HubSpot and a cookie banner: the consent setup that holds up in the EU and the US

If your site runs HubSpot, it sets tracking cookies on the first page view, and that makes HubSpot part of your consent problem, not just Google. In the EU and the UK those cookies need an opt-in before they are set, and Google needs Consent Mode v2 signals from European visitors or your ads lose remarketing and measurement for them. In the US the rule is the opposite, an opt-out, but a dozen states now require you to honor the browser’s Global Privacy Control signal automatically. HubSpot’s own banner handles part of this. The setup I use for B2B sites is one certified banner, CookieYes, that drives Google through Consent Mode v2 and drives HubSpot through its consent API, with HubSpot’s banner switched off. The code is below.

Why consent stopped being a legal footnote

For years a cookie banner was something the lawyer asked for and the marketing team tolerated. Two things changed that. Regulators started fining for broken banners, not only for missing ones, and Google started switching off ad features for traffic that arrives without consent signals.

Europe: opt-in, before anything is set

In the EU the ePrivacy rules require consent before a non-essential cookie is stored or read. GDPR sets what consent means: freely given, specific, informed, and as easy to refuse as to give. Analytics and marketing cookies are non-essential, and HubSpot’s tracking cookies are exactly that. The UK follows the same model under its own rules. Switzerland’s law is looser, but Google’s policy treats Swiss traffic like the EU’s, so in practice most sites do too.

The fines that make the news are against giants, but the findings are ordinary: ad cookies set before the visitor chose anything, a refusal that didn’t actually stop tracking, a banner that didn’t explain what was being collected. Those are configuration mistakes, and they happen on small sites too.

The US: opt-out, enforced through the plumbing

There is still no federal privacy law. Instead, state laws follow California’s model: you may track by default, but visitors must be able to opt out of the sale or sharing of their data, which includes most ad tracking. The details that bite are technical. California’s regulator fined a retailer $345,178 in 2025 largely because its cookie banner disappeared when clicked and Global Privacy Control signals were ignored, and the order made the point that a vendor’s tool breaking is still the site owner’s responsibility. Honda was fined before that for a banner that made opting out harder than opting in.

California also has the CIPA wiretapping law, which plaintiffs have used for years against pixels, chat widgets and session replay. A new law signed on 30 September 2026, SB 690, ends private lawsuits under its pen register section from 2027, but the wiretapping section remains, and what fires before consent is still the first thing a demand letter looks at.

Consent Mode v2: Google’s own requirement

Separate from the law, Google’s EU user consent policy requires advertisers to pass consent signals for visitors from the EEA and the UK, and its current scope includes Switzerland. Since March 2024 that means four signals: ad_storage and analytics_storage from the first version, plus ad_user_data and ad_personalization. Without them, Google Ads stops adding those visitors to remarketing audiences and measures their conversions poorly. The site doesn’t break. The ad account just quietly gets worse, and consent is one of the reasons GA4 and Google Ads report different conversions.

I explain the basic versus advanced trade-off on the Consent Mode v2 page. For this article the important part is that the banner has to send these signals, and it has to send them before Google’s tags fire.

Where HubSpot fits, and where its banner falls short

HubSpot’s tracking code is easy to forget in a consent review because it arrives with the CRM, not with the ads. But it sets its own cookies (__hstc, hubspotutk, __hssc and __hssrc) and it is what connects a visitor’s page history to a contact when they submit a form. In the EU it needs consent like any other analytics tool.

HubSpot has a built-in consent banner, and for a simple HubSpot CMS site it can be enough. The limits show up on B2B sites with more than one tool:

1. Consent Mode v2 only through HubSpot’s integrationsHubSpot added Consent Mode v2 to its own GA4 integration (advanced mode) and its GTM integration (basic mode) on HubSpot-hosted pages. Tags you add any other way need a custom script, and on sites not hosted on HubSpot, HubSpot has said it has no plans to support it.
2. No cookie scanningThe banner doesn’t discover which scripts set which cookies. Someone has to maintain that list by hand, and it goes stale with every new pixel.
3. Non-HubSpot tags are on youMeta, LinkedIn, Hotjar or a chat widget only respect HubSpot’s banner if you wrap each one in a consent listener yourself.
4. Two banners if you add a CMPInstall CookieYes, Cookiebot or OneTrust without switching HubSpot’s off, and visitors get asked twice, with two answers that can disagree.

Why I recommend CookieYes for HubSpot sites

CookieYes is a Google-certified CMP with Consent Mode v2 built in, a switch for basic or advanced mode, automatic cookie scanning, consent logs and a HubSpot Marketplace app. It is not the only good option. Cookiebot has a HubSpot app that wires much of this automatically, and enterprise sites often already run OneTrust. I default to CookieYes on small and mid-size B2B sites because it covers the EU and US cases from one dashboard at a reasonable price, and because its events are simple enough to connect to HubSpot in twenty lines I can read.

The architecture is the same whichever CMP you pick: the CMP is the single source of truth, Google gets its signals through Consent Mode, and HubSpot gets its signals through its consent API.

The code: CookieYes, HubSpot and Consent Mode on one page

Order matters more than the code itself. The bridge goes first, before both CookieYes and the HubSpot tracking code, so HubSpot’s banner is disabled before it can render and the listeners exist before CookieYes fires its first event.

<script>
  // Turn off HubSpot's own banner. Must run before HubSpot loads.
  window.disableHubSpotCookieBanner = true;
  window._hsp = window._hsp || [];

  (function () {
    var hadAnalytics = null;

    function sendToHubSpot(c) {
      var consent = {
        analytics: !!c.analytics,
        advertisement: !!c.advertisement,
        functionality: !!c.functional   // CookieYes "functional" = HubSpot "functionality"
      };
      window._hsp.push(['setHubSpotConsent', consent]);

      // Visitor withdrew analytics consent on this page: clear HubSpot's tracking cookies
      if (hadAnalytics === true && consent.analytics === false) {
        window._hsp.push(['revokeCookieConsent']);
      }
      hadAnalytics = consent.analytics;
    }

    // Fires on every page load with the stored choice (or the defaults)
    document.addEventListener('cookieyes_banner_load', function (e) {
      if (e.detail && e.detail.categories) sendToHubSpot(e.detail.categories);
    });

    // Fires when the visitor accepts, rejects or changes preferences
    document.addEventListener('cookieyes_consent_update', function (e) {
      var accepted = (e.detail && e.detail.accepted) || [];
      sendToHubSpot({
        analytics: accepted.indexOf('analytics') > -1,
        advertisement: accepted.indexOf('advertisement') > -1,
        functional: accepted.indexOf('functional') > -1
      });
    });
  })();
</script>

This is based on the integration CookieYes documents, with one addition: revoking HubSpot’s cookies when someone withdraws consent mid-visit, because switching consent off doesn’t remove cookies that were already set.

<!-- CookieYes. Turn on "Support GCM" in Advanced Settings:
     it sets the Consent Mode defaults and updates for you. -->
<script id="cookieyes" src="https://cdn-cookieyes.com/client_data/YOUR-SITE-ID/script.js"></script>

<!-- Google Tag Manager, after CookieYes -->
<script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
})(window,document,'script','dataLayer','GTM-XXXXXXX');</script>

<!-- On HubSpot CMS this is added for you. On WordPress, Webflow or Next.js
     paste it last. Accounts in HubSpot's EU data centre load js-eu1.hs-scripts.com. -->
<script id="hs-script-loader" async defer src="//js.hs-scripts.com/YOUR-HUB-ID.js"></script>

<!-- Footer link that reopens the CookieYes preferences -->
<a href="#" class="cky-banner-element">Cookie settings</a>

If you run CookieYes through its Google Tag Manager template instead of the script tag, CookieYes publishes a hosted version of this bridge to load alongside it. I still prefer the inline version: it’s short, I can read it, and I can change it when HubSpot or CookieYes changes an event name.

How I test it before handover

1. Fresh visit from the EUPrivate window, VPN in an EU country. Before clicking anything, no __hstc or hubspotutk cookie, and Tag Assistant shows all four Consent Mode signals as denied.
2. Accept analytics onlyHubSpot cookies appear, analytics_storage turns granted, both ad signals stay denied, and no ad pixel fires.
3. Accept all, then withdrawReopen preferences from the footer link, untick analytics, save. HubSpot’s cookies are removed and Consent Mode updates to denied.
4. A form submissionSubmit with a test email after accepting. The contact in HubSpot shows the page views from that session.
5. US visit with GPC onBrowser with Global Privacy Control enabled, US location. Ad tags respect the opt-out without anyone touching the banner.

// Consent Mode calls so far: a default first, then an update after the click
dataLayer.filter(function (e) { return e[0] === 'consent'; });

// HubSpot tracking cookies currently set
document.cookie.split('; ').filter(function (c) {
  return /^(__hstc|hubspotutk|__hssc|__hssrc)=/.test(c);
});

// Is the browser sending Global Privacy Control?
navigator.globalPrivacyControl;

Passing these tests once is not the end of it. The banner in the California case was misconfigured for at least 40 days before anyone fixed it. Leak watch re-runs the first check every week, so a broken banner shows up in days, not in a regulator’s letter.

None of this is legal advice. The banner wording, the categories and your privacy policy stay with your lawyer or DPO. What I take care of is that the site does what the banner says. To see what fires before your banner is answered right now, the free scan on the home page checks it on your real pages.