Cookies and Advertising Tracking

What it is

HubSpot and its advertising partners use cookies and tracking technologies to monitor your browsing behavior across the internet and show you targeted ads. You can opt out through cookie settings, but declining cookies may limit some site functionality.

Why it matters (compliance & governance perspective)

Behavioral advertising tracking involves collecting data about your online movements across multiple websites over time, which is a significant privacy consideration and subject to consent requirements in many jurisdictions.

Change history

Consumer impact (what this means for users)

Third-party advertising partners may collect data about your browsing habits across the web when you visit HubSpot's website, and this data may be used to serve targeted ads to you elsewhere online. In the EU and UK, this requires your active consent via the cookie banner; in the US, you can opt out of the sale or sharing of this data under CCPA.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: This provision engages the EU ePrivacy Directive (Cookie Law) and GDPR Article 6 for consent-based cookie processing, enforced by EU data protection authorities. In the US, the CCPA/CPRA defines sharing personal data for cross-context behavioral advertising as a regulated activity subject to opt-out rights, enforced by the California Privacy Protection Agency. The FTC Act Section 5 applies to deceptive or unfair data collection practices related to tracking. UK GDPR and PECR apply for UK users. GOVERNANCE EXPOSURE: Medium. HubSpot's use of third-party advertising cookies is standard industry practice, but the consent and opt-out mechanisms must be operationally sound to avoid regulatory exposure. Under GDPR, pre-ticked consent boxes or implied consent for non-essential cookies are not valid. Under CPRA, sharing data with advertising partners for cross-context behavioral advertising triggers opt-out rights even if no monetary consideration is exchanged. JURISDICTION FLAGS: EU/EEA requires granular, affirmative consent for non-essential cookies with a functional reject option. UK requires PECR compliance for cookie placement. California requires a conspicuous opt-out mechanism for behavioral advertising data sharing. States with active privacy laws (Colorado, Virginia, Connecticut, Texas) have analogous opt-out requirements that may apply. CONTRACT AND VENDOR IMPLICATIONS: Business customers embedding HubSpot tracking scripts on their own websites should ensure their own privacy notices and cookie banners accurately disclose HubSpot's role as a third-party tracker. Failure to do so may create independent liability for the business customer under GDPR or state privacy laws. Procurement teams should confirm that HubSpot's advertising partner list is available and that sub-processor notifications are provided for material changes. COMPLIANCE CONSIDERATIONS: Consent management platform configurations should be audited to ensure HubSpot tracking tags are blocked until valid consent is obtained in EU/UK contexts. US-facing properties should implement a compliant opt-out mechanism for behavioral advertising data sharing. Business customers using HubSpot's tracking pixel should include HubSpot in their cookie disclosures and data maps.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Dual Controller/Processor Framework high
• International Data Transfers via Standard Contractual Clauses medium
• Data Subject Rights Request Process medium
• Legitimate Interests as a Legal Basis for Processing medium
• Data Sharing with Third-Party Service Providers and Partners medium
• CCPA California Resident Rights and Data Sale Opt-Out medium

Related Analysis

• OpenAI Changed Its Privacy Policy 4 Times in One Week. Here Is What Actually Changed.

  Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.