HubSpot CMS Cookie Compliance in Spain: Privacy Evidence and Monitoring Checklist

Introduction

*Updated for 2026 compliance practices.*

If you run a website on HubSpot CMS and serve visitors from Spain, you need a clear plan for cookie compliance, privacy evidence, and ongoing monitoring. This guide gives you a practical **HubSpot CMS cookie compliance Spain privacy evidence and monitoring checklist** that helps you validate consent, tags, and disclosures without guesswork. We focus on what you can verify today—using GDPRChecker scans to check pre-consent network requests, banner behavior, and disclosure gaps after every change.

This is a technical implementation guide, not legal advice. Always consult a qualified privacy professional for your specific situation.

What Is HubSpot CMS Cookie Compliance Spain Privacy Evidence and Monitoring Checklist?

A **HubSpot CMS cookie compliance Spain privacy evidence and monitoring checklist** is a structured set of verification steps for website owners who need to demonstrate GDPR-aligned cookie practices on HubSpot-hosted sites. It covers:

• **Consent defaults**: Are non-essential cookies and trackers blocked before the user gives consent?
• **Pre-consent network requests**: Do any tags fire before the consent banner is interacted with?
• **Banner behavior**: Does the cookie banner offer a genuine reject option and respect that choice?
• **Disclosure gaps**: Are all cookies and trackers accurately described in your privacy policy?
• **Evidence collection**: What records should you keep to prove compliance?
• **Monitoring**: How do you catch regressions after CMS updates, tag changes, or new integrations?

This checklist is especially relevant for HubSpot CMS because the platform’s built-in cookie consent features must be configured correctly to meet Spanish and EU requirements. The Spanish Data Protection Authority (AEPD) enforces GDPR alongside the European Data Protection Board (EDPB) guidelines, so your evidence must show that you actively control and document cookie behavior.

Requirements and Compliance Expectations in Spain

Spain applies the GDPR and the national Ley Orgánica de Protección de Datos y Garantía de los Derechos Digitales (LOPDGDD). The AEPD expects:

• **Prior consent** for non-essential cookies (analytics, marketing, social media).
• **Clear information** about each cookie’s purpose, duration, and third-party access.
• **Easy withdrawal** of consent, with a mechanism as simple as giving it.
• **Documented evidence** of consent and ongoing monitoring.

The EDPB’s guidelines reinforce that cookie walls (making access conditional on consent) are not valid, and implied consent (e.g., “by continuing to browse you accept”) is insufficient. For HubSpot CMS users, this means you must configure the cookie consent banner to block tracking scripts until the user makes an active choice, and you must keep logs of consent where possible.

Comparison: HubSpot CMS Default Settings vs. Compliant Configuration

| Aspect | HubSpot CMS Default | Compliant Configuration | |--------|---------------------|-------------------------| | Cookie banner | May allow implied consent or pre-checked boxes | Explicit opt-in, no pre-ticked boxes | | Script blocking | Not always enforced before consent | All non-essential scripts blocked until consent | | Consent logging | Not enabled by default | Consent records stored (via CMP or custom integration) | | Privacy policy link | May be missing from banner | Clearly linked in banner and footer | | Reject button | May be absent or hard to find | Prominent reject option on first layer |

How to Implement Step by Step

1. Audit Your Current Cookie and Tracker Inventory

Before changing anything, run a scan with GDPRChecker to see exactly what cookies and network requests your HubSpot CMS site makes. Pay attention to:

• HubSpot’s own cookies (e.g., `__hs_opt_out`, `__hs_do_not_track`, `hs_ab_test`)
• Google Analytics or Google Ads tags
• Social media embeds (LinkedIn, Twitter)
• Any custom scripts added via the design manager or modules

Document every tracker, its purpose, and whether it is strictly necessary. This inventory is your baseline evidence.

2. Configure HubSpot’s Cookie Consent Banner

In your HubSpot account, go to **Settings > Privacy & Consent > Cookies**. Here you can:

• Enable the cookie consent banner.
• Choose “Opt-in” consent type (not “implied consent”).
• Add a link to your privacy policy.
• Customize the banner text to explain cookie use in Spanish if your audience is primarily in Spain.

**Important**: HubSpot’s built-in banner does not automatically block all scripts. You must use the `hs-cookie-consent` JavaScript API or Google Tag Manager triggers to conditionally load scripts based on consent.

3. Block Non-Essential Scripts Before Consent

For Google Analytics, Google Ads, or any other tracking scripts, wrap them in a consent check. Example using HubSpot’s API:

```javascript if (window.hs_cookie_consent && hs_cookie_consent.hasConsented('analytics')) { // Load Google Analytics } ```

If you use Google Tag Manager, set up consent triggers that fire only after the user accepts the corresponding category. This prevents pre-consent network requests that GDPRChecker would flag.

4. Implement Google Consent Mode v2

If you use Google services, integrate Google Consent Mode v2 to adjust tag behavior based on consent state. This is not a replacement for a consent banner but a complementary signal. GDPRChecker can diagnose Consent Mode gaps, so verify that `gtag('consent', 'default', {...})` is set correctly before any tags fire.

5. Test the Reject Flow

Many implementations fail because the reject button does not actually stop tracking. After a user clicks “Reject,” verify with GDPRChecker that no analytics or marketing requests are sent. Common pitfalls:

• HubSpot’s own analytics cookie may still be set if not properly categorized.
• Google Tag Manager may fire a pageview tag regardless of consent.
• Embedded YouTube videos may set cookies before interaction.

6. Update Your Privacy Policy

Your privacy policy must list every cookie and tracker identified in your audit, with clear descriptions. Link to it from the cookie banner and the site footer. GDPRChecker can check that the policy link is present and accessible.

Common Mistakes and How to Avoid Them

Mistake 1: Assuming HubSpot’s Banner Blocks Everything

HubSpot’s consent banner is a notice and choice mechanism, not a script blocker by default. You must manually configure script blocking. Without it, tags fire before consent, which is a clear violation.

**How to avoid**: After setup, run a GDPRChecker scan with the banner not yet accepted. If any non-essential requests appear, adjust your script loading logic.

Mistake 2: Ignoring Third-Party Embeds

Embedded forms, chatbots, or video players often set their own cookies. For example, a HubSpot meeting scheduler embed may drop cookies even if the main HubSpot tracking is blocked.

**How to avoid**: Scan every page type (landing pages, blog posts, contact pages) with GDPRChecker. Look for unexpected domains in the network requests.

Mistake 3: No Consent Evidence

Without records of consent, you cannot demonstrate compliance if challenged. HubSpot does not store consent logs by default.

**How to avoid**: Use a consent management platform that logs consent, or build a custom solution that records consent timestamps and preferences. GDPRChecker’s paid plans include managed consent banner and consent records to close this gap.

Mistake 4: Forgetting About Spanish Language Requirements

If your site targets Spanish users, the cookie banner and privacy policy should be available in Spanish. The AEPD may consider an English-only banner insufficient for a Spanish audience.

**How to avoid**: Use HubSpot’s multi-language features to display a Spanish consent banner and policy. Verify with GDPRChecker that the correct language version appears based on browser settings.

How to Validate with GDPRChecker

GDPRChecker scans help you verify every aspect of your HubSpot CMS cookie compliance. Here’s a practical validation workflow:

1. **Pre-consent scan**: Run a scan without interacting with the cookie banner. Check that no analytics or marketing requests appear. If they do, your script blocking is incomplete.
2. **Post-consent scan**: Accept all cookies and scan again. Confirm that the expected tags now fire.
3. **Reject scan**: Reject all cookies and scan. Verify that only essential requests remain.
4. **Policy link check**: GDPRChecker automatically verifies that your privacy policy is linked from the banner and accessible.
5. **Consent Mode diagnostics**: If you use Google Consent Mode, GDPRChecker checks that the default consent state is set before tags load.

After any change to your HubSpot CMS templates, modules, or integrations, re-run these scans. This is your ongoing monitoring evidence.

Implementation Checklist

1. Run a full GDPRChecker scan to inventory all cookies and trackers.
2. Document each tracker’s purpose, category, and necessity.
3. Enable HubSpot’s cookie consent banner with “Opt-in” mode.
4. Add a Spanish-language privacy policy link to the banner.
5. Configure script blocking for all non-essential tags (analytics, ads, social).
6. Implement Google Consent Mode v2 default settings.
7. Test the reject flow: verify no non-essential requests after rejection.
8. Set up consent logging (via CMP or custom integration).
9. Update your privacy policy with the complete cookie inventory.
10. Schedule monthly GDPRChecker scans to catch regressions.
11. Review and update the checklist whenever you add new HubSpot integrations.

FAQ

What is HubSpot CMS cookie compliance Spain privacy evidence and monitoring checklist? It is a practical verification framework for website owners using HubSpot CMS to ensure their cookie practices meet Spanish and EU GDPR requirements. It covers consent defaults, pre-consent request blocking, banner behavior, disclosure accuracy, evidence collection, and ongoing monitoring—all verifiable with GDPRChecker scans.

Do I need HubSpot CMS cookie compliance Spain privacy evidence and monitoring checklist for GDPR? Yes, if your HubSpot CMS site serves visitors in Spain. The AEPD enforces GDPR and expects documented evidence of compliant cookie practices. This checklist helps you systematically verify and prove compliance rather than relying on assumptions.

How do I implement HubSpot CMS cookie compliance Spain privacy evidence and monitoring checklist? Start with a GDPRChecker audit, configure HubSpot’s opt-in banner, block non-essential scripts before consent, integrate Google Consent Mode v2, test the reject flow, update your privacy policy, and set up consent logging. Follow the step-by-step guide above for detailed instructions.

How can I verify HubSpot CMS cookie compliance Spain privacy evidence and monitoring checklist with a scanner? Use GDPRChecker to run pre-consent, post-consent, and reject scans. Check for unauthorized network requests, missing policy links, and Consent Mode gaps. Regular scans after any site change provide ongoing monitoring evidence.

What are common HubSpot CMS cookie compliance Spain privacy evidence and monitoring checklist mistakes? Common mistakes include assuming HubSpot’s banner blocks scripts automatically, ignoring third-party embeds, lacking consent evidence, and not providing a Spanish-language banner. Each can lead to non-compliance and potential AEPD scrutiny.

Which cookies and trackers should I check for HubSpot CMS cookie compliance Spain privacy evidence and monitoring checklist? Check HubSpot’s own cookies, Google Analytics, Google Ads, social media embeds, and any custom scripts. GDPRChecker scans reveal all cookies and network requests, so you can build a complete inventory.

How often should I review HubSpot CMS cookie compliance Spain privacy evidence and monitoring checklist? Review at least monthly, and immediately after any HubSpot CMS update, new module addition, or integration change. Regular GDPRChecker scans should be part of your routine to catch regressions early.

What evidence should I keep for HubSpot CMS cookie compliance Spain privacy evidence and monitoring checklist? Keep your cookie inventory, consent logs (if available), GDPRChecker scan reports showing pre-consent blocking and post-consent behavior, and records of banner configuration and privacy policy updates. This documentation demonstrates your ongoing compliance efforts.

Next Steps for Ongoing Compliance

Cookie compliance is not a one-time project. Your HubSpot CMS site will evolve, and each change can introduce new tracking or break existing consent controls. Make GDPRChecker scans part of your deployment checklist. For deeper protection, consider upgrading to a paid plan that includes managed consent banner, runtime monitoring, and consent records—all designed to close the evidence gap without adding legal complexity.

For more practical guidance, explore our related guides:

• [GDPR checklist for small businesses](/guides/gdpr-checklist-for-small-businesses)
• [Google Analytics GDPR compliance](/guides/google-analytics-gdpr-compliance)
• [Consent Mode v2 vs Google Certified CMP](/guides/consent-mode-v2-vs-google-certified-cmp)
• [Do I need a CMP if I do not run Google Ads?](/guides/do-i-need-a-cmp-if-i-do-not-run-google-ads)
• [Cookie banner requirements](/guides/cookie-banner-requirements)
• [Privacy policy requirements](/guides/privacy-policy-requirements)

Start your verification today: run a free GDPRChecker scan on your HubSpot CMS site and see exactly where you stand.

Comparison: common implementation approaches

| Approach | Best for | Evidence to retain | Trade-off | | --- | --- | --- | --- | | A shared consent record | Smaller sites with one banner and a limited set of tags | Consent choice, timestamp, policy version, and affected pages | Requires a reliable process when the banner changes | | A tag-manager based record | Teams that control analytics and advertising tags centrally | Consent defaults, trigger conditions, publish history, and test results | Can miss scripts added outside the tag manager | | A CMP or external consent platform export | Sites with multiple domains, vendors, or regional workflows | Vendor configuration, consent events, retention settings, and audit exports | Adds provider configuration and recurring review work |

Choose the approach that matches the site's tracking complexity, then verify that the stored evidence can explain what a visitor saw and what tags were allowed at that time.

Practical examples

Example 1: A small ecommerce site

A shop changes its cookie banner wording before a seasonal campaign. The operator records the previous and new banner version, tests Reject all and Accept all, and stores screenshots plus the resulting network checks. That creates a clear before-and-after record without relying on memory.

Example 2: A B2B lead-generation site

A marketing team adds a form analytics tag through its tag manager. Before publishing, it documents the consent category, the tag trigger, the privacy notice update, and a test showing that the request does not fire after a visitor rejects optional cookies.

Example 3: A multi-page content site

An editor notices that a new embedded video adds a third-party request. The team scans the affected pages, compares the result with the last scan, updates the cookie disclosure if necessary, and keeps the scan report with the deployment reference.

Article schema

```json { "@context": "https://schema.org", "@type": "Article", "headline": "HubSpot CMS Cookie Compliance in Spain: Privacy Evidence and Monitoring Checklist", "description": "Practical guide to HubSpot CMS cookie compliance in Spain. Step-by-step implementation, evidence collection, and monitoring checklist. Verify with GDPRChecker scans.", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://www.gdprchecker.online/guides/hubspot-cms-cookie-compliance-in-spain-privacy-evidence-and-monitoring-checklist" }, "publisher": { "@type": "Organization", "name": "GDPRChecker", "url": "https://www.gdprchecker.online" } } ```

Copyright and editorial notice