require consent under the ePrivacy Directive.
Yes, on certain plans (Frankfurt). This eliminates SCCs for primary data flows and simplifies GDPR transfer compliance.
Existing customers: legitimate interest or contract performance. Inbound leads with consent: consent. Outbound prospected contacts: legitimate interest with a documented LIA and opt-out in every communication.
Use HubSpot's built-in banner, your own CMP blocking the HubSpot script conditionally, or HubSpot's cookieless tracking mode.
For access: export the contact record. For erasure: use HubSpot's GDPR Delete feature. Respond within 30 days and document all actions.
Yes. Sign the HubSpot DPA available in the HubSpot Legal Center or via Account Settings.
Brevo (France) and ActiveCampaign (EU option) offer EU data residency. HubSpot with EU hosting configured is itself a strong compliant option.