HubSpot includes a dedicated set of controls for managing consent records and privacy preferences inside your CRM. You can enable the data privacy features from account settings, and they apply platform-wide once switched on.
This guide covers the setup of HubSpot’s built-in privacy features: how to enable them and add consent to forms, and what to do when a contact requests their data. One important note: this guide describes how to configure HubSpot’s privacy tools. Whether a given configuration satisfies your specific legal obligations depends on your business and the regulations applicable to your region. Consult legal counsel for guidance on your specific obligations. These are functional settings, not legal advice.
Go to Settings > Privacy & Consent. Turn on the GDPR features toggle. This unlocks consent fields on forms and legal basis options on contact records, along with communication subscription settings throughout the platform.
In the same settings section, choose a default legal basis. Common choices include Consent (the contact explicitly opted in) or Legitimate Interests (you have a reasonable business rationale that does not override the contact’s rights). You can update this per contact from their record at any time.
Go to Marketing > Lead Capture > Cookie Banner. Add your banner to HubSpot-hosted pages. Set which cookie categories require consent beyond the necessary minimum, and configure how the banner appears on first visit. This only applies to pages served directly by HubSpot.
Inside each HubSpot form, turn on the consent-to-process section. Write a plain-language statement explaining what data is collected and how it will be used. Do not pre-tick the checkbox. Add a communications consent section if you want to record which outreach types the contact agrees to receive.
From any contact record, go to Actions to export a contact’s data or delete their record. Data export generates a file with the contact’s stored properties and activity history, as well as associated records. Deletion is permanent and cannot be reversed, so confirm the contact’s identity before proceeding.
How do consent fields work on HubSpot forms?
When you enable GDPR features, each form gains two optional sections. The consent-to-process section is where you explain how the contact’s data will be used. The communications consent section lets contacts opt in to specific outreach types by ticking a checkbox.
Both sections are configurable per form. A gated content download might use simpler consent language than a demo request form. Keep the wording specific to what you actually do with the data, and avoid combining multiple purposes into one vague statement.
HubSpot stores each contact’s consent status on their record. You can filter and segment by consent status using active lists, which is useful for confirming that only opted-in contacts are receiving certain types of email.
What does the legal basis field on a contact record do?
The legal basis field is a record-keeping tool. It stores which legal basis you have selected for processing that contact’s data. It does not automatically verify that your chosen basis applies to your specific situation. If you are uncertain which basis is appropriate for your business or region, this is worth reviewing with legal counsel.
You can update the legal basis field on any individual contact record from the Communication Subscriptions section. If your account has contacts from before you enabled GDPR features, review how those records are classified rather than leaving them with a default that was set automatically.
How does HubSpot’s cookie consent banner work?
HubSpot’s built-in cookie banner is available for HubSpot-hosted pages and CMS Hub sites. Visitors see the banner on first visit and can manage their cookie preferences. HubSpot respects the visitor’s selection on return visits by reading the stored preference cookie.
If your website is not hosted on HubSpot, the built-in banner does not apply. You would need a separate consent management platform for your site’s frontend. This is a common setup for teams using HubSpot CRM alongside a WordPress or externally hosted site.
Advertising and analytics cookies wait for the visitor’s choice before loading; only strictly necessary cookies run immediately. Keep in mind that third-party scripts loaded through Google Tag Manager also fall under consent requirements if they fire outside HubSpot’s native tracking.
How do subscription types connect to contact privacy settings?
HubSpot’s subscription types are the categories of communication that contacts can opt in or out of. When a contact ticks a communications consent checkbox on a form, they are subscribing to a specific subscription type.
Set up subscription types under Settings > Marketing > Email > Subscription Types. Create types that match your actual communications, such as marketing emails or event invitations. Map each form’s consent checkbox to the relevant type so opt-ins are recorded accurately.
When a contact unsubscribes from a specific type, HubSpot blocks that category of email automatically. A global unsubscribe blocks all marketing email from your portal. Both statuses are visible on the contact record and respected by every HubSpot email send.
What should you do if a contact requests access to or deletion of their data?
Navigate to the contact’s record and use Actions > View data to generate a data export. The file includes the contact’s stored properties and activity history, as well as associated records.
For a deletion request, use Actions > Delete. The record is removed permanently from your HubSpot portal. If you need an audit trail showing the deletion happened, document it externally before confirming. HubSpot also allows removing specific property values from a contact record without deleting the whole record, which is appropriate when a contact wants partial data removed.
Review your contact database periodically for records where consent status is unclear. An active list filtered by legal basis and subscription status surfaces this quickly and keeps your database audit-ready.
Frequently asked questions
Does turning on HubSpot’s GDPR settings mean my account is compliant?
Not automatically. The settings give you tools to collect and record consent, and to respect contact preferences. Whether your actual data practices satisfy legal requirements depends on how you use the data and the regulations applicable to your business. The privacy features are infrastructure for compliance, not a standalone guarantee.
Can I use these features even if my business is not in Europe?
Yes. Teams across Southeast Asia enable HubSpot’s consent and subscription features to maintain a clean record of how contacts were acquired and what they agreed to, regardless of jurisdiction. The tools are useful for any team that wants to manage contact preferences properly.
What is the difference between consent-to-process and communications consent on a form?
The consent-to-process section explains why you are collecting and using the contact’s data. The communications consent section captures which types of outreach the contact agrees to receive. Both serve different record-keeping purposes and should be configured separately rather than merged into a single checkbox.
What happens to a contact’s data when I delete them from HubSpot?
The record is removed permanently from your portal. This action cannot be undone. Confirm the contact’s identity and document the request externally before deleting, so you have an audit trail showing the deletion was carried out in response to a legitimate request.
This is an independent informational resource produced by a HubSpot Platinum Partner. HubSpot is a trademark of HubSpot, Inc.
Planning a HubSpot setup or integration in the region?
Contact us