Privacy policy: https://legal.hubspot.com/privacy-policy
| Cookie | Category | Purpose |
|---|---|---|
hs-membership-csrf | Strictly necessary | This cookie is used to ensure that content membership logins cannot be forged. |
hs-messages-hide-welcome-message | Functional | This cookie is used to prevent the chat widget welcome message from appearing again for one day after it is dismissed. |
hs-messages-is-open | Functional | This cookie is used to determine and save whether the chat widget is open for future visits. |
hs_ab_test | Functional | This cookie is used to consistently serve visitors the same version of an A/B test page they’ve seen before. |
__hs_cookie_cat_pref | Functional | This cookie is used to record the categories a visitor consented to. |
__hs_do_not_track | Functional | This cookie can be set to prevent the tracking code from sending any information to HubSpot. |
__hs_gpc_banner_dismiss | Functional | This cookie is used when the Global Privacy Control banner is dismissed. |
__hs_initial_opt_in | Functional | This cookie is used to prevent the banner from always displaying when visitors are browsing in strict mode. |
hs_langswitcher_choice | Functional | This cookie is used to save the visitor's selected language choice when viewing pages in multiple languages. |
__hs_notify_banner_dismiss | Functional | This cookie is used when the website uses a Notify consent banner type. |
__hs_opt_out | Functional | This cookie is used by the opt-in privacy policy to remember not to ask the visitor to accept cookies again. |
__hsmem | Functional | This cookie is set when visitors log in to a HubSpot-hosted site. |
__hssc | Marketing | This cookie keeps track of sessions. |
__hssrc | Marketing | Whenever HubSpot changes the session cookie, this cookie is also set to determine if the visitor has restarted their browser. |
__hstc | Marketing | The main cookie for tracking visitors. |
hubspotapi | Marketing | This cookie allows the user to access the app with the correct permissions. |
hubspotapi-csrf | Strictly necessary | This is used for CSRF prevention - preventing third party websites from accessing your data. Expires after a year. |
hubspotapi-prefs | Functional | This is used with the hubspotapi cookie to remember whether the user checked the 'remember me' box (controls the expiration of the main cookie's authentication). |
hubspotutk | Marketing | This cookie keeps track of a visitor's identity. It is passed to HubSpot on form submission and used when deduplicating contacts. |
messagesUtk | Marketing | This cookie is used to recognize visitors who chat with you via the chatflows tool. If the visitor leaves your site before they're added as a contact, they will have this cookie associated with their browser. |
Running HubSpot on your site? A free Conzent scan shows which of these cookies are set before consent, and the banner blocks them until the visitor agrees.
Last updated 2026-09-27.