HubSpot Marketing Hub

Overview

HubSpot Marketing Hub is HubSpot's flagship inbound marketing automation platform. Its tracking scripts are among the most commonly encountered on B2B and SaaS websites, providing visitor behavior tracking, lead identification, traffic attribution, and marketing campaign automation. The platform connects website behavioral data directly to HubSpot CRM contact records, making it both an analytics tool and a marketing profiling system.

What This Script Does

Marketing Hub deploys the HubSpot tracking code (loaded from js.hs-scripts.com) which initializes a comprehensive visitor tracking system:

• __hstc — primary tracking cookie storing visitor ID, first visit timestamp, last visit timestamp, current visit timestamp, and session number. 13-month expiry.
• hubspotutk — visitor identity token that persists across sessions and is submitted with HubSpot forms to link anonymous browsing history to known contacts. 13-month expiry.
• __hssc — session-scoped cookie tracking pageview count and session duration. 30-minute expiry.
• __hssrc — session cookie used to detect browser restarts and new sessions.

Additional scripts are loaded dynamically based on features enabled:

• js.hscollectedforms.net — non-HubSpot form detection and tracking, which monitors native HTML forms on the page and captures submissions even when the forms are not HubSpot forms
• js.hs-analytics.net — analytics event collection module
• js.hs-banner.com — HubSpot's own cookie consent banner (if enabled)

The tracking script collects page URLs, referral sources, UTM parameters, search keywords, device and browser metadata, and custom behavioral events. This data feeds into:

• Traffic analytics — source attribution, page performance, conversion funnels
• Lead scoring — visitor engagement scores based on page views and content interactions
• Marketing automation triggers — workflows that fire based on page visits (e.g., sending an email when a visitor views the pricing page three times)
• CRM contact enrichment — browsing history is appended to contact records, visible to sales teams

When a visitor submits a HubSpot form or is identified via email click-through, their entire anonymous browsing history is retroactively linked to their contact record.

Consent & Compliance

Marketing Hub is classified under marketing and analytics. Its tracking scripts serve dual purposes: website analytics and marketing automation. Under GDPR, both purposes require consent. The behavioral profiling that links browsing history to CRM contact records, triggers automated marketing workflows, and scores leads based on page engagement constitutes processing that requires explicit consent under Article 6(1)(a). Legitimate interest is a weak basis here given the scope of profiling.

The ePrivacy Directive requires consent for the __hstc and hubspotutk cookies, as they are persistent tracking cookies used for analytics and marketing — not strictly necessary for any service the user has requested.

Under CCPA/CPRA, the collected behavioral data is personal information. The retroactive linking of anonymous browsing to identified contacts, and the use of this data for automated marketing, constitutes data processing that must be disclosed. If behavioral data is shared with advertising platforms through HubSpot's ad integrations, this likely qualifies as "sharing" under CPRA.

Should You Block This Without Consent?

Yes. Marketing Hub's tracking scripts exist to collect behavioral data for marketing automation and lead profiling. None of this functionality is necessary for the website to operate. All HubSpot tracking scripts must be blocked until the visitor provides explicit consent for marketing and analytics cookies.