Pitfall 1: Undisclosed Email Tracking
The mistake: Teams deploy HubSpot's email tool (e.g., sales sequences or marketing campaigns) without updating their privacy notice or consent disclosures to cover email open/click tracking.
Why it happens with HubSpot: Email tracking is invisible to the recipient—there is no user interface warning that opens and clicks are monitored. Compliance teams often focus on the website cookie banner but overlook that HubSpot's email tracking pixels are a *separate* data flow requiring *separate* disclosure and, in many jurisdictions, consent.
Consequence: GDPR violation of Article 13 (failure to provide pre-collection transparency). CCPA violation of Section 1798.100(b) (missing required privacy notice disclosures). Regulators (e.g., UK ICO, Irish DPC) treat undisclosed email tracking as high-severity because it involves inference of behavior (read status) without knowledge. Potential fines and mandatory disable of email tracking until remedied.
Pitfall 2: Misconfigured Consent Categories
The mistake: Cookie banners accept 'Analytics' consent but route HubSpot's __hstc and hubspotutk cookies (which HubSpot classifies as marketing cookies for visitor identification and re-targeting) into the analytics category instead of marketing. This creates a consent-category mismatch.
Why it happens with HubSpot: HubSpot documentation groups cookies by purpose (session, visitor ID, marketing) rather than by consent category (analytics vs. marketing). Operators misread "analytics tracking" in HubSpot's cookie descriptions and assume consent for 'analytics' is sufficient.
Consequence: GDPR Article 7(4) violation: marketing cookies require separate, affirmative consent. Auditors flag the mismatch immediately. If a user consents only to analytics, HubSpot's visitor-identity and re-targeting cookies should be blocked. Failure to block results in processing without lawful basis under Article 6.
Pitfall 3: Missing DPA with HubSpot Inc.
The mistake: Operators add HubSpot without signing a Data Processing Addendum (DPA). HubSpot is a data processor (you control *how* it's used; HubSpot processes data on your instructions), so a DPA is legally required under GDPR and CCPA.
Why it happens with HubSpot: HubSpot's standard Terms of Service include processor terms, but teams assume this is sufficient and don't request or review HubSpot's DPA. Smaller teams skip the formal procurement step.
Consequence: GDPR Article 28(3) violation: no documented processor agreement. If audited, regulators view this as a critical gap. Even if HubSpot's terms are adequate, the absence of a signed, specific DPA is itself non-compliant. CCPA Section 1798.140(w) also requires processors to certify they understand CCPA restrictions. Without a DPA, you cannot legally claim HubSpot is a processor under CCPA.
