Holding the HubSpot tracking code until visitors consent

The HubSpot tracking code is the loader script served from js.hs-scripts.com/<your-hub-id>.js. As soon as it runs, it sets analytics cookies such as __hstc and hubspotutk, so for EU and UK visitors it has to wait until they consent. You can do that with HubSpot's own banner in opt-in mode, or turn that banner off and let a separate consent tool hold the loader, then tell HubSpot what the visitor chose.

What the HubSpot tracking code actually sets

HubSpot's tracking code stores a handful of cookies as soon as it loads on your page. The main one from a privacy standpoint is __hstc, which tracks visitors across sessions for six months. Alongside it sits hubspotutk, an identity cookie that ties form submissions to browsing history, and __hssc, a session cookie that expires after 30 minutes.

These are not functional cookies. They exist to build visitor profiles, measure page performance and feed data into HubSpot's contact records. Under Article 5(3) of the ePrivacy Directive, storing or reading information on a visitor's device for analytics needs prior consent, and a "legitimate interest" argument does not replace it.

A fourth cookie, __hssrc, helps detect whether the browser has restarted between page views. HubSpot classifies it as an analytics cookie too.

HubSpot cookie reference table

The table follows HubSpot's own cookie list, last updated on 9 September 2026. Any of these names can also be looked up in the cookie database.

The necessary cookies in the table are consent-management cookies that record visitor preferences. They do not need consent because they serve the visitor's own choice. Everything under the Analytics label does.

Why the default HubSpot setup sets cookies too early

If you paste the HubSpot embed code into your site header without any consent logic, every visitor is tracked from the first page view. The __hstc cookie lands immediately. hubspotutk follows. By the time your cookie banner appears, HubSpot has already stored data on the visitor's device.

That breaks the prior-consent rule of the ePrivacy Directive and the GDPR's conditions for consent. Regulators fine exactly this pattern: on 1 September 2025 the CNIL fined SHEIN 150 million euros, in part because advertising cookies were set as soon as visitors arrived, before any choice. The same logic applies to any tracking script, including HubSpot's.

HubSpot does offer a built-in cookie banner. Whether it is enough depends on what else runs on your site.

Option 1: use HubSpot's built-in consent banner

HubSpot includes a consent banner that can work in opt-in mode, and a cookie-by-category mode that records choices per category. Configured for EU, EEA and UK visitors, it holds HubSpot's analytics cookies until the visitor grants permission. You set the banner policy in HubSpot's privacy and consent settings.

This works if HubSpot is your only tracking tool. The banner controls HubSpot's own cookies with no extra code.

The drawback is scope. HubSpot's banner manages HubSpot's cookies. If your site also runs the Meta Pixel, Hotjar, the LinkedIn Insight Tag or any other third-party script, you need a separate solution for each, or a single consent tool that handles everything.

Option 2: turn off HubSpot's banner and use a separate consent tool

Most sites with several tracking tools are better served by one banner that controls every script. To make that work with HubSpot, you turn off HubSpot's banner, hold the tracking code until consent is granted, then load it and pass the choice on to HubSpot.

Turning off HubSpot's banner

HubSpot's consent banner API documents a flag for this: set window.disableHubSpotCookieBanner = true before the banner loads. HubSpot notes that this also turns off all of its own consent management, which is why the next two steps matter.

Blocking HubSpot with the type attribute

The most direct method changes the script's type attribute so the browser does not run it on load. With Kukie.io, set the type to text/plain and add data-cc-category with the category slug:

<script type="text/plain" data-cc-category="marketing"
        src="https://js.hs-scripts.com/YOUR_ID.js"></script>

When the visitor accepts that category, the banner runs the script. Kukie.io's automatic script blocking also recognises hs-scripts.com without any tagging and files it under Marketing, so use the same category if you tag it by hand. The help text in your banner should then describe HubSpot under that category.

Passing the choice to HubSpot

Once the loader runs, HubSpot still needs to know what was accepted, because its own banner is off. The consent banner API's setHubSpotConsent call takes three true or false values: analytics, advertisement and functionality. Kukie.io fires a cc:consent-updated event on document with the accepted category slugs, so the two can be joined:

<script>
  window.disableHubSpotCookieBanner = true;
  document.addEventListener('cc:consent-updated', function (e) {
    var c = e.detail.categories;
    window._hsp = window._hsp || [];
    window._hsp.push(['setHubSpotConsent', {
      analytics: c.indexOf('analytics') !== -1,
      advertisement: c.indexOf('marketing') !== -1,
      functionality: c.indexOf('functional') !== -1
    }]);
  });
</script>

HubSpot's documentation notes that this value is not saved in its banner cookies. The event fires again on every page view when a returning visitor's choice is restored, so the value is sent each time. Check your own category slugs in Kukie.io before you copy the example.

Blocking HubSpot through Google Tag Manager

If you load HubSpot through Google Tag Manager, open the HubSpot tag's consent settings and require the consent type your banner uses, such as analytics_storage. The tag then fires only after the consent update arrives. The Consent Initialization trigger is a different thing: it is where the default consent state is set before other tags run, not a trigger for the HubSpot tag itself. Both patterns are covered in the guide on conditionally loading third-party scripts.

Using HubSpot's privacy API

HubSpot also provides JavaScript calls for consent-aware loading. _hsq.push(['doNotTrack']) sets the __hs_do_not_track cookie and stops the tracking code from collecting anything, even when the script has loaded. To react when a visitor's choice changes in HubSpot's banner, register a listener on _hsp:

var _hsp = window._hsp = window._hsp || [];
_hsp.push(['addPrivacyConsentListener', function (consent) {
  if (consent.categories.analytics) {
    // Visitor has granted analytics consent
  } else {
    var _hsq = window._hsq = window._hsq || [];
    _hsq.push(['doNotTrack']);
  }
}]);

This approach lets the HubSpot script load while data collection waits for consent. The downside is that the script still places HubSpot's necessary cookies on the visitor's device, and the request to load it still reaches HubSpot. Whether that is acceptable depends on how strictly you block scripts before consent.

How to verify that blocking works

After implementing any of these methods, open Chrome DevTools and check the Application tab. Before granting consent, you should see no __hstc, hubspotutk, __hssc or __hssrc cookies. With the type="text/plain" approach, the Network tab should also show no request to js.hs-scripts.com.

Grant consent through your banner, then reload the page. The analytics cookies should now appear. If they do not, check that your consent tool is releasing the script. For a full method, see the guide on verifying that rejected cookies are actually blocked.

HubSpot forms, chat and the consent boundary

HubSpot's tracking code is not the only source of cookies. The chat widget sets messagesUtk, which HubSpot lists as a functionality cookie kept for six months to recognise returning chat users. Whether it counts as strictly necessary depends on how your site uses the widget. If chat is a core support channel, you may argue it is functional. If it is mainly for lead capture, regulators may disagree.

HubSpot forms submit the hubspotutk value with the form data, linking the submission to the visitor's browsing history. If the visitor has not consented to analytics, that value should be empty. Test your forms after setting up consent blocking to confirm that hubspotutk is not passed without permission.

The classification of chat cookies remains a grey area across regulators. Write down your reasoning and be ready to adjust it if guidance changes.

Google Consent Mode v2 alongside HubSpot

If your site also runs Google tags, Google Consent Mode v2 is a separate signal from HubSpot's consent. Google expects a default state, usually denied, before its tags send data, and an update with the four signals ad_storage, analytics_storage, ad_user_data and ad_personalization once the visitor chooses.

If you keep HubSpot's banner, check its settings for how it passes consent to Google. If you use a separate consent tool, that tool sends the Consent Mode signals, and the snippet above passes the same choice to HubSpot, so both follow one banner.

HubSpot consent questions

See which scripts load before your HubSpot banner

HubSpot is rarely the only tag on a page. The Script audit checks one page for third-party scripts, including js.hs-scripts.com, and shows whether each one sets cookies before a choice is made.

Audit your scripts