Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
HubSpot Chat is the live chat and chatbot widget of the HubSpot CRM and Marketing Hub. A JavaScript widget sets first party cookies such as messagesUtk and loads HubSpot analytics cookies to recognise visitors and link conversations to CRM contacts. Although it is often presented as a functional support tool, it places a persistent visitor token and analytics cookies, so it requires prior consent. Data is processed in the United States under the GDPR and the ePrivacy Directive.
HubSpot Chat is the live chat and chatbot tool built into the HubSpot CRM and Marketing Hub. A JavaScript widget loads on each page and lets visitors start a conversation with a human agent or an automated bot. Messages, contact details, and conversation history are stored against HubSpot CRM records, so support and sales teams can recognise returning visitors and continue earlier discussions.
The widget sets a persistent first party cookie called messagesUtk that links a chat visitor to a HubSpot contact, and it commonly loads the HubSpot analytics cookies __hstc, __hssc, and __hssrc. It processes the content of chat messages, names, email addresses, IP addresses, and browser and device information. Because the visitor token persists across sessions and ties conversations to identifiable contacts, the data involved is personal data.
A purely functional chat box that stores only a session cookie can sometimes rely on the strictly necessary exemption, but HubSpot Chat goes further. It loads a persistent visitor token and the HubSpot analytics cookies, which are not strictly necessary, so Article 5(3) of the ePrivacy Directive requires prior consent. The linkage of chat content with identifiable CRM contacts also brings the processing squarely within the GDPR, requiring a lawful basis, transparency, and a record of processing activities.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Because the widget sets non essential cookies, you should obtain consent before it loads or, at minimum, before the analytics and persistent tracking cookies are placed. HubSpot offers a consent banner and a cookie consent API that can keep the tracking cookies blocked until the visitor accepts. Consent must be freely given, specific, informed, and as easy to withdraw as it was to grant, and pre ticked boxes do not meet the standard.
HubSpot processes chat data in the United States, so you must document the transfer under the EU US Data Privacy Framework and the Standard Contractual Clauses and sign the HubSpot Data Processing Agreement. In practice, gate the widget or its tracking cookies behind your consent management platform, display a clear privacy notice inside the chat, set sensible retention for conversation history, and list the chat cookies and their durations in your cookie policy.
Websites using HubSpot Chat must obtain user consent under GDPR regulations.
DPIA considerations
HubSpot Chat sets a persistent visitor token (messagesUtk) and loads HubSpot analytics cookies, links chat content to identifiable CRM contacts, and processes message data and IP addresses on US infrastructure. A DPIA should assess the persistence of the visitor token, the combination of conversational content with CRM profiles, the international transfer to the United States, and retention periods for chat transcripts, together with mitigations such as consent gating, limited retention, and minimisation of the data captured in chat forms.
Sample consent text
We use HubSpot Chat to provide live chat and chatbot support and to connect your conversation with our customer records. HubSpot places cookies on your device to recognise your browser and link your messages to your contact details. These cookies load only after you accept the relevant cookie category, and the data may be processed in the United States. You can withdraw your consent at any time through our cookie settings.
Third-party domains contacted
js.usemessages.comjs.hs-banner.comapi.hubspot.comapp.hubspot.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| messagesUtk | functional | 6 months | Persistent HubSpot chat cookie that links a chat visitor to a HubSpot contact so that the conversation history and identity can be recognised across visits. |
| __hstc | analytics | 6 months | HubSpot analytics cookie loaded by the widget. Stores the visitor token, the timestamps of the first, previous, and current visits, and is used to count sessions and identify the traffic source. |
| __hssc | analytics | 30 minutes | Tracks the current session and determines whether HubSpot should increment the session count and update the session timestamp. |
| __hssrc | analytics | Session | Used to determine whether the visitor has restarted their browser. If this cookie is absent, HubSpot treats the activity as a new session. |
HubSpot Chat uses cookies for user preferences — inform visitors with a consent banner.
HubSpot Chat sets a persistent first party cookie called messagesUtk that links a chat visitor to a HubSpot contact, typically for about 6 months. It also commonly loads the HubSpot analytics cookies __hstc, __hssc, and __hssrc, which track sessions and traffic, so the widget is rarely a single session only tool.
Yes, in most cases. Because the widget stores a persistent visitor token and loads analytics cookies that are not strictly necessary, Article 5(3) of the ePrivacy Directive requires prior consent before those cookies are placed. A minimal, session only chat can sometimes avoid consent, but the standard HubSpot Chat setup does not.
The storage and reading of the non essential cookies relies on consent under the ePrivacy Directive, and the subsequent processing of chat content and contact data relies on consent under Article 6(1)(a) of the GDPR. Where chat is offered as a contractual support channel, some processing of the conversation may also rest on contract or legitimate interest, but the cookies still require consent.
Yes. HubSpot, Inc. processes chat data on infrastructure in the United States, although some plans offer EU data residency. Transfers are covered by the EU US Data Privacy Framework and Standard Contractual Clauses, which you should reference in your privacy notice.
A full DPIA is not always mandatory, but it is advisable because HubSpot Chat stores a persistent visitor token, captures potentially sensitive conversation content, links it to identifiable CRM contacts, and transfers data to the United States. Document the purposes, data categories, retention, and safeguards, and reassess if you add automated bots or scoring.
Load the chat widget, or at least block its non essential cookies, until the visitor accepts the relevant category in your consent management platform, and use the HubSpot cookie consent API to keep messagesUtk and analytics cookies blocked until then. Sign the Data Processing Agreement, show a privacy notice inside the chat, set sensible retention for transcripts, and document the cookies in your cookie policy.
Privacy focused or EU hosted live chat tools such as Crisp, Tidio, or self hosted options like Chatwoot keep data within the EU and can run with minimal cookies. They do not offer the same native CRM integration, so the right choice depends on whether you need tight HubSpot integration or prefer to keep chat data inside the European Union.
List the messagesUtk cookie and any HubSpot analytics cookies loaded by the widget, with their purpose and duration, name HubSpot, Inc. as a recipient, and disclose the transfer to the United States. Keep the entries in sync with a regular cookie scan so that new or renamed HubSpot chat cookies are reflected accurately.