Last updated: August 24, 2026
For users in the United Arab Emirates, Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) and the jurisdiction of the UAE Data Office apply in particular to cookies and comparable technologies. The UAE PDPL protects personal data and generally applies to the processing of personal data within the UAE, as well as to data controllers or processors outside the UAE, to the extent that they process personal data of individuals in the UAE. In addition, there are separate data protection regulations in financial free zones such as the DIFC and ADGM, the applicability of which must be assessed separately. There is no nationwide special regulation for cookies that is entirely identical to the EU ePrivacy framework. However, cookies and similar technologies are relevant under data protection law if they directly or indirectly identify an individual or track usage behavior. Technically necessary cookies can generally be justified on the grounds of ensuring the secure and functional operation of the website, provided that transparent information is provided. In contrast, analytics, tracking, marketing, profiling, and third-party technologies should only be used with clear, informed, and documented consent, unless a sound alternative legal basis is documented.
| Cookie | Publicly Available Privacy Notice | Retention Period | Legal Basis for the United Arab Emirates |
|---|---|---|---|
| __cfruid | This cookie is used by the website hosting provider’s content delivery or security service provider to limit requests, prevent misuse, and ensure the website is provided in a stable and secure manner. | Until the end of the session. | UAE PDPL, in particular the principles of lawfulness, transparency, purpose limitation, data minimization, security, and proportionality. Processing is permitted to ensure the secure and functional operation of the website; where consent is required as the legal basis, it must be obtained not for purely technical security functions, but for non-essential purposes. |
| __cfuvid | This cookie is used by the website hosting provider’s content delivery or security service provider to limit requests and support the secure operation of the website. | Until the end of the session. | UAE PDPL, specifically lawfulness, transparency, purpose limitation, data minimization, and security. Purpose: technical security, prevention of misuse, and website availability. |
| __cf_bm | This cookie is used to protect against automated access and bots. It helps detect and prevent abusive or technically harmful access to the website. | 30 minutes | UAE PDPL, specifically data security, proportionality, and protection of the website infrastructure. Purpose: To prevent automated or malicious access. |
| __hs_opt_out | This cookie records that a visitor has declined the use of non-essential cookies or should not be prompted for consent again. It contains the value “yes” or “no.” | 6 months | UAE PDPL, transparency, accountability, and proof of the user’s decision. Purpose: To store and implement the cookie decision and to document preference management in compliance with data protection regulations. |
| __hs_do_not_track | This cookie may be set to prevent the tracking code from sending information to HubSpot. It stores the corresponding opt-out or “do not track” decision. | 6 months | UAE PDPL, transparency, purpose limitation, and respect for user preferences. Purpose: Technical implementation of the opt-out from tracking. |
| __hs_initial_opt_in | This cookie prevents the cookie banner from reappearing in strict mode every time a page is loaded. It contains the value “yes” or “no.” | 7 days | UAE PDPL, transparency, accountability, and user-friendly management of the cookie prompt. Purpose: technical management of the consent or opt-out prompt. |
These are non-essential cookies that are controlled via the cookie banner. As a visitor to a HubSpot-powered website, you can object to the use of these cookies by not granting consent.
| Cookie / Storage Entry | Publicly Available Privacy Notice | Retention Period | Legal Basis for the United Arab Emirates |
|---|---|---|---|
| __hmpl | This storage entry contains metadata on tracking events that HubSpot collects while you use the website. It is used to analyze website usage and is only used if the appropriate consent has been granted. | Session storage or local storage, depending on the consent and tracking configuration. | UAE PDPL. For analytics and tracking purposes, this cookie should only be used based on clear, informed, specific, and documented consent, unless a valid alternative legal basis has been documented following a local review. |
| hublytics_events_53 | This cookie is temporarily used by HubSpot to store tracking events until they are technically transmitted. It is used for analytics purposes and is only used if appropriate consent has been granted. | Session storage or local storage, depending on the consent and tracking configuration. | UAE PDPL. Due to tracking events, the potential for personal identification, and third-party involvement, clear, informed, and documented consent should be obtained prior to use. |
| __hstc | This HubSpot cookie is used to recognize and track visitors across multiple sessions. In particular, it stores the domain, visitor ID, visit times, and session numbers. | 6 months | UAE PDPL. Consent is recommended or required when personal data is processed through recognition, analysis, third-party tracking, or profiling. The purposes, providers, categories of personal data, transfers, and the option to withdraw consent must be explained transparently. |
| hubspotutk | This HubSpot cookie is used to recognize a visitor. It may be transmitted to HubSpot when a form is submitted and helps identify and merge duplicate contacts. | 6 months | UAE PDPL. Due to visitor recognition, potential form and CRM mapping, and third-party involvement, clear, informed, and documented consent should be obtained prior to use. |
| __hssc | This HubSpot cookie is used to track sessions and page views within a session. It supports the analysis of user behavior on the website. | 30 minutes | UAE PDPL. Analysis purposes must be transparently explained; in cases involving the evaluation of personal data, third-party tracking, or profiling, use should only occur with consent. |
| __hssrc | This HubSpot cookie is set to determine whether a visitor has restarted their browser and whether a new session should be initiated. | Until the end of the session. | UAE PDPL. If this cookie is part of HubSpot analytics tracking, it must be treated as an analytics cookie and should only be used with consent. |
| _ga | This Google Analytics 4 cookie is used to distinguish individual users and to compile statistical information about website usage. | By default, 2 years, subject to different browser settings or a different configuration. | UAE PDPL. Due to user differentiation, recognition, third-party involvement, potential profiling, and cross-border transfer, this cookie should only be used after clear, informed, and documented consent has been obtained. |
| _ga_<Container-ID> | This Google Analytics 4 cookie is used to store the session status and to statistically analyze website usage. | By default, 2 years, subject to different browser settings or a different configuration. | UAE PDPL. Due to analysis, session tracking, third-party involvement, and potential cross-border transfers, this cookie should only be used with clear, informed, and documented consent. |
