HubSpot data privacy and consent: configuring settings, consent and cookies

HubSpot provides privacy and consent tools that can support an organisation’s approach to handling personal data and complying with regulations such as the UK GDPR and EU GDPR.

These tools can help you:

• Activate privacy-related account settings
• Record lawful basis and communication consent
• Add privacy notices to forms and meeting pages
• Manage email subscription preferences
• Configure cookie tracking and consent banners
• Process data privacy requests

HubSpot provides the technical functionality, but it does not determine which legal basis, consent model, privacy wording or retention approach is appropriate for your organisation.

Those decisions must form part of your wider privacy and compliance framework.

Manage HubSpot’s data privacy settings

HubSpot’s data privacy settings provide a central place to activate features that support privacy-management processes across the account.

Super Admin or Edit account defaults permissions are required to turn these settings on or off.

When data privacy settings are activated, HubSpot can make changes across several tools. These can include:

• Activating a cookie consent banner
• Adding privacy messaging to newly created scheduling pages
• Adding a privacy section to newly created forms
• Enabling unsubscribe links for relevant one-to-one and sequence emails
• Displaying warnings when a contact does not have a recorded legal basis for processing
• Allowing lawful-basis and communication-consent information to be added to contact records

Existing forms and scheduling pages may not be updated automatically. Review existing assets individually after activating or changing the settings.

For EU-hosted accounts, HubSpot’s data privacy settings are enabled by default. Account configuration should still be reviewed against your organisation’s requirements.

See Manage data privacy settings in your HubSpot account.

Understand lawful basis and consent

Lawful basis for processing and consent to communicate are related but distinct concepts.

A lawful basis concerns why your organisation is permitted to process personal data.

Consent to communicate concerns whether and how somebody has agreed to receive a particular type of communication.

HubSpot can store and use information relating to lawful basis, communication consent and subscription preferences. However, HubSpot cannot decide:

• Which lawful basis applies
• Whether consent is required
• What evidence your organisation needs to retain
• How consent should be collected
• How long personal data should be retained
• Whether a proposed communication is legally permitted

These decisions should be made by appropriately qualified people within or advising your organisation.

Configure notice and consent language

HubSpot allows organisations to configure default privacy and consent wording for supported forms, documents and scheduling pages.

The available content can include:

• Legitimate-interest wording
• Privacy-policy information
• Consent-to-communicate wording
• Subscription-type descriptions
• Explicit or implicit consent-to-process wording

Any privacy or consent wording should be approved through your organisation’s legal or compliance process before publication.

Changes to default wording normally apply to newly created assets. Existing forms and scheduling pages may retain their previous wording and require manual review.

Individual assets can also contain customised wording that overrides account defaults. This means reviewing only the default settings may not identify every version of privacy text currently in use.

See Set default notice and consent language for privacy-enabled forms, documents and meetings.

Manage communication subscriptions

HubSpot uses subscription types to represent categories of communication that contacts can receive.

Your organisation should define:

• Which subscription types are required
• What each subscription type covers
• Which teams and communication channels use them
• How consent or another lawful basis will be recorded
• How preference changes and withdrawals will be respected
• Whether different regions require different processes

Subscription types should have clear, audience-facing descriptions. Avoid creating overlapping or ambiguous categories that make it difficult for contacts or users to understand what has been agreed.

Activating HubSpot’s option to limit marketing emails to contacts with an appropriate subscription can support your chosen process, but your organisation must decide whether and how that control should be used.

Configure cookie tracking and consent banners

HubSpot’s cookie consent tools can be used on HubSpot-hosted pages and external pages where the HubSpot tracking code is installed.

Depending on the configuration, a banner can:

• Notify visitors that cookies are used
• Ask visitors to opt in to tracking
• Allow visitors to opt out
• Present cookie choices by category
• Apply different policies by domain, path, country or language
• Allow visitors to reopen their cookie settings
• Respond to Global Privacy Control signals where configured

The appropriate banner type, geographic targeting and wording depend on the tracking technologies used and the legal requirements that apply to your organisation.

Cookie categories and descriptions should reflect what the website actually does. They should also align with your published privacy and cookie information.

See Set up cookie tracking settings and consent banners.

Understand what HubSpot’s banner can block

HubSpot’s consent banner can control supported HubSpot cookies and cookies placed through certain HubSpot integrations.

It cannot automatically control every script or tracking technology added manually to a website.

For example, if tracking scripts have been inserted directly into a page, theme, tag manager or another external system, additional technical configuration may be required to prevent those scripts from running before the appropriate consent is obtained.

Your cookie review should therefore cover:

• HubSpot tracking
• HubSpot-connected advertising and analytics tools
• Google Tag Manager configuration
• Manually installed scripts
• Embedded media and third-party services
• Changes introduced through website updates or new integrations

Do not assume that publishing a HubSpot consent banner automatically governs every technology operating on the website.

Test the cookie experience

After publishing or changing a consent banner, test it on the relevant domains, subdomains, paths and regional variants.

Check that:

• The correct banner appears
• The intended policy applies in each location
• Language and links are accurate
• Optional tracking is handled as intended
• Visitors can update their preferences where required
• Connected analytics and advertising tools respond appropriately
• Manually installed scripts follow the intended consent behaviour
• Forms continue to display and submit correctly

Repeat this testing when website code, tracking tools, integrations or legal requirements change.

Manage data privacy requests

HubSpot provides tools that can support the handling of requests relating to personal data.

Depending on the request and account configuration, this may include processes for:

• Accessing or exporting personal data
• Correcting information
• Deleting contact data
• Managing communication preferences
• Recording and progressing privacy requests

HubSpot’s technical workflow does not decide whether a request is valid, which information falls within scope or whether an exemption applies.

Your organisation should maintain an approved process covering identity verification, response times, responsibilities, record keeping and escalation.

See Manage data privacy requests.

Review privacy configuration regularly

Privacy configuration should be reviewed whenever there is a relevant change, including:

• New forms, documents or scheduling pages
• New subscription types or communication channels
• Changes to consent language
• New websites, domains or regional audiences
• New tracking scripts or integrations
• Changes to retention requirements
• Changes to business processes
• New legal or regulatory guidance
• Changes to the personal data stored in HubSpot

A technically complete configuration does not establish legal compliance. Reviews should consider both the HubSpot settings and the wider organisational processes surrounding them.

Your organisation’s responsibilities

Your organisation must determine the privacy and data-protection requirements that apply to its activities.

This includes decisions about:

• The lawful bases used for processing
• When consent is required
• Privacy and consent wording
• Communication subscription structures
• Cookie and tracking controls
• Data retention and deletion
• Handling data-subject requests
• Access to personal data
• Use of integrations and exported information
• Documentation and evidence of compliance decisions

Your organisation’s exact legal role may vary according to the processing activity and contractual arrangements. Obtain qualified legal or compliance advice rather than relying on HubSpot configuration alone.

What can Forbidden help with?

Forbidden can explain and configure HubSpot’s technical privacy and consent functionality, including account settings, consent fields, subscription types, cookie banners and relevant user permissions.

We can also help identify where existing forms, meeting pages, integrations or website tracking require technical review.

Forbidden does not provide legal advice, select lawful bases, approve privacy wording or determine whether your organisation complies with GDPR or other privacy laws. Those decisions remain with your organisation and its qualified advisers.

Further information

• Manage data privacy settings in HubSpot
• Set default notice and consent language
• Set up cookie tracking settings and consent banners
• Manage data privacy requests
• HubSpot data privacy resources