Last updated: August 24, 2026
For users in Canada, cookies and similar technologies are governed in particular by the Personal Information Protection and Electronic Documents Act (PIPEDA) at the federal level, as well as—depending on the province and context of processing—substantially similar provincial privacy laws, particularly in Alberta, British Columbia, and Quebec. Cookies, local storage, pixels, scripts, tags, device identifiers, and similar technologies are subject to data protection laws if they are used to collect, use, or disclose personal information. Under PIPEDA, “meaningful consent” is required: Users must be informed in a clear, understandable, and accessible manner about what personal information is being collected, for what purposes, with whom it is being shared, and what risks or consequences may arise. For less sensitive, expected, and necessary processing, implied consent or transparent information may suffice on a case-by-case basis. For sensitive information, unexpected purposes, third-party tracking, online behavioral advertising, profiling, children, location data, or processing involving significant residual risk, explicit consent is required or strongly recommended. For Quebec, Law 25 must be reviewed separately; there, tracking, identification, location, or profiling technologies must generally be disabled by default and require active prior consent.
| Cookie | Publicly Available Privacy Notice | Retention Period | Legal Basis in Canada |
|---|---|---|---|
| __cfruid | This cookie is used by the website hosting provider’s content delivery or security service provider to limit requests, prevent misuse, and ensure the website is provided in a stable and secure manner. | Until the end of the session. | PIPEDA and the Canadian Fair Information Principles, specifically Accountability, Identifying Purposes, Consent, Limiting Collection, Safeguards, and Openness. Purpose: to ensure the secure, stable, and abuse-free operation of the website. No separate explicit consent is required, provided that the use is strictly technically necessary, reasonable, and transparently described. |
| __cfuvid | This cookie is used by the website hosting provider’s content delivery or security service provider to limit requests and support the secure operation of the website. | Until the end of the session. | PIPEDA, specifically Identifying Purposes, Limiting Collection, Safeguards, and Openness. Purpose: technical security, prevention of misuse, and website availability. |
| __cf_bm | This cookie is used to protect against automated access and bots. It helps detect and prevent abusive or technically harmful access to the website. | 30 minutes | PIPEDA, specifically Limiting Collection, Safeguards, and appropriate purpose limitation. Purpose: Protection of the website infrastructure, fraud and abuse prevention, and security monitoring. |
| __hs_opt_out | This cookie records that a visitor has declined the use of non-essential cookies or should not be prompted for consent again. It contains the value “yes” or “no.” | 6 months | PIPEDA, specifically Consent, Withdrawal of Consent, Openness, and Accountability. Purpose: To store and implement the cookie preference and to demonstrate transparent preference management. |
| __hs_do_not_track | This cookie may be set to prevent the tracking code from sending information to HubSpot. It stores the corresponding opt-out or “do not track” decision. | 6 months | PIPEDA, specifically Withdrawal of Consent, Openness, Accountability, and Safeguards. Purpose: Technical implementation of the opt-out from tracking and preservation of user preferences. |
| __hs_initial_opt_in | This cookie prevents the cookie banner from reappearing in strict mode every time a page is loaded. It contains the value “yes” or “no.” | 7 days | PIPEDA, specifically Consent, Openness, and Accountability. Purpose: user-friendly and transparent management of the cookie prompt. |
| __hs_cookie_cat_pref | This cookie stores which cookie categories the visitor has consented to or declined. It is used to manage cookie preferences. | 6 months | PIPEDA, specifically Meaningful Consent, Withdrawal of Consent, Openness, and Accountability. Purpose: To store and implement the user’s decision to consent, decline, or set preferences. |
| __hs_gpc_banner_dismiss | This cookie records that a Global Privacy Control notification has been closed. It contains the value “yes” or “no.” | 180 days | PIPEDA, Openness, and Accountability. Purpose: To manage privacy preferences and prevent repeated notifications. The practical relevance of GPC (Global Privacy Control) must be assessed separately on a technical basis depending on the Canadian province and website configuration. |
| __hs_notify_banner_dismiss | This cookie records that a “Notify” notification banner has been closed. It contains a Boolean value. | 180 days | PIPEDA, specifically Openness and Accountability. Purpose: user-friendly management of technically required notices. |
| hs_ab_test | This cookie is used to display the same version of an A/B test page to a visitor during a session that was previously assigned to them. | Until the end of the session. | Justifiable without explicit consent only if the A/B testing serves exclusively to ensure the consistent technical delivery of the accessed page version and does not pursue any analysis, reach measurement, optimization, personalization, marketing, or profiling purposes. Legal basis: PIPEDA, specifically Identifying Purposes, Consent, Limiting Collection, and Openness. Otherwise, explicit consent is required or strongly recommended; for Quebec, prior opt-in must be considered. |
| wg-translations | This local storage entry is used by the translation feature to store translations that have already been loaded or generated in the browser and to display the website in the language selected by the user. | Depending on provider or browser configuration; specified in the document as “stored indefinitely.” Recommendation: technically limit storage to a reasonable duration or transparently explain the option to delete. | PIPEDA, specifically Identifying Purposes, Limiting Collection, Limiting Use, Disclosure and Retention, Openness, and Safeguards. Purpose: to provide the website in multiple languages and in a user-friendly manner. Due to unlimited storage, a retention and proportionality assessment is required. |
| wg-slugs | This local storage entry is used by the translation feature to store translated URLs in the browser and provide navigation in the selected language. | Depending on provider or browser configuration; specified in the document as “stored indefinitely.” Recommendation: technically limit storage to a reasonable duration or transparently explain the option to delete. | PIPEDA, specifically Identifying Purposes, Limiting Collection, Limiting Use, Disclosure and Retention, Openness, and Safeguards. Purpose: consistent language-based navigation. Due to unlimited storage, a retention and proportionality assessment is required. |
| wglang | This cookie stores the language selected by the user so that the website can be displayed in the preferred language. | Until the end of the session. | PIPEDA, specifically Identifying Purposes, Consent, and Openness. Purpose: To provide the language version selected by the user. |
These are non-essential cookies that are managed via the cookie banner. As a visitor to a HubSpot-powered website, you can object to the use of these cookies by not giving your consent.
| Cookie / Storage Entry | Publicly Available Privacy Notice | Retention Period | Legal Basis in Canada |
|---|---|---|---|
| __hmpl | This storage entry contains metadata on tracking events that HubSpot collects while you use the website. It is used to analyze website usage and is only implemented if appropriate consent or a permissible opt-out mechanism has been put in place. | Session storage or local storage, depending on the consent and tracking configuration. | PIPEDA, specifically Meaningful Consent, Identifying Purposes, Limiting Collection, Openness, and Safeguards. Express consent is required or strongly recommended for third-party tracking, profiling, online behavioral advertising, sensitive information, unexpected use, or significant residual risk. For Quebec, prior opt-in must be reviewed separately. |
| hublytics_events_53 | This cookie is temporarily used by HubSpot to store tracking events until they are technically transmitted. It is used for analytics purposes and is only deployed if the relevant Canadian consent, information, and opt-out requirements are met. | Session storage or local storage, depending on the consent and tracking configuration. | PIPEDA, specifically Meaningful Consent, Openness, Accountability, and Safeguards. Due to tracking events, potential personal identifiability, and third-party involvement, clear, understandable, and documented consent should be obtained prior to use, unless a lower risk classification is robustly documented. |
| __hstc | This HubSpot cookie is used to recognize and track visitors across multiple sessions. In particular, it stores the domain, visitor ID, visit times, and session numbers. | 6 months | PIPEDA. Consent is required or strongly recommended, as the cookie is used for analytics, recognition, and tracking purposes, and online identifiers may constitute personal information. The purposes, providers, data categories, recipients, retention period, risks, and option to withdraw consent must be clearly highlighted. |
| hubspotutk | This HubSpot cookie is used to recognize a visitor. It may be transmitted to HubSpot when a form is submitted and helps identify and merge duplicate contacts. | 6 months | PIPEDA. Due to visitor recognition, potential form and CRM mapping, and third-party involvement, explicit, informed, and documented consent should be obtained prior to use, particularly when contacts are merged, profiles are created, or data is used for marketing purposes. |
| __hssc | This HubSpot cookie is used to track sessions and page views within a session. It supports the analysis of user behavior on the website. | 30 minutes | PIPEDA. Analytics purposes must be transparently explained in advance. In cases involving the analysis of personal data, third-party tracking, behavioral advertising, profiling, or unexpected use, the cookie should only be used with explicit consent. For Quebec, prior opt-in requirements must be specifically reviewed. |
| __hssrc | This HubSpot cookie is set to determine whether a visitor has restarted their browser and whether a new session should be initiated. | Until the end of the session. | PIPEDA. If this cookie is part of HubSpot’s analytics tracking, it must be treated like the corresponding analytics feature and should only be used if the required consent or opt-out mechanism has been effectively implemented. |
| _ga | This Google Analytics 4 cookie is used to distinguish individual users and to compile statistical information about website usage. | By default, 2 years, subject to different browser limitations or a different configuration. | PIPEDA and provincial privacy laws. Due to user identification, recognition, third-party involvement, potential profiling, online behavioral advertising, and potential international transfer, this cookie should only be used after clear, understandable, and documented consent has been obtained. For Quebec, prior opt-in must be verified before the cookie is set or read. |
| _ga_<Container-ID> | This Google Analytics 4 cookie is used to store the session status and to analyze website usage for statistical purposes. | By default, 2 years, subject to different browser limitations or a different configuration. | PIPEDA and provincial privacy laws. Due to analysis, session tracking, third-party involvement, and potential international data transfers, this cookie should only be used after clear, understandable, and documented consent has been obtained. The retention period, purpose, recipients, risks, right to withdraw consent, and data transfers must be described transparently. |
