Last updated: August 24, 2026
For users in the United Kingdom, cookies and similar storage and access technologies are governed in particular by Regulation 6 of the Privacy and Electronic Communications Regulations 2003 (PECR) and—to the extent that personal data is processed—by the UK GDPR and the Data Protection Act 2018. Under the PECR, information may generally only be stored on or retrieved from a user’s device if the user has been clearly and comprehensively informed in advance about the technologies used, their purposes, and the duration of storage, and has provided valid consent in accordance with UK GDPR standards. This requirement applies not only to traditional cookies but also to comparable technologies such as local storage, pixels, scripts, tags, SDKs, or fingerprinting. The only exception applies to technologies that are “strictly necessary” to provide an online service explicitly requested by the user. Analytics, tracking, marketing, personalization, and similar optimization technologies are generally not “strictly necessary” and may therefore, as a rule, only be used after prior active consent has been given.
Necessary cookies and comparable storage and access technologies that do not require consent under the PECR.
| Cookie | Publicly Available Privacy Notice | Retention Period | Legal basis in the United Kingdom |
|---|---|---|---|
| __cfruid | This cookie is used by the website hosting provider’s content delivery or security service provider to limit requests, prevent misuse, and ensure the website is delivered in a stable and secure manner. | Until the end of the session. | Regulation 6 PECR, exception for strictly necessary cookies or storage and access technologies; to the extent that personal data is processed: Art. 6(1)(f) UK GDPR. Legitimate interest: secure, stable, and abuse-free provision of the website. |
| __cfuvid | This cookie is used by the website hosting provider’s content delivery or security service provider to limit requests and support the secure operation of the website. | Until the end of the session. | Regulation 6 PECR, with an exception for strictly necessary cookies or storage and access technologies; to the extent that personal data is processed: Art. 6(1)(f) UK GDPR. Legitimate interest: technical security and availability of the website. |
| __cf_bm | This cookie is used to protect against automated access and bots. It helps detect and prevent abusive or technically harmful access to the website. | 30 minutes | Regulation 6 PECR, exception for strictly necessary cookies or storage and access technologies; to the extent that personal data is processed: Art. 6(1)(f) UK GDPR. Legitimate interest: Protection of the website against misuse, attacks, and automated access. |
| __hs_opt_out | This cookie records that a visitor has declined the use of non-essential cookies or should not be prompted for consent again. It contains the value “yes” or “no.” | 6 months | Regulation 6 PECR, exception for strictly necessary consent management; Art. 6(1)(f) UK GDPR. Legitimate interest: Storing and implementing the cookie decision, as well as demonstrating data protection-compliant consent management. |
| __hs_do_not_track | This cookie may be set to prevent the tracking code from sending information to HubSpot. It stores the corresponding opt-out or "do not track" decision. | 6 months | Regulation 6 PECR, exception for strictly necessary administration of tracking opt-out; Art. 6(1)(f) UK GDPR. Legitimate interest: technical implementation of tracking opt-out and preservation of user preference. |
| __hs_initial_opt_in | This cookie prevents the cookie banner from reappearing in strict mode every time a page is loaded. It contains the value “yes” or “no.” | 7 days | Regulation 6 PECR, exception for strictly necessary consent management; Art. 6(1)(f) UK GDPR. Legitimate interest: user-friendly and technically sound management of the cookie prompt. |
| __hs_cookie_cat_pref | This cookie stores which cookie categories the visitor has consented to or declined. It is used for the technically necessary management of cookie preferences. | 6 months | Regulation 6 of the PECR, exception for strictly necessary consent management; Art. 6(1)(f) of the UK GDPR. Legitimate interest: Storing and implementing the user’s decision to consent or refuse. |
| __hs_gpc_banner_dismiss | This cookie records that a Global Privacy Control prompt has been closed. It contains the value “yes” or “no.” | 180 days | Regulation 6 PECR, exception for strictly necessary management of privacy preferences; Art. 6(1)(f) UK GDPR. Legitimate interest: Managing privacy preferences and preventing repeated notifications. |
| __hs_notify_banner_dismiss | This cookie records that a “Notify” notification banner has been closed. It contains a Boolean value. | 180 days | Regulation 6 PECR, exception for strictly necessary notice management; Art. 6(1)(f) UK GDPR. Legitimate interest: user-friendly management of technically necessary notices. |
| hs_ab_test | This cookie is used to display the same version of an A/B test page to a visitor during a session that was previously assigned to them. | Until the end of the session. | Justifiable as a necessary cookie only if the A/B testing serves exclusively to ensure the consistent technical delivery of the page version accessed by the user and does not pursue any analysis, audience measurement, optimization, personalization, marketing, or profiling purposes. Legal basis for this strictly limited case: Regulation 6 PECR, exception for “strictly necessary” storage and access technologies; to the extent that personal data is processed: Art. 6(1)(f) UK GDPR. In all other cases, consent is required prior to setting or reading the cookie in accordance with Regulation 6 PECR and Art. 6(1)(a) UK GDPR. |
| wg-translations | This local storage entry is used by the translation feature to store translations that have already been loaded or generated in the browser and to display the website in the language selected by the user. | Depending on the provider’s or browser’s configuration; specified in the document as “stored indefinitely.” | Regulation 6 of the PECR, provided that the storage is strictly necessary for the explicitly requested voice function; Art. 6(1)(f) of the UK GDPR. Legitimate interest: multilingual and user-friendly provision of the website. |
| wg-slugs | This local storage entry is used by the translation feature to store translated URLs in the browser and to provide navigation in the selected language. | Depending on the provider’s or browser’s configuration; specified in the document as “stored indefinitely.” | Regulation 6 PECR, provided that the storage is strictly necessary for the explicitly requested language function; Art. 6(1)(f) UK GDPR. Legitimate interest: consistent language-based navigation. |
| wglang | This cookie stores the language selected by the user so that the website can be displayed in the preferred language. | Until the end of the session. | Regulation 6 PECR, provided that storage is strictly necessary for the explicitly requested language function; Art. 6(1)(f) UK GDPR. Legitimate interest: Providing the language version selected by the user. |
These are non-essential cookies that are managed via the cookie banner. As a visitor to a HubSpot-powered website, you can object to the use of these cookies by not giving your consent.
| Cookie / Storage Entry | Publicly Available Privacy Notice | Retention Period | Legal Basis in France |
|---|---|---|---|
| __hmpl | This storage entry contains metadata on tracking events that HubSpot collects while you use the website. It is used to analyze website usage and is only used if the appropriate consent has been granted. | Session storage or local storage, depending on the consent and tracking configuration. | Art. 82 of the French Data Protection Act; Art. 6(1)(a) of the GDPR. Use is based solely on prior, voluntary, informed, and revocable consent. |
| hublytics_events_53 | This cookie is temporarily used by HubSpot to store tracking events until they are technically transmitted. It is used for analytical purposes and is only used if consent has been granted. | Session storage or local storage, depending on the consent and tracking configuration. | Art. 82 of the French Data Protection Act; Art. 6(1)(a) of the GDPR. This is used only with prior consent. |
| __hstc | This HubSpot cookie is used to recognize and track visitors across multiple sessions. In particular, it stores the domain, visitor ID, visit times, and session numbers. | 6 months | Art. 82 of the French Data Protection Act; Art. 6(1)(a) of the GDPR. Consent is required, as the cookie is used for recognition and analysis across multiple sessions. It may only be treated as consent-free audience measurement if all CNIL criteria are demonstrably met; this cannot be assumed for HubSpot tracking without a separate technical review. |
| hubspotutk | This HubSpot cookie is used to recognize a visitor. It may be transmitted to HubSpot when a form is submitted and helps identify and merge duplicate contacts. | 6 months | Art. 82 of the French Data Protection Act; Art. 6(1)(a) of the GDPR. Consent is required because the cookie is used for visitor recognition, form mapping, and CRM/analytics mapping, and thus goes beyond the purely technical provision of the service requested by the user. |
| __hssc | This HubSpot cookie is used to track sessions and page views within a session. It supports the analysis of user behavior on the website. | 30 minutes | Art. 82 of the French Data Protection Act; Art. 6(1)(a) of the GDPR. Consent is required if the cookie is used in connection with HubSpot analytics tracking. An exception for reach measurement requires a strictly limited, non-aggregated, non-cross-page, and documented CNIL-compliant configuration. |
| __hssrc | This HubSpot cookie is set to determine whether a visitor has restarted their browser and whether a new session should be initiated. | Until the end of the session. | Art. 82 of the French Data Protection Act; Art. 6(1)(a) of the GDPR. Consent is required if the cookie is used in connection with HubSpot analytics tracking. In this context, the session logic is part of the analytics function and therefore should not be treated as a technically necessary cookie, unless it is required exclusively for a technical function requested by the user. |
| _ga | This Google Analytics 4 cookie is used to distinguish individual users and to compile statistical information about website usage. | By default, 2 years, subject to any different browser limitations or configurations. | Art. 82 of the French Data Protection Act; Art. 6(1)(a) of the GDPR. Consent is required, as Google Analytics 4 is used for user identification, analysis, and recognition. According to CNIL practice, audience measurement trackers may only be used without consent in exceptional cases if all CNIL criteria are met and documented; for Google Analytics 4, such an exception cannot be assumed without a separately verified exception configuration. |
| _ga_<container ID> | This Google Analytics 4 cookie is used to store the session status and to statistically analyze website usage. | By default, 2 years, subject to any different browser limitations or configurations. | Art. 82 of the French Data Protection Act; Art. 6(1)(a) of the GDPR. Consent is required, as the cookie is used to store the session status and for statistical analysis. A CNIL exemption is only applicable for reach measurement that is strictly limited in purpose, anonymized, not aggregated, not shared with third parties, not cross-site, and documented. |
