Hi everyone - I’m hoping to get a second opinion on a HubSpot/GTM tracking setup, mainly from a privacy point of view.
We have an external donation platform called ThankQ loaded on our HubSpot site via an iframe.
The setup is:
→ Child GTM container sends donation data to parent GTM container
→ Parent GTM container sends donation event to HubSpot and GA4
→ Server-side GTM receives the GA4 purchase event and handles ad conversion tracking
The issue is HubSpot is receiving the donation event and transaction ID, but it doesn’t always connect the donation event to an existing HubSpot contact. We think it’s because HubSpot receives the donation event before receiving an email identifier for the donor.
We found HubSpot’s identify method here: Identify a visitor - HubSpot docs
We’re working on a proper API integration between HubSpot and ThankQ but we’re not sure how long that will take. In the meantime, we’ve tested a GTM workaround.
The workaround is:
1. Child GTM container captures donor details (email, first name, and last name) from the donation form.
2. Those details are stored temporarily in sessionStorage.
3. The child GTM container sends the details to the parent listener.
4. The parent GTM container has a custom HTML event listener which uses the details only for HubSpot’s identify method.
5. Before pushing the event into the parent dataLayer, the parent listener removes donor details.
6. GA4, server-side GTM, and ad conversion tags then only receives the cleaned donation event, without personal details.
So the intended flow is:
Child iframe captures donor details
→ Parent listener receives donor details
→ Parent listener sends donor details to HubSpot identify
→ Parent listener removes donor details
→ Clean donation event enters parent dataLayer
→ GA4/server-side ads receive only non-personal donation data
We’ve tested this and I can see the donor details in the child container but they’re not appearing in the parent dataLayer. The parent dataLayer only receives the cleaned donation event.
So, in short: we’re using email/name only for HubSpot contact matching and not sending those personal details to GA4 or ad conversion tags.
Has anyone used this kind of setup before? Do you see any issues with it from a HubSpot tracking, GTM, or privacy point of view?

