Free account
CIPA § 631 Risk

Is HubSpot Tracking legal in California?

Marketing Automation / Tracking · Updated 2026

The HubSpot tracking script profiles visitors across pages and forms for marketing automation. Using it is perfectly legal — but running HubSpot Tracking before a visitor consents is what creates exposure under California's wiretapping law.

Is this tracker on your site? Find out free in 30 seconds.

Real browser scan with evidence capture. No signup required to see results.

Why HubSpot Tracking can trigger CIPA claims

California's Invasion of Privacy Act (CIPA), Penal Code § 631, prohibits intercepting communications without all-party consent. Since 2022, a wave of plaintiff-firm litigation has applied this decades-old wiretapping statute to website session-replay, chat, and pixel tools — arguing that capturing a visitor's clicks, keystrokes, and form input without consent is an unlawful interception. The HubSpot tracking script profiles visitors across pages and forms; firing before consent contributes to CIPA/CCPA exposure.

Statutory damages run up to $5,000 per violation, and plaintiffs argue each affected visitor session is a separate count — which is why even small sites receive demand letters.

Real-world enforcement

In a landmark action, the California Attorney General reached a $1.2M settlement with Sephora over its use of tracking technologies without honoring consumer privacy choices. Private CIPA suits over session-replay and chat tools have named retailers, healthcare providers, and SaaS companies alike. The common thread: trackers firing before the visitor had any chance to opt out.

How to make HubSpot Tracking compliant

  1. Enable HubSpot's built-in consent banner OR gate the tracking code (js.hs-scripts.com) behind your own CMP.
  2. Use the HubSpot consent API: _hsp.push(['doNotTrack']) by default, then revoke after opt-in.
  3. Re-scan with 'Verify fix' to confirm no requests reach hs-scripts.com / hscollectedforms.net pre-consent.

Consent-gating snippet

var _hsp = window._hsp = window._hsp || [];
_hsp.push(['doNotTrack']);                       // suppress until consent
// After the visitor accepts:
cmp.onConsent('analytics', () => _hsp.push(['revokeCookieConsent']) /* re-enables */);

Prefer HubSpot's native consent banner (Settings → Privacy & Consent) if you don't already run a CMP.

HubSpot Tracking's official privacy/consent documentation →

Check your own site

RegSentry runs a real browser against your site, watches exactly when HubSpot Tracking (and every other tracker) first contacts a third-party server, and captures the evidence — including whether it intercepts keystrokes typed into your forms.

Is this tracker on your site? Find out free in 30 seconds.

Real browser scan with evidence capture. No signup required to see results.

← See all tracker compliance guides