Last updated: August 24, 2026
For users in the U.S., there is no uniform federal cookie law that corresponds to the EU ePrivacy framework. However, cookies and similar technologies are subject to various state privacy laws as well as general consumer protection and anti-deception provisions. Particular attention should be paid to the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), other comprehensive state privacy laws, requirements for “Notice at Collection,” opt-out rights regarding the sale, disclosure, or “sharing” of personal information, targeted advertising, the processing of sensitive data, universal opt-out mechanisms or Global Privacy Control, as well as consumer protection risks under FTC practice. Technically necessary cookies may generally be used if they serve exclusively to ensure security, functionality, preference management, or the provision of the website and are described transparently. Analytics, tracking, marketing, profiling, third-party, and advertising technologies, on the other hand, should be controlled at a minimum through clear notice and opt-out mechanisms; in cases involving sensitive data, minors, health-related tracking, cross-context behavioral advertising, or the sale or disclosure of personal information, more stringent requirements—including explicit consent or opt-in—must be considered.
| Cookie | Publicly Available Privacy Notice | Retention Period | Legal Basis in the U.S. |
|---|---|---|---|
| __cfruid | This cookie is used by the website hosting provider’s content delivery or security service provider to limit requests, prevent misuse, and ensure the website is provided in a stable and secure manner. | Until the end of the session. | A patchwork of U.S. state privacy laws, particularly transparency, notice, and security requirements; CCPA/CPRA and comparable state privacy laws, to the extent that personal information is involved. Purpose: Security, prevention of misuse, and ensuring the website functions properly. No “Do Not Sell/Share” opt-out is required as long as the cookie is used solely for technical necessity and is not used for targeted advertising, sale, or sharing. |
| __cfuvid | This cookie is used by the website hosting provider’s content delivery or security service provider to limit requests and support the secure operation of the website. | Until the end of the session. | CCPA/CPRA and other state privacy laws, to the extent that personal information is involved; general security and transparency requirements. Purpose: technical security, prevention of misuse, and website availability. |
| __cf_bm | This cookie is used to protect against automated access and bots. It helps detect and prevent abusive or technically harmful access to the website. | 30 minutes | CCPA/CPRA and other state privacy laws, to the extent that personal information is involved; permissible security and fraud prevention purposes. Purpose: Protection against bots, attacks, and malicious access. |
| __hs_opt_out | This cookie records that a visitor has declined the use of non-essential cookies or should not be prompted for consent again. It contains the value “yes” or “no.” | 6 months | CCPA/CPRA and other state privacy laws, in particular requirements regarding opt-out, “Do Not Sell or Share,” targeted advertising opt-out, universal opt-out mechanisms, and accountability for user preferences. Purpose: To store and implement the user’s privacy and cookie preferences. |
| __hs_do_not_track | This cookie may be set to prevent the tracking code from sending information to HubSpot. It stores the corresponding opt-out or “Do Not Track” decision. | 6 months | CCPA/CPRA and other state privacy laws, in particular opt-out rights regarding sale, sharing, and targeted advertising, as well as the implementation of user preferences. Purpose: Technical implementation of the opt-out from tracking. |
| __hs_initial_opt_in | This cookie prevents the cookie banner from reappearing in strict mode every time a page is loaded. It contains the value “yes” or “no.” | 7 days | CCPA/CPRA and other state privacy laws, transparency, notice, and preference management requirements. Purpose: user-friendly management of the cookie or privacy choice prompt. |
| __hs_cookie_cat_pref | This cookie stores which cookie categories the visitor has consented to or declined. It is used to manage cookie preferences. | 6 months | CCPA/CPRA and other state privacy laws, specifically the management of consent, opt-out, “Do Not Sell or Share,” targeted advertising opt-out, and universal opt-out mechanisms. Purpose: To store and implement the user’s preference selection. |
| __hs_gpc_banner_dismiss | This cookie records that a Global Privacy Control notification has been closed. It contains the value “yes” or “no.” | 180 days | CCPA/CPRA and state privacy laws requiring recognition of universal opt-out mechanisms or Global Privacy Control, where applicable. Purpose: Management of notifications and preferences related to GPC. |
| __hs_notify_banner_dismiss | This cookie records that a “Notify” notification banner has been closed. It contains a Boolean value. | 180 days | U.S. state privacy laws and FTC guidelines regarding clear, non-misleading notices and user-friendly preference management. Purpose: Management of technically necessary notices. |
| hs_ab_test | This cookie is used to display the same version of an A/B test page to a visitor during a session that was previously assigned to them. | Until the end of the session. | This is justifiable only if A/B testing is used exclusively for the consistent technical delivery of a page version. If it supports analysis, optimization, profiling, targeted advertising, sales, or sharing, notice, opt-out, and, if applicable, consent must be reviewed. Relevant legal bases: CCPA/CPRA, other state privacy laws, and the FTC Act regarding misleading or deceptive practices. |
| wg-translations | This local storage entry is used by the translation feature to store translations that have already been loaded or generated in the browser and to display the website in the language selected by the user. | Depends on provider or browser configuration; specified in the document as “stored indefinitely.” Recommendation: Technically limit storage to a reasonable duration or transparently explain the option to delete the data. | CCPA/CPRA and other state privacy laws, to the extent that personal information is involved; Notice at Collection, purpose limitation, and appropriate retention. Purpose: multilingual provision. Unlimited storage should be reviewed from the perspective of transparency and data minimization. |
| wg-slugs | This local storage entry is used by the translation feature to store translated URLs in the browser and provide navigation in the selected language. | Depends on provider or browser configuration; specified in the document as “stored indefinitely.” Recommendation: Technically limit storage to a reasonable duration or transparently explain the option to delete the data. | CCPA/CPRA and other state privacy laws, to the extent that personal information is involved; Notice at Collection, description of purpose, and storage limitation. Purpose: consistent language-based navigation. Unlimited storage should be reviewed and transparently explained. |
| wglang | This cookie stores the language selected by the user so that the website can be displayed in the preferred language. | Until the end of the session. | CCPA/CPRA and other state privacy laws, to the extent that personal information is involved; transparent description as a preference or functional cookie. Purpose: To provide the selected language version. |
These are non-essential cookies that are managed via the cookie banner. As a visitor to a HubSpot-powered website, you can object to the use of these cookies by not giving your consent.
| Cookie / Storage Entry | Publicly Available Privacy Notice | Retention Period | Legal Basis in the U.S. |
|---|---|---|---|
| __hmpl | This storage entry contains metadata on tracking events that HubSpot collects while you use the website. It is used to analyze website usage and is only used if the notice, opt-out, or consent requirements for the respective U.S. state are met. | Session storage or local storage, depending on the consent and tracking configuration. | CCPA/CPRA and other state privacy laws. For sales, sharing, targeted advertising, profiling, or sensitive data, “Notice at Collection,” “Opt-out,” “Do Not Sell or Share,” “Universal Opt-Out Mechanisms,” and, where applicable, consent/opt-in must be technically verified. |
| hublytics_events_53 | This storage entry is temporarily used by HubSpot to store tracking events until they are technically transmitted. It is used for analytics purposes and is only employed if the relevant U.S. notice, opt-out, or consent requirements are implemented. | Session storage or local storage, depending on the consent and tracking configuration. | CCPA/CPRA and other state privacy laws. Due to HubSpot’s use of third-party providers, tracking events, and potential user attribution, notice, opt-out, and the technical sharing of privacy choices with service providers or third parties are required. |
| __hstc | This HubSpot cookie is used to recognize and track visitors across multiple sessions. In particular, it stores the domain, visitor ID, visit times, and session numbers. | 6 months | CCPA/CPRA and other state privacy laws. If recognition is used for targeted advertising, sale, sharing, cross-context behavioral advertising, or profiling, a “Do Not Sell or Share” or targeted advertising opt-out and acknowledgment of GPC/UOOM are required, where applicable. |
| hubspotutk | This HubSpot cookie is used to recognize a visitor. It may be transmitted to HubSpot when a form is submitted and helps identify and merge duplicate contacts. | 6 months | CCPA/CPRA, other state privacy laws, and FTC transparency requirements. Due to form mapping, potential CRM mapping, third-party involvement, and possible sharing of personal information, the “Notice at Collection,” purposes, categories, recipients, opt-out rights, and, where applicable, consent for sensitive data or minors must be reviewed. |
| __hssc | This HubSpot cookie is used to track sessions and page views within a session. It supports the analysis of user behavior on the website. | 30 minutes | CCPA/CPRA and other state privacy laws. Analysis purposes must be described transparently. In cases of personalized analysis, third-party tracking, targeted advertising, sale, or sharing, opt-out mechanisms and GPC/UOOM detection must be reviewed. |
| __hssrc | This HubSpot cookie is set to determine whether a visitor has restarted their browser and whether a new session should be initiated. | Until the end of the session. | CCPA/CPRA and other state privacy laws. If this cookie is part of HubSpot analytics tracking, it must be treated in the same manner as the respective analytics feature. Opt-out and GPC/UOOM must be considered in cases of sale, sharing, or targeted advertising. |
| _ga | This Google Analytics 4 cookie is used to distinguish individual users and to compile statistical information about website usage. | By default, 2 years, subject to different browser limitations or a different configuration. | CCPA/CPRA, other state privacy laws, and FTC practices. Due to user identification, third-party involvement, potential sharing, targeted advertising, profiling, and analysis via online identifiers, notice, opt-out, “Do Not Sell or Share,” and acknowledgment of GPC/UOOM are required, where applicable. For sensitive data, health-related tracking, or minors, additional consent or opt-in requirements must be reviewed. |
| _ga_<Container-ID> | This Google Analytics 4 cookie is used to store the session status and to analyze website usage for statistical purposes. | By default, 2 years, subject to different browser limitations or a different configuration. | CCPA/CPRA and other state privacy laws. Due to analytics, session tracking, Google’s third-party involvement, and potential use for targeted advertising or data sharing, notice, opt-out, “Do Not Sell or Share,” GPC/UOOM, and documentation of data sharing must be reviewed. |
