Using HubSpot in compliance with the GDPR

The HubSpot tracking code (js.hs-scripts.com) sets cookies to recognise visitors, links their behaviour to CRM contacts and transfers data to HubSpot in the USA.

Is this a risk?

Setting the analytics and personalisation cookies requires consent under § 25 (1) TDDDG. The subsequent processing and the US transfer need a legal basis under Art. 6 and 44 et seq. GDPR. Embedded HubSpot forms also load from HubSpot servers and transmit the entries there.

What you can do

• Execute the tracking code only after active consent, not just show the banner.\nEither include HubSpot forms in the consent as well or connect them server-side via the API.\nConclude a data processing agreement with HubSpot and document the transfer basis (standard contractual clauses, Data Privacy Framework).\nIn the privacy policy, name the purpose, HubSpot as recipient, US transfer, cookie lifetimes and withdrawal.

How consentglass helps

The free scan checks the delivered HTML and shows which services are embedded, whether a cookie banner is detected and whether privacy-policy and legal-notice links are present — with context for each finding. It is not a substitute for legal advice.