Do I need consent to use HubSpot Email tracking?

Yes. The website-side identity linking that activates when email recipients click through to the site is marketing tracking requiring cookie consent. The act of clicking a marketing email link does not constitute consent to website tracking. HubSpot Email is classified as marketing and its web tracking must be gated on consent.

What does HubSpot Email track on my website?

When an email recipient clicks through, HubSpot rewrites links via track.hubspot.com and injects UTM parameters. On the landing page, the tracking code sets or updates hubspotutk, linking the visitor's browser to their CRM contact record. All subsequent browsing is then attributed to that contact via __hstc (13-month expiry).

How does ConsentStack handle HubSpot Email?

ConsentStack detects HubSpot tracking activated by email click-throughs and classifies it as marketing. Tracking scripts are blocked until the visitor consents on the landing page, preventing identity linking between email engagement and web browsing. ConsentStack treats email-triggered tracking identically to any other HubSpot marketing script.

HubSpot Email - Campaign Tracking Consent

Overview

HubSpot Email is HubSpot's email marketing module for creating, sending, and tracking marketing email campaigns. Its relevance to website cookie consent arises when email recipients click through links in marketing emails and land on the website, where HubSpot's tracking infrastructure connects the email engagement to the visitor's browsing session and CRM profile.

What This Script Does

HubSpot Email's web-facing behavior occurs primarily through email-to-web tracking:

Tracking pixels — HTML emails sent through HubSpot contain a 1x1 pixel image loaded from HubSpot's servers. When the recipient opens the email, the pixel fires and records the open event, including timestamp, IP address, email client, and device type.
Click tracking — links in HubSpot emails are rewritten to pass through HubSpot's click tracking servers (e.g., track.hubspot.com or custom tracking domains). The redirect logs the click event before forwarding the recipient to the destination URL.
UTM parameter injection — HubSpot appends UTM parameters to email links, enabling the website's HubSpot tracking code to attribute the visit to the specific email campaign.
Contact identity linking — when an email recipient clicks through to the website, the click tracking URL includes a contact identifier. The HubSpot tracking code on the landing page uses this to set or update the hubspotutk cookie, linking the visitor's browser to their CRM contact record. From this point forward, all subsequent browsing is attributed to that contact — even on return visits days or weeks later.

The email-side tracking (opens and clicks) operates within the email channel and does not set website cookies. The website-side impact comes from the identity linking that occurs on click-through, which activates the standard HubSpot tracking cookie suite (__hstc, hubspotutk, __hssc, __hssrc).

Consent & Compliance

HubSpot Email is classified under marketing. The email tracking pixels and click tracking serve marketing measurement purposes, and the identity-linking mechanism that connects email engagement to website browsing is a marketing profiling technique. Under GDPR, the email tracking itself may be covered by the consent obtained for email marketing (provided the privacy notice disclosed tracking), but the website-side identity linking and subsequent behavioral tracking require separate cookie consent.

The ePrivacy Directive requires consent for the tracking cookies set on the website when the recipient clicks through. The act of clicking a link in a marketing email does not constitute consent to website tracking.

Under CCPA/CPRA, both the email tracking data and the linked website behavioral data constitute personal information. The cross-channel profiling that connects email engagement to web browsing must be disclosed in the privacy notice, and consumers must be able to opt out of this combined tracking.

Should You Block This Without Consent?

Yes. The website-side tracking that activates when email recipients click through to the site is marketing tracking that requires consent. The HubSpot tracking code should be blocked until the visitor consents to marketing cookies. Note that email-side tracking (open pixels, click tracking) is governed by email marketing consent rather than cookie consent and is managed separately.

Is HubSpot Email GDPR compliant?

HubSpot Email typically loads marketing trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So HubSpot Email can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads HubSpot Email, not on HubSpot Email itself.