HubSpot

Overview

HubSpot is an all-in-one CRM, marketing automation, sales, and customer service platform widely used by inbound marketing teams. Its tracking code is one of the most commonly deployed marketing scripts on the web. HubSpot scripts serve multiple functions simultaneously: visitor tracking and identification, marketing attribution, live chat, forms, and CRM contact enrichment.

What This Script Does

HubSpot's tracking code (hs-script-loader) loads multiple subsystems:

Tracking and Analytics

• Tracks every page view with full URL, referrer, and timestamp
• Records form submissions (both HubSpot forms and native HTML forms when configured)
• Captures UTM parameters and marketing attribution data (source, medium, campaign)
• Monitors CTA clicks and content interactions
• Fires custom behavioral events when configured via the HubSpot API

Cookies Set

• __hssc — session cookie tracking current session page view count (30-minute expiry)
• __hssrc — session cookie detecting new sessions vs. tab reopens
• __hstc — persistent cookie (13 months) containing visitor ID, first visit timestamp, last visit timestamp, current session timestamp, and session count. This is the primary tracking cookie.
• hubspotutk — persistent cookie (13 months) storing the visitor's unique identity token. This value is sent to HubSpot when a form is submitted, linking anonymous browsing history to a known contact in the CRM.
• __hs_opt_out — stores cookie consent banner response
• __hs_do_not_track — respects Do Not Track settings when enabled
• __hs_initial_opt_in — tracks initial consent state
• messagesUtk — persistent cookie for chat widget visitor identification

Live Chat (HubSpot Conversations)

• Loads the chat widget when configured
• Sets messagesUtk to identify returning chat visitors
• Tracks which pages the visitor viewed before starting a conversation
• Sends browsing context to agents in real time

Forms

• Renders HubSpot-hosted forms or enhances native forms with tracking
• Pre-fills form fields for returning visitors when identity is known
• On submission, links all prior anonymous browsing history to the contact record in HubSpot CRM

Network Requests

• Sends tracking data to track.hubspot.com and forms.hubspot.com
• Loads chat widget resources from app.hubspot.com
• Downloads form definitions and configuration from HubSpot CDN
• May load additional scripts for A/B testing, ads tracking, or integrations depending on HubSpot portal configuration

Consent & Compliance

• Consent categories: Marketing (visitor tracking, attribution, CRM identification), Analytics (page views, behavioral events), Functional (live chat, forms)
• GDPR/ePrivacy: HubSpot sets multiple persistent cookies with long expiration periods (up to 13 months) that track visitors across sessions and link anonymous behavior to identified contacts. Requires explicit opt-in consent under both ePrivacy Directive and GDPR. HubSpot provides a built-in cookie consent banner, but if a third-party CMP is used, the tracking code must be gated behind consent.
• CCPA: Visitor tracking data, behavioral profiles, and contact enrichment constitute personal information. Requires prominent disclosure. The hubspotutk cookie specifically enables cross-session identification, which falls under PI definitions.
• Data Processing: HubSpot acts as a data processor. A DPA is available in HubSpot account settings and should be executed.
• Consent granularity: HubSpot's tracking code loads as a single script that enables all features simultaneously. For granular consent (e.g., allow chat but block tracking), the HubSpot consent API or conditional loading at the CMP level is required.

Because HubSpot serves marketing, analytics, and functional purposes simultaneously, there are several approaches to consent management: (1) Block everything until marketing consent — the simplest approach, treating the entire script as marketing since tracking is its primary function. (2) Use HubSpot's consent API — load the script but call _hsq.push(["doNotTrack"]) until consent is granted. (3) Conditional feature loading — if only chat is needed, the HubSpot Conversations API can be deployed independently without the full tracking code.

Should You Block This Without Consent?

Yes. HubSpot's tracking code sets persistent identification cookies, tracks page views across sessions, and builds behavioral profiles linked to CRM contacts. Even when used primarily for its chat or forms features, the default tracking code includes full visitor monitoring. It should not load until the user has granted at least marketing consent. If chat functionality is needed without tracking, the Conversations widget can be deployed separately using HubSpot's standalone chat embed.