Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
HubSpot Meetings embeds a scheduling page so visitors can book a slot. It collects name, email and meeting details, transfers them to HubSpot in the United States and can load HubSpot tracking cookies requiring consent.
HubSpot Meetings embeds a booking scheduler on your website so visitors can pick a time slot and reserve a meeting directly from your site. The embed loads code from meetings.hubspot.com, collects the visitor name, email address and meeting details, and stores that information in your HubSpot CRM. While the embed is active it can also place HubSpot analytics and tracking cookies on the visitor's device.
The embed collects name, email and the chosen meeting time when a visitor submits the booking form. It also loads the HubSpot tracking infrastructure which can set __hstc (six months, cross session analytics), hubspotutk (six months, visitor to contact linking), __hssc (thirty minutes, session tracking) and __hssrc (session, detects new sessions). The messagesUtk cookie (six months) links conversations and meetings to a single contact record.
HubSpot Meetings involves two distinct legal bases. Processing the booking itself (name, email, meeting time) is justified under Article 6(1)(b) GDPR as processing necessary for a contract the visitor requests. However the non essential tracking cookies the embed loads require separate consent under Article 6(1)(a) GDPR and the ePrivacy Directive. You must handle these two streams separately and not bundle the tracking cookie consent with the booking process.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
The booking form itself does not require consent because it operates under the contract basis, but you must provide clear information about who processes the data and where (HubSpot, United States). The non essential HubSpot tracking cookies must not be placed until the visitor has given opt in consent via your cookie consent mechanism. Ideally configure the embed so tracking cookies are blocked for visitors who have not consented while the booking form remains available.
Booking and tracking data are transferred to and processed by HubSpot in the United States. The transfer is covered by the EU US Data Privacy Framework and standard contractual clauses. You must disclose this transfer in your privacy policy and inform booking visitors that their data is processed by HubSpot in the US.
Sign the HubSpot Data Processing Agreement. Configure your consent management platform to block non essential HubSpot cookies for visitors who have not given tracking consent while keeping the booking embed available. Update your privacy policy to describe the dual legal basis, name HubSpot as the processor and explain US transfers. List all five HubSpot cookies in your cookie policy. Add a short privacy notice near the booking form explaining how the visitor's booking details are used.
Websites using HubSpot Meetings must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is advisable if the meetings embed is used alongside behavioural tracking or audience syncing. The booking itself uses Article 6(1)(b) and is lower risk, but the accompanying HubSpot tracking cookies add a profiling dimension. Assess whether the tracking cookies can be blocked until consent is given without breaking the booking flow. Document the dual legal basis approach and the US transfer mechanism in your record of processing activities.
Sample consent text
To book a meeting I provide my name and email. These are stored by HubSpot in the United States under standard contractual clauses. The meeting booking is processed on the basis of our contract. I separately consent to HubSpot tracking cookies being placed on my device for analytics purposes and can withdraw this consent at any time.
Third-party domains contacted
meetings.hubspot.comstatic.hsappstatic.netjs.hs-scripts.comjs.usemessages.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| __hstc | Analytics | 6 months | Primary HubSpot analytics cookie that links all visits from the same browser across sessions |
| hubspotutk | Analytics | 6 months | Stores a unique visitor token used to associate browsing activity with HubSpot contact records |
| __hssc | Analytics | 30 minutes | Tracks visitor activity within a single session to understand page sequences |
| __hssrc | Analytics | Session | Detects when the browser starts a new session for accurate visit counting |
| messagesUtk | Functional | 6 months | Links meeting bookings and chat conversations to a single HubSpot contact record |
HubSpot Meetings uses cookies for user preferences — inform visitors with a consent banner.
HubSpot Meetings can set five cookies. __hstc (six months) is the main cross session analytics cookie. hubspotutk (six months) links your browser to a HubSpot contact record. __hssc (thirty minutes) tracks activity within a session. __hssrc (session) detects new browser sessions. messagesUtk (six months) links meeting bookings and chat conversations to a single contact so HubSpot can track the full journey. All except the basic booking functionality cookies are non essential and require prior consent.
Partially. The booking form itself (collecting name, email and meeting time) operates under the contract basis (Article 6(1)(b) GDPR) and does not require consent, but you must inform visitors about the processing. The non essential HubSpot tracking cookies that the embed loads do require prior opt in consent. You must handle these separately and not make the booking conditional on accepting tracking cookies.
There are two legal bases. The meeting booking itself (name, email, chosen slot) is processed under Article 6(1)(b) GDPR as processing necessary for a contract at the visitor's request. The non essential HubSpot tracking cookies (analytics, cross session tracking) require consent under Article 6(1)(a) GDPR and the ePrivacy Directive. Both bases must be documented separately in your record of processing activities and disclosed in your privacy policy.
Yes. Both the booking data (name, email, meeting time) and any tracking cookie data are transmitted to and processed by HubSpot in the United States. The transfer is covered by the EU US Data Privacy Framework and standard contractual clauses. You must disclose this transfer in your privacy policy and inform booking visitors that their data is processed by HubSpot in the US, both on the booking page and in your general privacy notice.
A full DPIA is advisable but may not be strictly required if the embed is used only for basic meeting booking without additional tracking or audience syncing. The booking itself under Article 6(1)(b) is relatively low risk. However if the embed is deployed alongside HubSpot marketing tracking and audience syncing, a DPIA becomes more necessary. Document the dual legal basis approach and the US transfer mechanism in your record of processing activities as a minimum step.
Sign the HubSpot Data Processing Agreement. Configure your consent management platform to block non essential HubSpot cookies for visitors without tracking consent while keeping the booking embed available. Update your privacy policy to describe the dual legal basis, name HubSpot as the processor and explain US transfers. Add a short privacy notice near the booking form stating that booking details are stored by HubSpot in the US. List all five HubSpot cookies in your cookie policy and link them to your consent categories.
If reducing US data transfers is the goal, consider Cal.com (self hostable, open source), Calendly (US based but focused on scheduling only with a smaller data footprint) or Tidycal. Self hosting Cal.com keeps all booking data on your own infrastructure and eliminates third party transfers entirely. If you are already using HubSpot CRM and need tight integration, the compliance cost of HubSpot Meetings is lower than switching tools, provided the dual legal basis is properly implemented.
Add a HubSpot Meetings section to your cookie policy. List all five cookies: __hstc (analytics, six months), hubspotutk (analytics, six months), __hssc (analytics, thirty minutes), __hssrc (analytics, session) and messagesUtk (functional, six months, links meetings and chat to contact records). Categorise the tracking cookies as analytics and link them to your consent categories. Explain that the booking form itself does not require cookie consent but the tracking cookies loaded alongside it do.