HubSpot keeps attributing conversions after a visitor denies consent, and the numbers it reports will quietly stop matching everything else you measure.
Google Consent Mode v2 changed how Google’s own tags behave when consent is denied: they keep firing, but strip identifiers and send cookieless pings that Google models into estimated conversions. HubSpot has no equivalent mechanism. Its tracking code either runs and sets cookies or it does not run at all, and nothing in Consent Mode tells it what to do.
That mismatch is where the reporting goes wrong. This is the failure I see most often in audits, and it is invisible until someone asks why two systems disagree.
Consent Mode v2 Does Not Govern HubSpot
The most common misunderstanding is that Consent Mode is a site-wide consent system. It is not. It is a Google-specific signalling layer that adjusts the behavior of Google tags: Google Analytics, Google Ads, Floodlight.
Consent Mode sets a handful of flags, primarily analytics_storage, ad_storage, ad_user_data and ad_personalization. Google tags read those flags and change what they do. Third party tags read nothing unless you explicitly wire them to.
// Consent Mode defaults, before any consent decision
gtag('consent', 'default', {
ad_storage: 'denied',
ad_user_data: 'denied',
ad_personalization: 'denied',
analytics_storage: 'denied',
wait_for_update: 500,
});
HubSpot’s tracking code has no awareness of any of that. If it is on the page, it runs.
Where HubSpot Fits in the Consent Categories
HubSpot’s tracking code is not analytics in the narrow sense. It identifies individuals, builds contact timelines, ties anonymous sessions to known records on form submission, and feeds that into lead scoring and attribution reports.
That behavior puts it squarely in the categories that require consent under GDPR, alongside tools like ZoomInfo WebSights and Zoho SalesIQ. At minimum it belongs behind the same gate as ad_storage and ad_user_data, not behind a “strictly necessary” classification. I cover the full tag by tag breakdown in my guide to Consent Mode for Google Tag Manager.
The practical consequence: in a compliant setup, HubSpot tracking must be blocked entirely when consent is denied, because it has no degraded mode to fall back to.
The Hidden Attribution Problems
Once HubSpot is correctly gated, several things break in ways that do not announce themselves.
Original source becomes “Direct traffic”
HubSpot stamps original source on a contact the first time it sees them. If tracking was blocked on the visit where they arrived from a paid campaign, and they later return and convert after granting consent, HubSpot has no record of the first visit. The contact is attributed to direct traffic or to whatever the consented session looked like.
The campaign that actually generated the lead gets no credit, permanently, because original source is set once and does not backfill.
GA4 and HubSpot stop agreeing, in a specific direction
GA4 with Consent Mode v2 keeps receiving cookieless pings and models the gap, so its conversion totals stay roughly whole. HubSpot receives nothing at all from denied sessions.
The result is not random noise. HubSpot will consistently report fewer conversions than GA4, and the gap will be roughly the size of your consent denial rate. Teams routinely misread this as a tracking bug and go looking for a broken form.
Lead scoring silently skews
Page view history feeds lead scoring. Contacts who deny consent accumulate no page views, so they score lower than equally engaged contacts who accepted. Sales prioritization ends up shaped by a privacy preference rather than by buying intent.
Attribution reports understate entire regions
Consent denial rates are dramatically higher in the EU and UK than in the US. HubSpot’s multi touch attribution reports will therefore understate European campaign performance relative to American campaigns, comparing two numbers produced under completely different collection conditions. Budget decisions made on that comparison are being made on bad data.
What To Do About It
None of this is a reason to abandon consent gating. It is a reason to stop treating HubSpot’s numbers as directly comparable to Google’s.
- Gate HubSpot properly and know your denial rate. Block the tracking code when consent is denied, then measure what share of sessions that represents. That number is the size of your blind spot and it belongs on every attribution report.
- Stop comparing HubSpot totals to GA4 totals. One is modeled and one is truncated. Compare each to itself over time instead, which is the only valid trend either one supports.
- Capture original source server-side where you legitimately can. Campaign parameters present on a landing page URL can be persisted at form submission through the HubSpot Forms API without relying on the tracking cookie, which recovers attribution for the conversions that matter most.
- Segment reporting by region. Reporting EU and US performance separately keeps a consent rate difference from being misread as a performance difference.
- Audit what your CMP actually blocks. Many consent platforms are configured to manage Google tags well and leave third party tags running, which produces the opposite problem: a compliance exposure rather than a data gap.
The Broader Pattern
Consent Mode v2 was built by Google, for Google tags, and it does a reasonable job of preserving measurement inside that ecosystem. Every other vendor on your site is on its own, and most marketing stacks contain more non-Google tracking than Google tracking.
Getting this right means treating consent as an architectural concern across the whole stack rather than a banner you install, which is the work I do as a privacy and consent compliance consultant, usually alongside the analytics and tag management that has to keep reporting accurately once the gating is in place.
The first step is simply knowing your denial rate. Until you do, every attribution report you read is missing an unknown number of conversions, and no dashboard will tell you that on its own.