FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Customer support

HubSpot Chat

PreferencesOfficial website

HubSpot Chat is the live chat and chatbot widget of the HubSpot CRM and Marketing Hub. A JavaScript widget sets first party cookies such as messagesUtk and loads HubSpot analytics cookies to recognise visitors and link conversations to CRM contacts. Although it is often presented as a functional support tool, it places a persistent visitor token and analytics cookies, so it requires prior consent. Data is processed in the United States under the GDPR and the ePrivacy Directive.

Block HubSpot Chat until consentScan my site
Overview

What does HubSpot Chat do?

What HubSpot Chat is

HubSpot Chat is the live chat and chatbot tool built into the HubSpot CRM and Marketing Hub. A JavaScript widget loads on each page and lets visitors start a conversation with a human agent or an automated bot. Messages, contact details, and conversation history are stored against HubSpot CRM records, so support and sales teams can recognise returning visitors and continue earlier discussions.

What data and cookies it collects

The widget sets a persistent first party cookie called messagesUtk that links a chat visitor to a HubSpot contact, and it commonly loads the HubSpot analytics cookies __hstc, __hssc, and __hssrc. It processes the content of chat messages, names, email addresses, IP addresses, and browser and device information. Because the visitor token persists across sessions and ties conversations to identifiable contacts, the data involved is personal data.

GDPR and ePrivacy implications

A purely functional chat box that stores only a session cookie can sometimes rely on the strictly necessary exemption, but HubSpot Chat goes further. It loads a persistent visitor token and the HubSpot analytics cookies, which are not strictly necessary, so Article 5(3) of the ePrivacy Directive requires prior consent. The linkage of chat content with identifiable CRM contacts also brings the processing squarely within the GDPR, requiring a lawful basis, transparency, and a record of processing activities.

Consent requirements

Because the widget sets non essential cookies, you should obtain consent before it loads or, at minimum, before the analytics and persistent tracking cookies are placed. HubSpot offers a consent banner and a cookie consent API that can keep the tracking cookies blocked until the visitor accepts. Consent must be freely given, specific, informed, and as easy to withdraw as it was to grant, and pre ticked boxes do not meet the standard.

Data transfers and practical compliance steps

HubSpot processes chat data in the United States, so you must document the transfer under the EU US Data Privacy Framework and the Standard Contractual Clauses and sign the HubSpot Data Processing Agreement. In practice, gate the widget or its tracking cookies behind your consent management platform, display a clear privacy notice inside the chat, set sensible retention for conversation history, and list the chat cookies and their durations in your cookie policy.

Compliance

HubSpot Chat and the GDPR

HubSpot Chat is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

Legal basis
Consent (Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy Directive)
Risk level
medium
Applicable regulations
GDPR, ePrivacy Directive, EU US Data Privacy Framework

Impact assessment (DPIA)

HubSpot Chat sets a persistent visitor token (messagesUtk) and loads HubSpot analytics cookies, links chat content to identifiable CRM contacts, and processes message data and IP addresses on US infrastructure. A DPIA should assess the persistence of the visitor token, the combination of conversational content with CRM profiles, the international transfer to the United States, and retention periods for chat transcripts, together with mitigations such as consent gating, limited retention, and minimisation of the data captured in chat forms.

Sample text for your banner

We use HubSpot Chat to provide live chat and chatbot support and to connect your conversation with our customer records. HubSpot places cookies on your device to recognise your browser and link your messages to your contact details. These cookies load only after you accept the relevant cookie category, and the data may be processed in the United States. You can withdraw your consent at any time through our cookie settings.
Cookies and trackers

What HubSpot Chat sets and contacts

Tracking method
Chat widget JavaScript with first party cookies
Server location
United States (EU data residency available on some plans)
Data transferred outside the EU
Chat data is processed by HubSpot, Inc. on infrastructure located in the United States. Transfers rely on the EU US Data Privacy Framework and Standard Contractual Clauses.

Cookies set (4)

NameTypeDurationPurpose
messagesUtkfunctional6 monthsPersistent HubSpot chat cookie that links a chat visitor to a HubSpot contact so that the conversation history and identity can be recognised across visits.
__hstcanalytics6 monthsHubSpot analytics cookie loaded by the widget. Stores the visitor token, the timestamps of the first, previous, and current visits, and is used to count sessions and identify the traffic source.
__hsscanalytics30 minutesTracks the current session and determines whether HubSpot should increment the session count and update the session timestamp.
__hssrcanalyticsSessionUsed to determine whether the visitor has restarted their browser. If this cookie is absent, HubSpot treats the activity as a new session.

Third-party domains contacted (4)

  • js.usemessages.com
  • js.hs-banner.com
  • api.hubspot.com
  • app.hubspot.com
Questions

Frequently asked questions about HubSpot Chat

Can't find your question? Write to us, we answer fast.

Which cookies does HubSpot Chat set?

HubSpot Chat sets a persistent first party cookie called messagesUtk that links a chat visitor to a HubSpot contact, typically for about 6 months. It also commonly loads the HubSpot analytics cookies __hstc, __hssc, and __hssrc, which track sessions and traffic, so the widget is rarely a single session only tool.

Do I need consent to use HubSpot Chat?

Yes, in most cases. Because the widget stores a persistent visitor token and loads analytics cookies that are not strictly necessary, Article 5(3) of the ePrivacy Directive requires prior consent before those cookies are placed. A minimal, session only chat can sometimes avoid consent, but the standard HubSpot Chat setup does not.

What is the legal basis for HubSpot Chat?

The storage and reading of the non essential cookies relies on consent under the ePrivacy Directive, and the subsequent processing of chat content and contact data relies on consent under Article 6(1)(a) of the GDPR. Where chat is offered as a contractual support channel, some processing of the conversation may also rest on contract or legitimate interest, but the cookies still require consent.

Does HubSpot Chat transfer data to the United States?

Yes. HubSpot, Inc. processes chat data on infrastructure in the United States, although some plans offer EU data residency. Transfers are covered by the EU US Data Privacy Framework and Standard Contractual Clauses, which you should reference in your privacy notice.

Do I need a DPIA for HubSpot Chat?

A full DPIA is not always mandatory, but it is advisable because HubSpot Chat stores a persistent visitor token, captures potentially sensitive conversation content, links it to identifiable CRM contacts, and transfers data to the United States. Document the purposes, data categories, retention, and safeguards, and reassess if you add automated bots or scoring.

How do I implement HubSpot Chat in a compliant way?

Load the chat widget, or at least block its non essential cookies, until the visitor accepts the relevant category in your consent management platform, and use the HubSpot cookie consent API to keep messagesUtk and analytics cookies blocked until then. Sign the Data Processing Agreement, show a privacy notice inside the chat, set sensible retention for transcripts, and document the cookies in your cookie policy.

Are there alternatives to HubSpot Chat?

Privacy focused or EU hosted live chat tools such as Crisp, Tidio, or self hosted options like Chatwoot keep data within the EU and can run with minimal cookies. They do not offer the same native CRM integration, so the right choice depends on whether you need tight HubSpot integration or prefer to keep chat data inside the European Union.

How do I update my cookie policy for HubSpot Chat?

List the messagesUtk cookie and any HubSpot analytics cookies loaded by the widget, with their purpose and duration, name HubSpot, Inc. as a recipient, and disclose the transfer to the United States. Keep the entries in sync with a regular cookie scan so that new or renamed HubSpot chat cookies are reflected accurately.

Same category

More services: Customer support

See the whole category

YourGPT

YourGPT is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. YourGPT integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, YourGPT makes advanced AI accessible to all teams.

Analytics

Whatfix

Whatfix is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Whatfix integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Whatfix helps organizations maintain robust websites that meet user expectations and technical requirements.

Customer support

Arnica

Arnica is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Arnica enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Arnica empowers marketing teams to achieve measurable growth.

Marketing

SegMate

SegMate is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. SegMate integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, SegMate helps organizations maintain robust websites that meet user expectations and technical requirements.

Preferences

Callgear

Callgear is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Callgear integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Callgear helps organizations maintain robust websites that meet user expectations and technical requirements.

Preferences

Robofy

Robofy is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. Robofy integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, Robofy makes advanced AI accessible to all teams.

Preferences

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site