HubSpot Forms

Overview

HubSpot Forms is HubSpot's embedded lead capture tool for collecting contact information through forms placed on any website. Form submissions feed directly into HubSpot CRM, creating or updating contact records and triggering marketing automation workflows. The forms infrastructure also includes non-HubSpot form tracking, which monitors and captures submissions from native HTML forms that are not built with HubSpot.

What This Script Does

HubSpot Forms deploys scripts that handle form rendering, submission processing, and visitor identification:

• Form embed script — loaded from js.hsforms.net, this script renders HubSpot-designed forms on the page, handling validation, multi-step form logic, progressive profiling (showing different fields to known vs. unknown contacts), and dependent field logic.
• Collected forms script — loaded from js.hscollectedforms.net, this script monitors all form submissions on the page, including forms not built with HubSpot. When a visitor submits any form containing an email field, the script captures the submission and sends it to HubSpot, creating a contact record. This behavior is opt-in at the HubSpot account level but is enabled by default for many accounts.
• hubspotutk — the visitor identity cookie is critical to Forms' operation. When a form is submitted, the hubspotutk value is included in the submission payload, linking the form fill to the visitor's entire browsing history. This retroactively associates all previous anonymous page views with the now-identified contact.
• Standard HubSpot cookies — __hstc, __hssc, and __hssrc are set alongside hubspotutk as part of the tracking infrastructure that accompanies the forms.
• Pre-population — for returning visitors whose hubspotutk matches a known contact, form fields may be pre-populated with previously submitted values, showing the visitor's name and email already filled in.

Data collected through forms is transmitted to forms.hubspot.com or forms.hsforms.com. Smart forms may also load additional scripts for A/B testing different form variants.

Consent & Compliance

HubSpot Forms is classified under marketing and analytics. While form submission itself is a user-initiated action, the surrounding tracking infrastructure serves marketing purposes. The hubspotutk cookie that retroactively links anonymous browsing history to identified contacts is a marketing profiling mechanism. The collected forms feature that monitors non-HubSpot form submissions without the visitor's awareness raises additional consent concerns.

Under GDPR, the form submission data processing can be justified under Article 6(1)(a) (consent given through the form submission) or Article 6(1)(b) (pre-contractual measures). However, the tracking cookies set before the visitor interacts with any form, and the retroactive linking of browsing history to the contact record, constitute additional processing that requires separate consent under Article 6(1)(a).

The ePrivacy Directive requires consent for the hubspotutk and __hstc cookies, which are set on page load regardless of whether the visitor submits a form. These persistent tracking cookies are not strictly necessary for the form submission functionality.

Under CCPA/CPRA, the combination of form submission data, browsing history, and contact profiling constitutes personal information that must be disclosed. The collected forms feature that captures submissions from non-HubSpot forms requires particular attention in privacy disclosures.

Should You Block This Without Consent?

Yes. While the form submission itself is user-initiated, the HubSpot Forms infrastructure sets marketing tracking cookies on page load and retroactively links browsing history to contacts upon form submission. The collected forms feature adds passive monitoring of all form submissions on the page. Block the HubSpot Forms scripts until the visitor consents to marketing cookies. If you need forms to work without consent, use native HTML forms that do not depend on the HubSpot tracking infrastructure.