> Is HubSpot GDPR compliant? Cookie consent, email opt-in, CRM legal basis, EU data hosting, the DPA and how to set up HubSpot lawfully for European contacts. > > Canonical: https://www.flowconsent.com/en/services/customer-support/hubspot Customer support # HubSpot Preferences HubSpot is a leading US-based CRM, marketing, sales, and customer service platform. It combines contact management, email marketing, website analytics, live chat, landing pages, and marketing automation in a single suite. GDPR compliance for HubSpot is complex because different HubSpot tools require different legal bases: consent for marketing emails and tracking cookies, legitimate interest for CRM contact records, and contract performance for customer service. EU data hosting (Frankfurt) is available on certain plans. [Block HubSpot until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=customer_support) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Customer support](https://www.flowconsent.com/en/services/customer-support) - Consent Preferences - Prior consent Required - Documented cookies 3 - Third-party domains 3 - Servers United States with EU data hosting option (Frankfurt) Overview ## What does HubSpot do? ## **What is HubSpot?** HubSpot is an all-in-one CRM, marketing, sales, and customer service platform. Its product suite includes Marketing Hub (email marketing, landing pages, SEO, social media), Sales Hub (CRM, email sequences, deal pipelines), Service Hub (help desk, live chat, knowledge base), CMS Hub (website management), and Operations Hub (data sync, workflow automation). HubSpot is one of the most comprehensive marketing technology platforms, and its breadth means GDPR compliance spans many different data processing activities. ## **Multiple legal bases across HubSpot tools** Different HubSpot features require different legal bases. Marketing emails and tracking cookies: consent. CRM contacts from existing customers: legitimate interest. CRM contacts from contracts or service delivery: contract performance. Sales outreach to business prospects: legitimate interest (with opt-out). Live chat initiated by users: legitimate interest for the session, consent for tracking cookies. HubSpot's built-in legal basis field in contact records helps document this per-contact. ## **HubSpot cookie tracking and consent** HubSpot's tracking script sets the \_\_hstc cookie (persistent visitor ID, 13 months) and \_\_hssc (session cookie). These require consent under the ePrivacy Directive. HubSpot provides a built-in cookie consent banner, but many organisations prefer to use their own CMP and configure HubSpot to load conditionally after consent. HubSpot also supports cookie-less tracking for privacy-conscious implementations. ## **EU data hosting option** HubSpot offers EU data hosting (Frankfurt) for customers on certain plans. When configured, CRM data, marketing contacts, and most HubSpot data is stored within the EU. This eliminates SCCs for primary data flows and significantly simplifies the transfer compliance picture. ## **Practical compliance steps** Sign the HubSpot DPA. Enable EU data hosting if available on your plan. Configure cookie consent for HubSpot tracking. Use HubSpot's GDPR features: legal basis tracking per contact, consent records, subscription management. Implement double opt-in for marketing emails. Configure the legal basis field for each contact. Use HubSpot's data deletion tools for erasure requests. Add HubSpot to your privacy policy covering CRM, email, and analytics processing. Compliance ## HubSpot and the GDPR HubSpot is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent (Art. 6(1)(a) GDPR) required for marketing tracking cookies, email marketing, and behavioural analytics. Legitimate interest (Art. 6(1)(f)) may apply for CRM data of existing customers. Contract performance (Art. 6(1)(b)) for processing contact data as part of the service relationship. - Risk level high - Applicable regulations GDPR, ePrivacy Directive, SCCs for US deployments. HubSpot spans CRM, email, analytics, and chat, each requiring assessment of applicable legal bases. ### Impact assessment (DPIA) A DPIA is recommended for large-scale HubSpot deployments combining CRM profiling, marketing automation, behavioural tracking, and lead scoring across many EU contacts. The breadth of data processing across the HubSpot suite warrants a comprehensive DPIA covering each Hub. ### Sample text for your banner > By submitting this form, you consent to HubSpot storing your contact information and to \[Company] contacting you about relevant products and services. You can withdraw consent at any time. See our privacy policy for details. Cookies and trackers ## What HubSpot sets and contacts - Tracking method JavaScript tracking code (HubSpot analytics), CRM, email marketing, live chat, forms, landing pages, first-party cookies, cross-device tracking, marketing automation - Server location United States with EU data hosting option (Frankfurt) - Data transferred outside the EU HubSpot is a US-based CRM and marketing platform. EU data hosting (Frankfurt) is available on certain plans. For standard deployments, EU personal data is transferred to US infrastructure requiring SCCs. HubSpot provides a comprehensive GDPR DPA. ### Cookies set (3) | Name | Type | Duration | Purpose | | ---------- | ---------- | ---------- | ------------------------------------------------------------------------------------ | | \_\_hstc | persistent | 13 months | HubSpot persistent visitor ID for cross-session analytics and contact de-duplication | | \_\_hssc | session | 30 minutes | HubSpot session identifier tracking page views within a single session | | hubspotutk | persistent | 13 months | HubSpot visitor identity cookie linking form submissions to existing CRM contacts | ### Third-party domains contacted (3) - `hubspot.com` - `js.hs-scripts.com` - `api.hubspot.com` Questions ## Frequently asked questions about HubSpot Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Does HubSpot require GDPR consent? Yes for marketing emails and tracking cookies. The HubSpot tracking script requires cookie consent. Marketing emails require valid opt-in. CRM contacts may rely on legitimate interest or contract performance. HubSpot has built-in GDPR tools. ### What cookies does HubSpot set? HubSpot sets \_\_hstc (13 months), hubspotutk (13 months), and \_\_hssc (30 minutes session). These require consent under the ePrivacy Directive. ### Does HubSpot offer EU data hosting? Yes, on certain plans (Frankfurt). This eliminates SCCs for primary data flows and simplifies GDPR transfer compliance. ### What legal basis applies to HubSpot CRM contacts? Existing customers: legitimate interest or contract performance. Inbound leads with consent: consent. Outbound prospected contacts: legitimate interest with a documented LIA and opt-out in every communication. ### How do I implement cookie consent for HubSpot? Use HubSpot's built-in banner, your own CMP blocking the HubSpot script conditionally, or HubSpot's cookieless tracking mode. ### How do I handle data subject requests in HubSpot? For access: export the contact record. For erasure: use HubSpot's GDPR Delete feature. Respond within 30 days and document all actions. ### Do I need a DPA with HubSpot? Yes. Sign the HubSpot DPA available in the HubSpot Legal Center or via Account Settings. ### Are there EU-based alternatives to HubSpot? Brevo (France) and ActiveCampaign (EU option) offer EU data residency. HubSpot with EU hosting configured is itself a strong compliant option. Related guide ## Our guides on HubSpot [13 May 2026](https://www.flowconsent.com/en/blog/hubspot-cookies-gdpr-compliance) ### [HubSpot and GDPR cookies: compliance guide](https://www.flowconsent.com/en/blog/hubspot-cookies-gdpr-compliance) [HubSpot sets CRM and marketing tracking cookies across multiple sessions. This guide explains how to block the HubSpot script, sign the DPA, and configure forms for GDPR compliance.](https://www.flowconsent.com/en/blog/hubspot-cookies-gdpr-compliance) [Read the guide](https://www.flowconsent.com/en/blog/hubspot-cookies-gdpr-compliance) Same category ## More services: Customer support [See the whole category](https://www.flowconsent.com/en/services/customer-support) ### [Chatway](https://www.flowconsent.com/en/services/customer-support/chatway) [Chatway is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Chatway integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Chatway helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/customer-support/chatway) [Preferences](https://www.flowconsent.com/en/services/customer-support/chatway) · ### [Hikari CS](https://www.flowconsent.com/en/services/customer-support/hikari-cs) [Hikari CS is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Hikari CS enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Hikari CS empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/customer-support/hikari-cs) [Marketing](https://www.flowconsent.com/en/services/customer-support/hikari-cs) · ### [Ultimate](https://www.flowconsent.com/en/services/customer-support/ultimate) [Ultimate is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. Ultimate integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, Ultimate makes advanced AI accessible to all teams.](https://www.flowconsent.com/en/services/customer-support/ultimate) [Customer support](https://www.flowconsent.com/en/services/customer-support/ultimate) · ### [BoatChat](https://www.flowconsent.com/en/services/customer-support/boatchat) [BoatChat is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. BoatChat integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, BoatChat helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/customer-support/boatchat) [Preferences](https://www.flowconsent.com/en/services/customer-support/boatchat) · ### [Hiver](https://www.flowconsent.com/en/services/customer-support/hiver) [Hiver is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Hiver provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Hiver helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/customer-support/hiver) [Marketing](https://www.flowconsent.com/en/services/customer-support/hiver) · ### [Userpilot](https://www.flowconsent.com/en/services/customer-support/userpilot) [Userpilot is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Userpilot integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Userpilot helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/customer-support/userpilot) [Analytics](https://www.flowconsent.com/en/services/customer-support/userpilot) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)