HubSpot on your website.
Does it track before anyone is asked?
The HubSpot code (js.hs-scripts.com) sets cookies such as __hstc and hubspotutk and reports page views to HubSpot. Without the right banner this happens before the choice.
Your account after the first check

Sample shop. Every point opens its fix with the steps for your tool.
Why HubSpot tracks before the choice
HubSpot has its own banner. It only asks where it is switched on, and tracking only waits in opt-in mode.
- 01
Banner only for some countries
In the banner policy you choose who sees it. If your markets are not included, visitors there see no banner and HubSpot tracks without asking.
Art. 5(3) Directive 2002/58/EC
- 02
Banner as a notice only
A notice-type banner only informs. HubSpot then sets its cookies right away; only the opt-in type waits for consent.
Art. 5(3) Directive 2002/58/EC
- 03
Another banner, HubSpot not listed
If you use another banner tool, it only holds HubSpot back if js.hs-scripts.com is assigned to a category there.
Art. 5(3) Directive 2002/58/EC
Step by step
Measure
Open the page in a private window, developer tools (F12), Network tab, filter for “hs-” and “hubspot” and reload. Under Application, Cookies look for __hstc. The report does this for every page it reads.
Create an opt-in banner
In HubSpot under Settings, Privacy and consent, Cookies create an opt-in banner for your domain and choose no countries or all countries of your market; otherwise it does not show there.
Or in your own banner
If you already use another banner, assign the HubSpot code (js.hs-scripts.com) to the statistics category there and turn off the HubSpot banner.
Measure again
Check again without consent and after “Reject”. Only when no __hstc and no hubspotutk appear does HubSpot no longer track before the choice.
Questions
Why don't I see the HubSpot banner?
Usually it is set for certain countries only, or the domain is missing from the policy. A private window shows what a new visitor sees.
Which cookies does HubSpot set?
Among others __hstc, hubspotutk and __hssc for visitor and session.
I have two banners. Is that bad?
Two banners ask twice and store the choice separately. One is enough; the report detects which banner tool is running.
What a scan shows
It opens your website without consenting, also reads subpages, then clicks Reject and measures again. If HubSpot tracks in advance, the report names the page and the setting that fixes it. Right away for your website: cookie check.
As of 15 November 2026. We name the reference so you can read it yourself; this is not legal advice.
More guides
- Cookies before consent: what ePrivacy requires
- Price information in web shops: unit price and shipping
- European Accessibility Act checker for web shops (WCAG)
- Cookiebot not working or not blocking?
- Usercentrics not blocking?
- Borlabs Cookie not blocking?
- Real Cookie Banner not blocking?
- Complianz not blocking?
- Check your cookie banner yourself in three steps
- Google Fonts self-hosted but still loading?
- Dark patterns in online shops: five patterns and the fix
- EU withdrawal button 2026: what your shop needs
- Unit price and the “order with obligation to pay” button
- GPSR: manufacturer information in your web shop
- OneTrust not blocking cookies?
- CookieYes not blocking or not working?
- Wix cookie banner check: does it really block?
- GTM consent: fire tags only after consent in Tag Manager
- Google Maps embed and GDPR: load the map only after a click
- YouTube embed and GDPR: load the video only after a click
- Google Analytics without consent?
- Meta Pixel before consent?
- TikTok Pixel before consent?
- Hotjar before consent?
- Microsoft Clarity consent mode: check what it sends
- Google reCAPTCHA and GDPR: load it only on the form page
- Shopify cookie banner check: does it really block?
- Google Consent Mode v2 checker: test and set it up
- Cookie checker for websites: free, with the reject test
- Security headers check: free website security checker