HubSpot's tracking code sets four main cookies: __hstc and hubspotutk (visitor identity, 6 months each), __hssc (session page views, 30 minutes) and __hssrc (browser restart detection, session). All four track visitors for analytics, so they need consent in the EU before they are set. HubSpot's own consent banner can hold them back, but by HubSpot's own account it cannot block cookies from scripts you place on the page yourself.
Which cookies HubSpot sets on your website
Every HubSpot-hosted or HubSpot-tracked page places a handful of cookies in your visitors' browsers. Most of these cookies support analytics and CRM identification rather than basic site functionality, which means they fall squarely under Article 5(3) of the ePrivacy Directive and require prior consent in the EU. The details below come from HubSpot's list of the cookies it sets, last updated on 9 September 2026.
__hstc tracks a visitor's identity across sessions. It stores the domain, the hubspotutk value, the timestamp of the first visit, the last visit and the current visit, plus a running session counter. It expires after six months.
hubspotutk is the cookie people look up most. It holds an opaque ID for the current visitor and is passed to HubSpot when the visitor submits a form, which is how HubSpot ties earlier anonymous page views to a contact record and removes duplicate contacts. It expires after 6 months and belongs in the Analytics category. When a visitor declines tracking through HubSpot's banner, HubSpot stops setting it, so a later form submission creates a contact without the browsing history. You can look up its details in the cookie database.
__hssc counts page views within a single session and expires after 30 minutes. __hssrc is a session cookie that helps HubSpot detect whether the browser has been restarted since the last visit.
| Cookie name | Purpose | Expiry | Category |
|---|---|---|---|
__hstc | Visitor identity and session tracking | 6 months | Analytics |
__hssc | Session page-view counter | 30 minutes | Analytics |
__hssrc | Browser restart detection | Session | Analytics |
hubspotutk | Visitor identity for form submissions | 6 months | Analytics |
messagesUtk | Live chat visitor identity | 6 months | Functionality |
__hs_opt_out | Remembers the visitor's opt-out choice | 6 months | Strictly necessary |
__hs_do_not_track | Stops the tracking code sending data | 6 months | Strictly necessary |
__hs_cookie_cat_pref | Stores category-level consent choices | 6 months | Strictly necessary |
__cf_bm | Bot protection by HubSpot's CDN provider | 30 minutes | Strictly necessary |
If you also run the HubSpot live chat widget, messagesUtk joins the list. HubSpot treats it as a necessary cookie when the "Consent to collect chat cookies" setting is on, and puts it under the banner's control when that setting is off. And if your site uses Google Analytics, Meta Pixel or other marketing tags that you added yourself, those tools add their own cookies, such as _ga and _fbp, that the HubSpot banner does not control.
Setting up HubSpot's own cookie banner
HubSpot's consent banner lives under Settings > Privacy & Consent > Cookies. It works on HubSpot-hosted pages and on external pages with the HubSpot tracking code, once HubSpot has verified the domain. According to HubSpot's guide to the new banner editor (updated 28 September 2026), each banner lets you choose:
A banner type: Notification (a notice only), Opt-in (visitors must agree before tracking) or Opt-out (tracking starts, visitors can refuse), with an option to let visitors decide by category
The countries where it is shown, based on the visitor's IP address, and an optional URL path for one section of the site
Whether it responds to Global Privacy Control signals from the browser
The text of every button and category, per language
For EU visitors, the banner type that matches the prior-consent rule is Opt-in. Accounts created after November 2022 have this v2 editor by default. Older accounts using the v1 editor have been moved over automatically in phases since 11 May 2026, and can switch manually at any time.
The banner integrates tightly with HubSpot's own tracking code. When a visitor declines cookies, HubSpot's JavaScript stops setting __hstc, __hssc, __hssrc and hubspotutk. Form submissions still work, but the contact record will not be linked to prior browsing activity. HubSpot says the banner also blocks cookies from its Google Analytics and Google Tag Manager integrations and from pixels added through the HubSpot ads tool, as long as those come through HubSpot.
Where the built-in banner falls short
The built-in banner controls HubSpot's own cookies effectively. The problem starts with everything else running on your site.
HubSpot's help centre puts it directly: HubSpot cannot automatically block cookies from scripts you manually place on the page. Third-party scripts added through custom HTML modules, theme templates or external tag managers fire and set cookies regardless of what a visitor selects in the HubSpot banner. That includes a Hotjar heatmap, a LinkedIn Insight Tag and a YouTube video pasted into a custom HTML module as an embed code.
Under the GDPR, the site owner is responsible for every cookie set on the domain, not only the cookies from the platform hosting the site. Regulators sanction exactly this gap. On 20 November 2025, the CNIL fined Condé Nast EUR 750,000 because cookies on vanityfair.fr were placed, and existing ones kept being read, after visitors had clicked "Refuse all" in a banner that was there, according to the CNIL's vanityfair.fr decision.
Other limitations worth noting:
No script-blocking engine for your own code: the banner records consent for HubSpot's cookies but does not prevent non-HubSpot scripts from executing
Region rules are set by country per banner, so a site that needs opt-in in Europe, opt-out in California and nothing elsewhere has to maintain several banners in step
If Require opt-in is off, a visitor who closes the banner cannot reopen it, because there is no opt-in to revoke
Custom CSS or JavaScript changes to the banner may need rework after the move from the v1 to the v2 editor
Why an external CMP helps on HubSpot sites
A dedicated cookie consent management platform fills the gaps that HubSpot's built-in tool leaves open. The core difference is script blocking: an external CMP intercepts and holds all tagged scripts until the visitor makes a consent choice, then releases only the categories the visitor approved.
This matters because tracking cookies from third-party tools should never reach the browser before consent is granted. A CMP that handles script blocking at the page level, not just within one platform's ecosystem, gives you coverage across every tag on the page.
An external CMP also brings a scan of the whole site. Rather than manually cataloguing cookies each time you add a new integration, the scanner detects cookies across your entire domain and flags uncategorised ones for review. For HubSpot sites that frequently add marketing tools and landing page experiments, this ongoing audit is difficult to replicate by hand.
How to add an external cookie banner to HubSpot
Adding a third-party consent banner to a HubSpot-hosted website involves injecting a script into the site header. HubSpot provides a dedicated area for this under Settings, then Website, then Pages, in the Header HTML section. Placing the CMP script here makes it load before any other tracking code on the page. With Kukie.io, the tag to paste is:
<script src="https://cdn.kukie.io/s/YOUR_SITE_KEY/c.js" async></script>The Kukie.io HubSpot installation guide in the Help Centre walks through the exact steps: copying the embed code, pasting it into the HubSpot header, and verifying that cookies are blocked until consent is given.
After installing the external banner, turn off HubSpot's built-in cookie banner to avoid showing visitors two overlapping consent prompts. The external CMP will handle consent for HubSpot's own cookies alongside every other script on the page.
Configuring cookie categories for HubSpot tracking
Once your external CMP is in place, assign each cookie to the correct cookie category. HubSpot's analytics cookies, __hstc, __hssc, __hssrc and hubspotutk, belong in the Analytics category. The live chat cookie messagesUtk could sit under Functionality, since it supports a user-facing feature rather than behavioural tracking.
Consent preference cookies like __hs_opt_out, __hs_do_not_track and __hs_cookie_cat_pref are strictly necessary and do not require consent.
If you run HubSpot tracking alongside Google Ads or Meta advertising pixels, those cookies fall under Marketing. Keeping categories accurate matters because a miscategorised cookie fires under the wrong choice, and that is the kind of gap regulators and auditors catch quickly.
Testing your HubSpot cookie consent setup
Before going live, verify three things. Open your site in a private window and check that no analytics or marketing cookies appear before you interact with the banner. Decline all optional cookies, then confirm that __hstc and hubspotutk are absent from the browser's cookie storage. Accept analytics cookies and verify they appear.
Run a cookie scan against your domain to catch any cookies that slipped through. Pay attention to embedded iframes: HubSpot's FAQ notes that a page with the tracking code loaded inside an iframe shows the consent banner there too, unless you limit the banner to specific domains and URLs.
Repeat this test after every significant change to your HubSpot portal: new integrations, theme updates or landing page launches can introduce cookies that were not present during your initial setup.
HubSpot cookie questions
Does HubSpot set cookies without consent?
By default, HubSpot's tracking code sets cookies as soon as the page loads. To prevent this, turn on an Opt-in consent banner in HubSpot's privacy settings or install an external CMP that blocks scripts before consent.
Can HubSpot's cookie banner handle GDPR opt-in consent?
The built-in banner can collect opt-in consent for HubSpot's own cookies and its Google Analytics and Google Tag Manager integrations. It does not block scripts you placed on the page yourself, which limits its usefulness on sites with several tracking tools.
Does the HubSpot banner block YouTube embeds?
Not when you paste the YouTube embed code into the page yourself. HubSpot says it cannot automatically block cookies from scripts placed manually on the page, so the video needs a separate blocker that holds the iframe until consent.
Can I use HubSpot and an external cookie consent tool at the same time?
Yes, but you should turn off HubSpot's built-in banner to avoid displaying two consent prompts. The external CMP takes over consent management for all cookies, including HubSpot's own tracking cookies.
Does HubSpot support Google Consent Mode v2?
HubSpot's banner documentation says it blocks cookies from its own Google Analytics and Google Tag Manager integrations. For Consent Mode signals across every Google tag on the page, including ones you added yourself, use a CMP with a Google Consent Mode v2 integration.
How do I block HubSpot cookies until consent is given?
Either set HubSpot's consent banner to Opt-in in the privacy settings, or install an external CMP that holds the HubSpot tracking script back until the visitor grants consent.
See every cookie on your HubSpot pages, not only HubSpot's
If you are not sure which cookies your HubSpot site sets, start with a scan. Kukie.io lists every cookie it finds, sorts it into a category and with auto-blocking on, holds non-essential scripts, HubSpot's tracking code included, until visitors choose. Its Google Consent Mode v2 integration sends the signals for Google tags on the same page. The Free plan covers up to 5 websites.
