hubspotutk Cookie: What It Is, Who Sets It, and Consent Rules

What the hubspotutk Cookie Does on Your Site

The hubspotutk cookie is a first-party marketing cookie that the HubSpot tracking code sets to keep track of the identity of a visitor. The hubspotutk cookie "keeps track of a visitor's identity" with an opaque ID for the visitor, according to the HubSpot list of cookies set in the browser of a visitor. The hubspotutk cookie "is passed to HubSpot on form submission", where HubSpot uses the ID to find or merge the contact.

The form submission turns an anonymous visitor into a named contact. HubSpot attaches every page view the hubspotutk ID recorded before the form to the timeline of the new contact. Your sales team then sees the pages a lead read before signing up.

The value of the hubspotutk cookie looks like 3fa85f6457174562b3fc2c963f66afa6. The table explains each part.

Who Sets the hubspotutk Cookie

The HubSpot tracking code sets the hubspotutk cookie. The loader js.hs-scripts.com/<hub-id>.js adds the analytics script from js.hs-analytics.net, which writes the cookie, and HubSpot CMS adds the tracking code to every hosted page by itself. A scan by the TermsFeed website auditor on 9 October 2026 found the hubspotutk cookie written by js.hs-analytics.net with the same visitor ID as the __hstc cookie.

HubSpot forms embedded on a site outside HubSpot read the hubspotutk cookie at submission, so a form without the tracking code creates contacts with no page view history.

Read how HubSpot, Inc. handles the data in the HubSpot privacy policy, and sign the HubSpot Data Processing Agreement before you collect data from visitors in the EU or the UK. Both documents appear in the sources at the end of this page.

Does the hubspotutk Cookie Need Consent?

Yes, the hubspotutk cookie needs consent in the EU and the UK, and needs no prior opt-in in California. The table gives the rule for each law.

The consent table describes what each law requires and is not legal advice. Whether a law applies to your site depends on where your visitors are, where your business is based, and how you set up HubSpot, such as the HubSpot cookie banner and embedded HubSpot forms.

The ePrivacy Directive requires consent before a site sets the hubspotutk cookie. The General Data Protection Regulation (GDPR) sets the standard for that consent: freely given, specific, informed, and unambiguous.

The UK Privacy and Electronic Communications Regulations (PECR) require consent before a site sets the hubspotutk cookie.

The California Consumer Privacy Act (CCPA) sets no general opt-in requirement before a site sets the hubspotutk cookie. The CCPA treats the data the hubspotutk cookie collects for cross-context behavioral advertising as sharing. Offer visitors a way to opt out of sale and sharing, such as a "Do Not Sell or Share My Personal Information" link or the alternative opt-out link the CCPA regulations allow. Honor Global Privacy Control (GPC) signals as opt-out requests. Sharing the data of a consumer under 16 needs opt-in consent instead: from the consumer from 13 to 15 years, and from a parent under 13.

Read how each law decides which cookies need consent in the EU ePrivacy Directive + GDPR guide, the UK PECR guide, and the California CCPA guide.

How to Block the hubspotutk Cookie Until Visitors Accept

Block the hubspotutk cookie by holding back the HubSpot tracking code until the visitor accepts marketing cookies. TermsFeed Free Cookie Consent and TermsFeed Privacy Consent place HubSpot in the marketing category. Check whether an exemption applies to your own use of HubSpot in the consent rules for the hubspotutk cookie.

HubSpot writes no hubspotutk cookie while the tracking code waits as a tagged script, so a visitor who declines leaves no page view history in HubSpot. A HubSpot form on the page still works without the tracking code, and HubSpot creates the contact without the page views.

<!-- Start of HubSpot Embed Code -->
<script type="text/plain" data-cookie-consent="targeting" id="hs-script-loader" async defer src="//js.hs-scripts.com/YOUR_HUB_ID.js"></script>
<!-- End of HubSpot Embed Code -->

How to Verify That the hubspotutk Cookie Waits for Consent

Verify the setup in a private window. Open Chrome DevTools, select the Application tab, and open Cookies. Click "I decline" on the consent banner and reload the page. The hubspotutk cookie must not appear in the list until you accept marketing cookies.

How Long the hubspotutk Cookie Lasts

The hubspotutk cookie lasts 180 days (6 months). Safari caps the cookies that JavaScript sets at 7 days of Safari use without an interaction with your site, according to the WebKit team behind Safari.

The hubspotutk cookie "expires in six months", according to HubSpot, and the auditor scan measured an expiry of 180 days (6 months).

Cookies That Work Together With hubspotutk

HubSpot sets 8 other cookies next to the hubspotutk cookie in its current setup.

Scripts and Requests of HubSpot That Come With the hubspotutk Cookie

The catalog lists 5 scripts, pixels, and data endpoints of HubSpot, which a cookie scanner or the Network tab of Chrome DevTools shows next to the hubspotutk cookie. Block the main script, and the requests in the table stop with the main script.

hubspotutk Cookie FAQs

Is hubspotutk a necessary cookie?

No, the hubspotutk cookie is not a strictly necessary cookie. Firstly, your site and your HubSpot forms work for a visitor who refuses the hubspotutk cookie. Secondly, HubSpot uses the cookie to track the identity of a visitor for marketing, a purpose the ePrivacy Directive exemption does not cover. Thirdly, HubSpot itself classes its analytics cookies as non-essential cookies that its cookie banner controls.

What happens to hubspotutk when a visitor submits a form?

HubSpot sends the hubspotutk value with the form submission and links the ID to the contact record. HubSpot then shows the page views recorded under that ID on the timeline of the contact and uses the ID to avoid duplicate contacts.

What is the difference between hubspotutk and __hstc?

The hubspotutk cookie holds the visitor ID alone, and the __hstc cookie holds the visitor ID with session data. The session data of the __hstc cookie covers the timestamps of the first, the previous, and the current session, and the session count. HubSpot calls __hstc "the main cookie for tracking visitors", and both cookies last 6 months.

How long does the hubspotutk cookie last?

The hubspotutk cookie lasts 6 months (180 days). HubSpot documents the 6 months, and a scan by the TermsFeed website auditor measured 180 days. Safari deletes the cookie earlier, after 7 days of Safari use without an interaction with your site.