Checklist
Does HubSpot tracking fire before Accept?
Check HubSpot tracking cookies and hosts before Accept, then after Reject. Names such as __hstc are labels. Not a HubSpot CRM setup guide.
In brief
HubSpot tracking can set analytics or marketing cookies and call HubSpot hosts on first paint. Check those cookies, storage, and requests on Fresh, then again after Reject. Names such as __hstc, __hssc, and hubspotutk are labels when they appear, not a full inventory. ConsentProbe can store Fresh and Reject packs. A free US-baseline scan is not an EU or California legal conclusion. This page is not a HubSpot CRM setup guide and not legal advice.
Not legal advice
This guide explains how to observe HubSpot tracking code, analytics cookies, marketing cookies, and related network activity relative to Accept and Reject. It is not legal advice, not a HubSpot CRM, Marketing Hub, or tracking-code setup tutorial, and not a GDPR, ePrivacy, CPRA, or other compliance certificate. ConsentProbe reports are technical observations of what fired. They do not say what counsel would allow. Observation is not counsel permission.
Last updated September 28, 2026. The before-Accept audit owns the general first load. The Reject leftovers guide owns a Reject failure. The pre-consent checklist owns the pass order. The marketing-pixels FAQ owns the wider pixel question. The first-party versus third-party guide owns party labels. This page stays on HubSpot observation.
Short answer
HubSpot tracking can set analytics or marketing cookies and call HubSpot-related hosts on first paint. A cookie consent audit asks whether those cookies, storage entries, or network requests appeared before Accept, and whether Reject All stopped them.
Example observation labels include hs-scripts and hubspot hosts, and cookie names such as __hstc, __hssc, or hubspotutk when they show up in DevTools. Treat the names as labels. The inventory on a given site can differ. This page does not say which HubSpot cookies are essential.
Treat banner text that says marketing or analytics is off as a claim. Falsify it on a clean visit. Capture HubSpot-related hosts and cookies on Fresh. Repeat after Reject. Note any fan-out that continues after the click. First-party versus third-party labeling still applies when HubSpot cookies sit on your domain. The party-label guide owns that distinction. ConsentProbe can produce Fresh and Reject packs with request, cookie, and screenshot links. A free US-baseline scan is not an EU or California legal conclusion. ConsentProbe does not install a CMP and does not configure HubSpot tracking or CRM. This page is not a HubSpot CRM setup guide and not legal advice.
Hosts, cookies, and the banner claim
Three surfaces get mixed when a banner says analytics is off. Separate the script request from the cookie name. Write the finding as a HubSpot host before Accept, or a named cookie after Reject. Leave permission with counsel.
| Surface | What a browser test can see | Note |
|---|---|---|
| HubSpot tracking or analytics script | Network rows to hs-scripts, hubspot, or related analytics hosts before Accept | Label the pack Fresh |
| HubSpot cookies or storage | Names such as __hstc, __hssc, or hubspotutk when they are present | Examples only. The inventory can differ by setup |
| CMP analytics or marketing-off claim | A screenshot of the banner or the category state | Match the claim to Fresh and Reject runtime |
Fresh and Reject on the site
These steps compare a claimed wait-for-Accept state with cookies and requests. They do not install HubSpot tracking code, open a CRM, or build a form. The before-Accept audit and the pre-consent checklist hold the general method. The Reject leftovers guide and the marketing-pixels FAQ hold a Reject failure.
- Use a clean profile. Load the page once. Do not click Accept.
- Capture cookies, storage, and Network for HubSpot-related hosts, including hs-scripts and hubspot. Note any __hstc, __hssc, or hubspotutk cookies, or other HubSpot-looking names.
- Screenshot the banner state. Label the pack Fresh.
- Open a new clean profile, or clear storage. Click Reject All. Navigate once more.
- Recapture cookies and Network. Label the pack Reject. Compare it with Fresh and, if you ran one, with an Accept control.
- Write one finding sentence per mismatch, such as __hstc on Fresh, or an hs-scripts host after Reject.
First-party placement is still a label
HubSpot cookies may appear on your registrable domain while the scripts still call HubSpot hosts. HubSpot's own tracking notes name requests to hosts such as track.hubspot.com. A first-party cookie row and a third-party host row can sit on the same Fresh capture.
First-party placement does not settle permission. The runtime questions stay the same. Was the cookie or host present before Accept? Is it still present after Reject? The party-label guide owns how to name first-party and third-party storage. This page stays on the HubSpot rows you can point at.
Example of a storefront clue, not a customer capture: Fresh Network shows a request to an hs-scripts or hubspot host before any banner click, and the cookie jar lists __hstc. After Reject and one more navigation, the host or the cookie is still there. That pair is a finding about the browser. It does not rank HubSpot, and it does not say the cookie is allowed.
When checking HubSpot hosts gets slow
Checking HubSpot hosts and cookie names across templates by hand takes a long time. ConsentProbe runs Fresh and Reject on the site URL. Each finding stays tied to a request, a cookie, or a screenshot.
Use the free US-baseline visit when you want the report format. Use paid EU or California scenarios when those regions are the claims. The free versus paid guide draws that line. ConsentProbe does not install or configure HubSpot tracking or CRM, does not install a CMP, and does not issue a certificate.
FAQ
Does HubSpot tracking fire before Accept?
It often does when the tracking code is ungated. Verify Network and cookies on a Fresh visit, including hs-scripts and hubspot hosts, and any example cookie names that are present.
Are __hstc, __hssc, and hubspotutk always present?
No. Treat them as example labels when they appear. The inventory varies by HubSpot setup.
What if Reject All still shows HubSpot hosts or cookies?
Treat it as a Reject failure. The Reject leftovers guide is the network check. Keep the evidence pack.
Will this page teach HubSpot CRM setup?
No. This page is a Fresh and Reject check, not a HubSpot CRM, Marketing Hub, or tracking-code setup guide.
Does a first-party HubSpot cookie mean it is allowed before Accept?
No. Placement is a label. Permission is for counsel. The party-label guide covers first-party versus third-party names. Observation is not counsel permission.
Is this legal advice?
No. These are technical observations. Observation is not counsel permission. ConsentProbe does not replace counsel, and it does not install a CMP.
Limits of this page
This page tells you how to check HubSpot tracking cookies and hosts on Fresh, how to repeat the check after Reject, and how to treat cookie and host names as observation labels. It is not legal advice, not a HubSpot CRM setup guide, and not a certificate. Observation is not counsel permission. ConsentProbe reports stay tied to requests, cookies, and screenshots. A free US-baseline scan is not an EU or California legal conclusion.
Related guides
Open the before-Accept audit for the general first load, the Reject leftovers guide when Reject still tracks, the pre-consent checklist for the pass order, and the marketing-pixels FAQ for the wider pixel question. The party-label guide covers first-party versus third-party names.
- How to run a cookie audit before Accept
- Reject All Still Tracking: What to Check After You Say No
- Pre-consent audit checklist: what to verify before Accept
- Does Reject All stop marketing pixels?
- First-party vs third-party cookies before consent: what should you check?
- What belongs in a cookie consent audit evidence pack?
- What does a free US-baseline cookie audit prove vs paid EU or California scans?
- CMP claims vs runtime evidence: how do you prove the banner actually works?
- Cookie audit hub: which consent test should you run first?
- Are first-party analytics cookies allowed before Accept?
- ConsentProbe methodology
- Pricing and listed regional products
Sources
These links cover the platform and regulatory context used in this guide. Applicability still depends on the organization and jurisdiction.
Save a US-baseline technical record
After a DIY check, run a free US-baseline audit: one browser visit outside California, with cookies, requests, and screenshots stored as evidence. That visit does not run EU reject/accept or California GPC. EU, California, and Global 2 audits can be purchased from Billing after sign-in.