HubSpot Ads

HubSpot Ads sets four main cookies. __hstc (six months) is the primary analytics cookie that links all visits from the same browser to build a visit history. hubspotutk (six months) stores a unique visitor token that is matched against HubSpot contact records to attribute web activity to known contacts. __hssc (thirty minutes) tracks activity within a single session to understand page sequences. __hssrc (session) detects when the browser starts a new session. All four are non essential and require prior consent.

Yes, explicit opt in consent is required. HubSpot Ads involves advertising profiling and sharing visitor data with multiple ad networks (Google, Meta, LinkedIn), which is a high risk activity under GDPR. You must not fire the HubSpot tracking script or sync any audience until the visitor has actively consented to advertising and analytics cookies. Bundling consent with terms of service or using pre ticked boxes is not valid.

The legal basis is consent under Article 6(1)(a) GDPR. Advertising profiling and the sharing of personal data with advertising networks (Google, Meta, LinkedIn) cannot rely on legitimate interests given the scale of tracking and the impact on individuals. Consent must be opt in, granular enough to cover each ad network separately, and freely withdrawable at any time without detriment to the user.

Yes. All visitor and contact data processed by HubSpot Ads flows to HubSpot in the United States. In addition, audience and conversion data is shared with Google, Meta and LinkedIn, which are also US based. HubSpot relies on the EU US Data Privacy Framework and standard contractual clauses. You must disclose all four companies as recipients and describe the US transfer in your privacy policy.

Yes, a DPIA is strongly recommended and likely required given the high risk rating. The combination of cross site behavioural tracking, audience profiling and data sharing with multiple US advertising networks creates significant privacy risks. The DPIA must assess the necessity and proportionality of each audience sync, evaluate whether advertising goals could be achieved with less data, and document the transfer mechanisms for each ad platform. Obtain legal sign off before activating the integration.

Gate the HubSpot tracking script behind advertising consent in your consent management platform so it does not fire until consent is given. Sign the HubSpot Data Processing Agreement. Complete a DPIA before activating audience syncing. Update your privacy policy to name HubSpot, Google, Meta and LinkedIn as recipients and explain US transfers under the EU US Data Privacy Framework and standard contractual clauses. List all four HubSpot cookies in your cookie policy. Disable all HubSpot Ads features for visitors who decline consent.

If the primary concern is US data transfers and advertising profiling, consider restricting HubSpot Ads to first party analytics only and using EU based advertising alternatives. Matomo (self hosted) provides first party analytics without US transfers. For ad audience building, server side conversion APIs reduce the cookie footprint but do not eliminate the US transfer issue. There is no like for like EU alternative that matches HubSpot Ads feature set without US data processing.

Add a dedicated HubSpot section to your cookie policy. List all four cookies: __hstc (analytics, six months, HubSpot), hubspotutk (analytics, six months, HubSpot), __hssc (analytics, thirty minutes, HubSpot) and __hssrc (analytics, session, HubSpot). Categorise them as analytics or advertising cookies depending on whether audience syncing is active. Link each to your consent categories in your consent management platform so visitors can accept or reject them independently of other cookies.