Marketing vendor · HubSpot, Inc.
HubSpot Cookies: List With Purpose and Retention
Last verified 2026-10-16 · Updated 2026-10-16
On this page
Cookies HubSpot Sets on Your Site
The HubSpot tracking code sets 4 tracking cookies on your domain, led by hubspotutk, and up to 5 more for the HubSpot cookie banner, chat, and opt-outs.
| Name | Type | Category | Party | Retention | What it does |
|---|---|---|---|---|---|
__hs_cookie_cat_pref | Cookie | Essential | First-party | 180 days (6 months) | The __hs_cookie_cat_pref cookie stores the cookie categories the visitor accepted in the HubSpot cookie banner, for 6 months. |
__hs_do_not_track | Cookie | Essential | First-party | 180 days (6 months) | The __hs_do_not_track cookie stops the HubSpot tracking code from sending data to HubSpot, for 6 months. |
__hs_initial_opt_in | Cookie | Essential | First-party | 7 days | The __hs_initial_opt_in cookie stops the HubSpot cookie banner from showing on every page in strict mode, for 7 days. |
__hs_opt_out | Cookie | Essential | First-party | 180 days (6 months) | The __hs_opt_out cookie remembers for 6 months that the visitor opted out of HubSpot cookies. |
__hssc | Cookie | Marketing | First-party | 30 minutes (1800 seconds) | The __hssc cookie keeps track of the current session for 30 minutes and decides when HubSpot counts a new session. |
__hssrc | Cookie | Marketing | First-party | Session | The __hssrc cookie tells HubSpot whether the visitor restarted the browser. |
__hstc | Cookie | Marketing | First-party | 180 days (6 months) | The __hstc cookie is the main HubSpot tracking cookie, with the visitor ID, the session timestamps, and the session count. |
hubspotutk | Cookie | Marketing | First-party | 180 days (6 months) | The hubspotutk cookie is a HubSpot marketing cookie that tracks visitor identity for 6 months and needs consent under the ePrivacy Directive. |
messagesUtk | Cookie | Functionality | First-party | 180 days (6 months) | The messagesUtk cookie recognises a visitor who chats through HubSpot chatflows, for 6 months. |
Scripts, Pixels, and Endpoints HubSpot Loads
HubSpot loads 5 known scripts, pixels, and data endpoints. Each row gives the host to look for in the Network tab of Chrome DevTools or in a cookie scanner report.
| Type | Resource | Host | What it does |
|---|---|---|---|
| Script | HubSpot tracking code loader (js.hs-scripts.com) | js.hs-scripts.comjs-na1.hs-scripts.com | The loader named after your Hub ID adds the HubSpot analytics, chat, and pop-up scripts to the page. |
| Script | HubSpot analytics script (js.hs-analytics.net) | js.hs-analytics.net | The analytics script writes the hubspotutk, __hstc, __hssc, and __hssrc cookies and records page views. |
| Pixel | HubSpot page view pixel (__ptq.gif) | track.hubspot.com | The page view pixel sends each page view to HubSpot with the visitor ID from the hubspotutk cookie. |
| Script | HubSpot forms script (js.hsforms.net) | js.hsforms.net | The forms script renders an embedded HubSpot form and reads the hubspotutk cookie at submission. |
| Pixel | HubSpot forms counter pixel (counters.gif) | forms-na1.hsforms.comperf-na1.hsforms.com | The counter pixel reports form loads and performance to HubSpot, and the auditor scans found the pixel before consent on a scanned site. |
Does HubSpot Need Consent?
Yes, the HubSpot cookies need consent in the EU and the UK, and need no prior opt-in in California. The table gives the rule for each law, taken from the page of the hubspotutk cookie.
| Law | Consent before the cookies are set | Opt-out right | Source |
|---|---|---|---|
| EU ePrivacy Directive + GDPR | Required | Withdraw at any time | Article 5(3), ePrivacy Directive |
| UK PECR | Required | Withdraw at any time | Regulation 6 and Schedule A1, PECR |
| California CCPA | No general opt-in | Opt out of sale and sharing | Cal. Civ. Code 1798.120 |
The consent table describes what each law requires and is not legal advice. Whether a law applies to your site depends on where your visitors are, where your business is based, and how you set up HubSpot, such as the HubSpot cookie banner and embedded HubSpot forms.
HubSpot sets 4 strictly necessary cookies as well, such as __hs_cookie_cat_pref, and those cookies follow the rule for strictly necessary cookies.
Read the reason for each answer in the consent rules for the hubspotutk cookie.
How to Add HubSpot to a Consent Banner
Add HubSpot to a consent banner by holding back the HubSpot tracking code until the visitor accepts marketing cookies. Both TermsFeed products block HubSpot in the Marketing category.
Add HubSpot to TermsFeed Free Cookie Consent
TermsFeed Free Cookie Consent runs a tagged script only after the visitor accepts its category. Change type="text/javascript" to type="text/plain" and add data-cookie-consent="targeting".
<!-- Start of HubSpot Embed Code -->
<script type="text/plain" data-cookie-consent="targeting" id="hs-script-loader" async defer src="//js.hs-scripts.com/YOUR_HUB_ID.js"></script>
<!-- End of HubSpot Embed Code -->Cookie Consent is free and needs no account. Build your free consent banner with TermsFeed Free Cookie Consent.
Add HubSpot to TermsFeed Privacy Consent
Add HubSpot from its template in TermsFeed Privacy Consent, and the HubSpot tracking code loads only after the visitor accepts the Marketing vendor category. The template loads the HubSpot chat widget and pop-ups with the tracking code, so a visitor who declines sees neither.
The HubSpot template asks for the Hub ID and fills every other field of the vendor. Pick the "HubSpot" card under Marketing, enter the Hub ID, and click "Add HubSpot". In HubSpot, the Hub ID is the number next to the account name in the account menu. The illustration shows the template form in the TermsFeed app.
Privacy Consent detects the location of each visitor and records every answer in a consent log. Set up HubSpot from its template with TermsFeed Privacy Consent.
Follow every step, the vendor settings, and the check in Chrome DevTools in how to block the hubspotutk cookie.
Who Runs HubSpot
HubSpot, Inc. runs HubSpot from the United States. HubSpot combines a CRM with marketing, sales, and service tools, so the tracking code on your site feeds the contact records your sales and marketing teams work with.
Read how HubSpot, Inc. handles the data in the HubSpot privacy policy, and sign the HubSpot Data Processing Agreement before you collect data from visitors in the EU or the UK. Both documents appear in the sources at the end of this page.
HubSpot Cookie FAQs
Does HubSpot need consent?
Yes, the HubSpot cookies need consent in the EU and the UK, and need no prior opt-in in California. Firstly, the ePrivacy Directive requires consent before a site sets the marketing cookies of HubSpot. Secondly, the UK PECR requires consent before a site sets the marketing cookies of HubSpot. Thirdly, the CCPA sets no general opt-in requirement for the marketing cookies of HubSpot, and the table gives the opt-out right of visitors. The consent section of this page gives the table for each law.
How long do HubSpot cookies last?
The cookies of HubSpot last up to 180 days (6 months), and 1 cookie lasts for the browser session. A session cookie such as __hssrc has no expiry date, and the __hs_cookie_cat_pref cookie lasts longest. The retention column of the cookie list gives the lifetime of each cookie.
How do I block HubSpot cookies?
Block the HubSpot cookies by holding back the HubSpot tracking code until the visitor accepts marketing cookies. Tag the HubSpot tracking code with data-cookie-consent="targeting" in TermsFeed Free Cookie Consent, or add HubSpot as a vendor in TermsFeed Privacy Consent. The page of the hubspotutk cookie gives the full steps and the settings of HubSpot.
Sources for the HubSpot Cookies
The facts on this page come from the documentation HubSpot publishes, checked on 2026-10-16. The list gives every source, so you check each fact yourself.
- HubSpot Knowledge Base, Cookies set in a visitor's browser by HubSpot
- GDPR, Recital 30
- TermsFeed website auditor scan, 9 October 2026 (internal)
- HubSpot privacy policy
- HubSpot Data Processing Agreement