Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
HubSpot Ads places the HubSpot tracking script on your site to sync visitors into advertising audiences on Google, Meta and LinkedIn and to measure ad conversions. All data flows to the United States, requiring explicit consent.
HubSpot Ads is part of HubSpot Marketing Hub. It loads the HubSpot tracking script on your website, records page visits and conversion events, and syncs your website visitor and contact data into advertising audiences on Google, Meta and LinkedIn. It also reports ad conversion data back to those platforms so you can measure campaign performance inside HubSpot.
HubSpot Ads sets several persistent cookies that track individual visitors across sessions. The __hstc cookie links visits over six months. The hubspotutk cookie stores a unique visitor token that is tied to HubSpot contact records. The __hssc cookie tracks activity within a session and the __hssrc cookie detects when a new browser session starts. In addition to these cookies, HubSpot reads contact email addresses and syncs them as hashed audience lists to the connected ad networks.
HubSpot Ads involves advertising profiling, cross site tracking and sharing of personal data with multiple third party platforms, all of which require consent under GDPR and the ePrivacy Directive. The risk level is high because the data flows to the United States and is shared with major advertising networks that have their own extensive processing activities. You must not fire the HubSpot tracking script or sync any audience until the visitor has given explicit consent.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Visitors must give opt in consent before the tracking script loads and before any data is shared with advertising platforms. The consent must name HubSpot and each connected ad network (Google, Meta, LinkedIn) as recipients. Audience syncing should be gated behind the same consent. Withdrawing consent must stop tracking immediately and, where technically possible, trigger deletion from existing audience lists.
All data flows to the United States. HubSpot relies on the EU US Data Privacy Framework and standard contractual clauses. The connected advertising networks (Google, Meta, LinkedIn) have their own transfer mechanisms. You must disclose all recipients and transfer mechanisms in your privacy policy and cookie policy.
Gate the HubSpot tracking script behind advertising consent in your consent management platform. Sign the HubSpot Data Processing Agreement. Complete a DPIA before activating audience syncing. Update your privacy policy to name HubSpot, Google, Meta and LinkedIn as recipients and describe US transfers. List all four HubSpot cookies in your cookie policy. Disable HubSpot Ads features for visitors who decline consent and review the integration after any HubSpot subprocessor list updates.
Websites using HubSpot Ads must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is strongly recommended for HubSpot Ads given the high risk rating. The combination of cross site tracking, audience syncing to multiple ad networks and US data transfers creates significant privacy risks. Assess the necessity and proportionality of each audience sync, document the legal basis and transfer mechanisms for each ad platform, and evaluate whether the advertising purposes could be achieved with less data. Record the DPIA outcome before activating the integration.
Sample consent text
I consent to my browsing behaviour and contact information being shared with HubSpot and used to build advertising audiences on Google, Meta and LinkedIn. My data may be transferred to the United States under standard contractual clauses. I can withdraw consent at any time.
Third-party domains contacted
js.hs-scripts.comjs.hs-analytics.nettrack.hubspot.comforms.hsforms.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| __hstc | Analytics | 6 months | Primary HubSpot analytics cookie linking all visits from the same browser to build a cross session visitor history |
| hubspotutk | Analytics | 6 months | Stores a unique visitor token used by HubSpot to associate web activity with known contact records and ad conversions |
| __hssc | Analytics | 30 minutes | Tracks visitor activity within a single browsing session to understand page sequences and session engagement |
| __hssrc | Analytics | Session | Detects when a visitor starts a new browser session so HubSpot can correctly count separate visits |
HubSpot Ads places tracking cookies for advertising — comply with GDPR using FlowConsent.
HubSpot Ads sets four main cookies. __hstc (six months) is the primary analytics cookie that links all visits from the same browser to build a visit history. hubspotutk (six months) stores a unique visitor token that is matched against HubSpot contact records to attribute web activity to known contacts. __hssc (thirty minutes) tracks activity within a single session to understand page sequences. __hssrc (session) detects when the browser starts a new session. All four are non essential and require prior consent.
Yes, explicit opt in consent is required. HubSpot Ads involves advertising profiling and sharing visitor data with multiple ad networks (Google, Meta, LinkedIn), which is a high risk activity under GDPR. You must not fire the HubSpot tracking script or sync any audience until the visitor has actively consented to advertising and analytics cookies. Bundling consent with terms of service or using pre ticked boxes is not valid.
The legal basis is consent under Article 6(1)(a) GDPR. Advertising profiling and the sharing of personal data with advertising networks (Google, Meta, LinkedIn) cannot rely on legitimate interests given the scale of tracking and the impact on individuals. Consent must be opt in, granular enough to cover each ad network separately, and freely withdrawable at any time without detriment to the user.
Yes. All visitor and contact data processed by HubSpot Ads flows to HubSpot in the United States. In addition, audience and conversion data is shared with Google, Meta and LinkedIn, which are also US based. HubSpot relies on the EU US Data Privacy Framework and standard contractual clauses. You must disclose all four companies as recipients and describe the US transfer in your privacy policy.
Yes, a DPIA is strongly recommended and likely required given the high risk rating. The combination of cross site behavioural tracking, audience profiling and data sharing with multiple US advertising networks creates significant privacy risks. The DPIA must assess the necessity and proportionality of each audience sync, evaluate whether advertising goals could be achieved with less data, and document the transfer mechanisms for each ad platform. Obtain legal sign off before activating the integration.
Gate the HubSpot tracking script behind advertising consent in your consent management platform so it does not fire until consent is given. Sign the HubSpot Data Processing Agreement. Complete a DPIA before activating audience syncing. Update your privacy policy to name HubSpot, Google, Meta and LinkedIn as recipients and explain US transfers under the EU US Data Privacy Framework and standard contractual clauses. List all four HubSpot cookies in your cookie policy. Disable all HubSpot Ads features for visitors who decline consent.
If the primary concern is US data transfers and advertising profiling, consider restricting HubSpot Ads to first party analytics only and using EU based advertising alternatives. Matomo (self hosted) provides first party analytics without US transfers. For ad audience building, server side conversion APIs reduce the cookie footprint but do not eliminate the US transfer issue. There is no like for like EU alternative that matches HubSpot Ads feature set without US data processing.
Add a dedicated HubSpot section to your cookie policy. List all four cookies: __hstc (analytics, six months, HubSpot), hubspotutk (analytics, six months, HubSpot), __hssc (analytics, thirty minutes, HubSpot) and __hssrc (analytics, session, HubSpot). Categorise them as analytics or advertising cookies depending on whether audience syncing is active. Link each to your consent categories in your consent management platform so visitors can accept or reject them independently of other cookies.