HubSpot Cookie Compliance Report

HubSpot

hubspot.com

Compare

https://hubspot.com

Scanned Apr 15, 2026 · 40.2s

Your website score is

0/100

Critical

Grade

BannerConsent Banner

Yes

Regulatory Compliance

Multi-regulation overview — click any regulation for details

Technical scan only. A passing score does not equal legal compliance. Consult qualified legal counsel for your jurisdiction.

Tag Leak detected 22 user data leaks before consent on hubspot.com, including HubSpot (Advertising Tracker), HubSpot Tracking, CHEQ (Tracker Tracker) and 1 more.

Security Headers

5/6 present

Strict-Transport-Security

max-age=31536000; includeSubDomains; preload

Content-Security-Policy

script-src 'unsafe-inline' 'unsafe-eval' 'self' 1003891.track.convertexperiments.com app.hubspot.com cdn-3.convertexperiments.com cdn-4.convertexperiments.com *.metrics.convertexperiments.com *.signals.convertexperiments.com logs.convertexperiments.com *.convertexperiments.com cdn.pdst.fm connect.facebook.net js.hs-analytics.net js.hs-banner.com js.hsforms.net js.hsleadflows.net js.hubspotfeedback.com js.usemessages.com organizer.bizzabo.com play.vidyard.com script.hotjar.com snap.licdn.com static.hotjar.com static.hsappstatic.net www.google-analytics.com www.googletagmanager.com www.recaptcha.net code.highcharts.com www.youtube.com js.hubspot.com www.dropbox.com widget.altrulabs.com www.google.com maps.googleapis.com wt-assets.hubteam.com cdn2.hubspot.net www.redditstatic.com cdn.veritonic.com gosniply.com d.impactradius-event.com js.hubspot.com 50339659.hs-sites.com analytics.tiktok.com 'strict-dynamic' 'nonce-+lZ2tXWchioJCtfdTUg8rw=='; report-uri https://send.hsbrowserreports.com/csp/report; upgrade-insecure-requests

X-Frame-Options

DENY

X-Content-Type-Options

nosniff

Referrer-Policy

no-referrer-when-downgrade

Permissions-Policy

Add a Permissions-Policy header to restrict browser features like camera, microphone, and geolocation

Google Consent Mode

Not Detected

Google Consent Mode v2 was not found on this page. GCM v2 allows Google's tags to adjust their behavior based on user consent, and is required for compliant advertising measurement in the EU. Without it, your Google Ads and GA4 conversions may be impacted after consent is declined.

GTM container detected (GTM-N5LT88) but no consent mode initialisation found. Add gtag('consent', 'default', ...) before your GTM snippet.

Post-Rejection Audit

Reject Button

Found

Post-Rejection Fires

0 vendors

Consent Mode

Not Detected

GTM Load

2443ms pre-consent

Google Tag Manager(GTM-N5LT88)

Loaded 2443ms after page load — before the consent banner was detected (banner appeared at 8645ms). Per a 2022 German court ruling, GTM itself transmits the user's IP to Google pre-consent.

Consent Mode V2: Not Detected

Google Consent Mode was not detected on this site.

No tracking vendors detected firing after rejection

Consent Record Audit

Issues detected

Consent record stored after interaction

GDPR Art. 7(1)

No consent record written — cannot prove consent was given

No CMP consent cookie or localStorage entry was found after the consent interaction. GDPR requires controllers to demonstrate consent was given.

Consent withdrawal mechanism accessible

GDPR Art. 7(3)

Cookie settings link / floating button found

Why this matters

Under GDPR Article 7, controllers must be able to demonstrate that consent was given (Art. 7(1)) and ensure users can withdraw consent at any time, as easily as giving it (Art. 7(3)). Sites with no consent record or no withdrawal mechanism cannot legally rely on consent as a lawful basis.

Tracker categories detected

Advertising8 vendors

Analytics3 vendors

Marketing7 vendors

Security1

Functional4 vendors

Tag Management1 vendor

Critical8

HubSpot (Advertising Tracker)3 findings

js.hs-banner.com, js.hsadspixel.net, feedback.hubapi.com

criticalNetworkAdvertisingHubSpot (Advertising Tracker)

HubSpot (advertising) loaded before consent

Host: js.hs-banner.comFired: 1148ms after load

criticalNetworkAdvertisingHubSpot (Advertising Tracker)

HubSpot (advertising) loaded before consent

Host: js.hsadspixel.netFired: 2475ms after load

criticalNetworkAdvertisingHubSpot (Advertising Tracker)

HubSpot (advertising) loaded before consent

Host: feedback.hubapi.comFired: 3401ms after load

criticalNetworkAnalyticsHubSpot Tracking

HubSpot Tracking (HubSpot) loaded before consent: HubSpot analytics tracking endpoint

Host: js.hs-analytics.netFired: 2474ms after load

CHEQ (Tracker Tracker)2 findings

ob.greencolumnart.com, obs.greencolumnart.com

criticalNetworkCHEQ (Tracker Tracker)

CHEQ (tracker) loaded before consent

Host: ob.greencolumnart.comFired: 3132ms after load

criticalNetworkCHEQ (Tracker Tracker)

CHEQ (tracker) loaded before consent

Host: obs.greencolumnart.comFired: 3949ms after load

criticalNetworkAdvertisingAdvertising Tracker

advertising tracker at tags.pw.adn.cloud loaded before consent

Host: tags.pw.adn.cloudFired: 3132ms after load

criticalConsent Record

No recognizable consent cookie or storage entry detected after interaction — GDPR Article 7(1) requires controllers to demonstrate consent was given (server-side storage cannot be verified)

Warnings15

Google Tag Manager2 findingsID tracked

www.googletagmanager.com

warningNetworkTag ManagementGoogle Tag Manager

Google Tag Manager (Google) loaded before consent: Loads the GTM container which may trigger other tags

ID: GTM-N5LT88Host: www.googletagmanager.comFired: 2306ms after load

warningGTMTag ManagementGoogle Tag Manager

GTM loaded before consent banner — IP address transmitted to Google pre-consent (container: GTM-N5LT88)

warningConsentUnknown

Unknown was clicked but no consent storage was written — tags may continue firing as if consent was never given

warningNetworkGA4 (server-side proxy)

Possible server-side tag proxy at sgtm-amer.hubspot.com — analytics data may be forwarded to third parties before consent. Browser scanning cannot verify downstream recipients; audit your GTM Server-side or CNAME configuration.

Host: sgtm-amer.hubspot.comFired: 4368ms after load

warningNetworkAnalytics proxy

Possible server-side tag proxy at metrics-fe-na1.hubspot.com — analytics data may be forwarded to third parties before consent. Browser scanning cannot verify downstream recipients; audit your GTM Server-side or CNAME configuration.

Host: metrics-fe-na1.hubspot.comFired: 8122ms after load

warningNetwork

Unknown third-party request to 53.fs1.hubspotusercontent-na1.net before consent

Host: 53.fs1.hubspotusercontent-na1.netFired: 1146ms after load

warningNetwork

Unknown third-party request to js.hubspotfeedback.com before consent

Host: js.hubspotfeedback.comFired: 2474ms after load

warningNetwork

Unknown third-party request to api.tx4.pw.adn.cloud before consent

Host: api.tx4.pw.adn.cloudFired: 3336ms after load

warningNetwork

Unknown third-party request to pebeiooilphfmbohdbhbomomkkoghoia before consent

Host: pebeiooilphfmbohdbhbomomkkoghoiaFired: 3745ms after load

warningNetwork

Unknown third-party request to cdn1.hubspot.net before consent

Host: cdn1.hubspot.netFired: 4238ms after load

warningStorage

sessionStorage key "__hmpl" written before consent

Key: __hmplType: sessionStorageFired: 2249ms after load

warningStorage

sessionStorage key "HUBLYTICS_EVENTS_53" written before consent

Key: HUBLYTICS_EVENTS_53Type: sessionStorageFired: 2424ms after load

warningStorage

localStorage key "_cq_check" written before consent

Key: _cq_checkType: localStorageFired: 3610ms after load

warningStorage

sessionStorage key "_cq_tuid" written before consent

Key: _cq_tuidType: sessionStorageFired: 3944ms after load

warningStorage

localStorage key "_cq_cdr" written before consent

Key: _cq_cdrType: localStorageFired: 4407ms after load

Info6

HubSpot (Cdn)3 findings

static.hsappstatic.net, js.usemessages.com, perf-na1.hsforms.com

infoNetworkHubSpot (Cdn)

HubSpot (cdn) loaded before consent

Host: static.hsappstatic.netFired: 1148ms after load

infoNetworkHubSpot (Cdn)

HubSpot (cdn) loaded before consent

Host: js.usemessages.comFired: 2475ms after load

infoNetworkHubSpot (Cdn)

HubSpot (cdn) loaded before consent

Host: perf-na1.hsforms.comFired: 2885ms after load

infoNetworkGoogle (Cdn)

Google (cdn) loaded before consent

Host: fonts.googleapis.comFired: 2598ms after load

infoCookieFunctionalCloudflare

Cloudflare cookie "_cfuvid" set before consent — The _cfuvid cookie is only set when a site uses this option in a Rate Limiting Rule, and is only used to allow the Cloudflare WAF to distinguish individual users who share the same IP address.

Cookie: _cfuvidDomain: .www.hubspot.comRetention: session

infoCookieFunctional

Cloudflare bot management — necessary for site operation

Cookie: __cf_bmDomain: .www.hubspot.com

Compliant39

Google Analytics5 findingsID tracked

region1.analytics.google.com, _ga, _ga_X, FPAU, _ga_LXTM6CQ0XK

CompliantNetworkAnalyticsGA4

GA4 (Google) loaded correctly after consent

ID: G-LXTM6CQ0XKHost: region1.analytics.google.comFired: 4905ms after load

CompliantCookieAnalyticsGoogle Analytics

Google Analytics cookie "_ga" set correctly after consent

Cookie: _gaDomain: .hubspot.com

CompliantCookieAnalyticsGoogle Analytics

Google Analytics cookie "_ga_X" set correctly after consent

Cookie: _ga_XDomain: .hubspot.com

CompliantCookieMarketingGoogle Analytics

Google Analytics cookie "FPAU" set correctly after consent

Cookie: FPAUDomain: .hubspot.comRetention: session

CompliantCookieAnalyticsGoogle Analytics

Google Analytics cookie "_ga_LXTM6CQ0XK" set correctly after consent

Cookie: _ga_LXTM6CQ0XKDomain: .hubspot.com

Meta Pixel3 findingsID tracked

www.facebook.com, connect.facebook.net, _fbp

CompliantNetworkAdvertisingMeta Pixel

Meta Pixel (Meta) loaded correctly after consent

ID: 893596480692132Host: www.facebook.comFired: 5332ms after load

CompliantNetworkAdvertisingMeta Pixel

Meta Pixel (Meta) loaded correctly after consent

Host: connect.facebook.netFired: 4260ms after load

CompliantCookieAdvertisingMeta Pixel

Meta Pixel cookie "_fbp" set correctly after consent

Cookie: _fbpDomain: .hubspot.com

CompliantNetworkAdvertisingLinkedIn Insight Tag

LinkedIn Insight Tag (LinkedIn) loaded correctly after consent

Host: snap.licdn.comFired: 4260ms after load

CompliantNetworkAdvertisingTwitter/X Pixel

Twitter/X Pixel (X (Twitter)) loaded correctly after consent

Host: static.ads-twitter.comFired: 4260ms after load

Microsoft Ads3 findings

bat.bing.com, _uetsid, _uetvid

CompliantNetworkAdvertisingMicrosoft Ads

Microsoft Ads (Microsoft) loaded correctly after consent

Host: bat.bing.comFired: 4260ms after load

CompliantCookieAdvertisingMicrosoft Ads

Microsoft Ads cookie "_uetsid" set correctly after consent

Cookie: _uetsidDomain: .hubspot.com

CompliantCookieAdvertisingMicrosoft Ads

Microsoft Ads cookie "_uetvid" set correctly after consent

Cookie: _uetvidDomain: .hubspot.com

CompliantNetworkAdvertisingImpact

Impact (Impact) loaded correctly after consent

Host: d.impactradius-event.comFired: 4260ms after load

Google Ads5 findings

www.google.com, www.googleadservices.com, googleads.g.doubleclick.net, _gcl_au, _gcl_ls

CompliantNetworkAdvertisingGoogle Ads

Google Ads (Google) loaded correctly after consent

Host: www.google.comFired: 4345ms after load

CompliantNetworkAdvertisingGoogle Ads

Google Ads (Google) loaded correctly after consent

Host: www.googleadservices.comFired: 6334ms after load

CompliantNetworkAdvertisingGoogle Ads

Google Ads (Google) loaded correctly after consent

Host: googleads.g.doubleclick.netFired: 6811ms after load

CompliantCookieAdvertisingGoogle Ads

Google Ads cookie "_gcl_au" set correctly after consent

Cookie: _gcl_auDomain: .hubspot.com

CompliantStorageAdvertisingGoogle Ads

Google Ads (Google) wrote "_gcl_ls" to localStorage correctly after consent

Key: _gcl_lsType: localStorageFired: 4180ms after load

CompliantCookieFunctionalHubSpot

HubSpot cookie "__hs_cookie_cat_pref" set correctly after consent

Cookie: __hs_cookie_cat_prefDomain: .hubspot.comRetention: 6 months

HubSpot Tracking4 findings

__hstc, hubspotutk, __hssrc, __hssc

CompliantCookieAnalyticsHubSpot Tracking

HubSpot Tracking cookie "__hstc" set correctly after consent

Cookie: __hstcDomain: .hubspot.com

CompliantCookieAnalyticsHubSpot Tracking

HubSpot Tracking cookie "hubspotutk" set correctly after consent

Cookie: hubspotutkDomain: .hubspot.com

CompliantCookieAnalyticsHubSpot Tracking

HubSpot Tracking cookie "__hssrc" set correctly after consent

Cookie: __hssrcDomain: .hubspot.com

CompliantCookieAnalyticsHubSpot Tracking

HubSpot Tracking cookie "__hssc" set correctly after consent

Cookie: __hsscDomain: .hubspot.com

CompliantCookieMarketingDoubleClick/Google Marketing

DoubleClick/Google Marketing cookie "IDE" set correctly after consent

Cookie: IDEDomain: .doubleclick.netRetention: 2 years

CompliantCookieMarketingClaritas

Claritas cookie "barometric[cuid]" set correctly after consent

Cookie: barometric[cuid]Domain: .trkn.usRetention: 1 year

LinkedIn3 findings

bcookie, li_gc, lidc

CompliantCookieMarketingLinkedIn

LinkedIn cookie "bcookie" set correctly after consent

Cookie: bcookieDomain: .linkedin.comRetention: 1 year

CompliantCookieFunctionalLinkedIn

LinkedIn cookie "li_gc" set correctly after consent

Cookie: li_gcDomain: .linkedin.comRetention: 2 years

CompliantCookieMarketingLinkedIn

LinkedIn cookie "lidc" set correctly after consent

Cookie: lidcDomain: .linkedin.comRetention: 1 day

CHEQ AI Technologies2 findings

_cq_duid, _cq_suid

CompliantCookieFunctionalCHEQ AI Technologies

CHEQ AI Technologies cookie "_cq_duid" set correctly after consent

Cookie: _cq_duidDomain: .hubspot.comRetention: 3 months

CompliantCookieFunctionalCHEQ AI Technologies

CHEQ AI Technologies cookie "_cq_suid" set correctly after consent

Cookie: _cq_suidDomain: .hubspot.comRetention: 3 months

X5 findings

guest_id_marketing, guest_id_ads, personalization_id, guest_id, muc_ads

CompliantCookieMarketingX

X cookie "guest_id_marketing" set correctly after consent

Cookie: guest_id_marketingDomain: .twitter.comRetention: 2 years

CompliantCookieMarketingX

X cookie "guest_id_ads" set correctly after consent

Cookie: guest_id_adsDomain: .twitter.comRetention: 2 years

CompliantCookieMarketingX

X cookie "personalization_id" set correctly after consent

Cookie: personalization_idDomain: .twitter.comRetention: 2 years

CompliantCookieMarketingX

X cookie "guest_id" set correctly after consent

Cookie: guest_idDomain: .twitter.comRetention: 2 years

CompliantCookieMarketingX

X cookie "muc_ads" set correctly after consent

Cookie: muc_adsDomain: .t.coRetention: 24 months

Amazon2 findings

ad-id, ad-privacy

CompliantCookieMarketingAmazon

Amazon cookie "ad-id" set correctly after consent

Cookie: ad-idDomain: .amazon-adsystem.comRetention: 190 days

CompliantCookieMarketingAmazon

Amazon cookie "ad-privacy" set correctly after consent

Cookie: ad-privacyDomain: .amazon-adsystem.comRetention: 5 years

CompliantCookieMarketingBing / Microsoft

Bing / Microsoft cookie "MUID" set correctly after consent

Cookie: MUIDDomain: .bing.comRetention: 1 year

Is this your site?

Run a full multi-page scan with monitoring and get detailed remediation steps

Scan hubspot.com →

This audit is based on publicly observable website behavior. To request removal from the index, email support@tagleak.com