Creating a custom cookie consent bar

[gweaver]

My problem is that I'm making a custom cookie consent bar that I can have more control over.

It seems huybspot only allows me to check the current consent status of a users hubspot cookies using:

_hsq.push(['addPrivacyConsentListener', function(consent) {
  console.log(consent.allowed)
}]);

or remove cookies all together using:

_hsq.push(['revokeCookieConsent']);

or I can set do not track

_hsq.push(['doNotTrack']);

Do not track is no the same as setting _hs_opt_out. I'd like to be able to set privacy consent by firing a method from a button click. Something like:

_hsq.push('privacyConsent', { consent: false })

Is this something that's in the pipeline? I'd rather not design a really nice looking site and be forced to use the hubspot cookie consent bar that doesn't look great.

[Julix]

@gweaver have you tried just setting the `__hs_opt_out` cookie via JavaScript after `revokeCookieConsent` and then reloading to test if all the cookies come back? - I'd be interested in seeing if that works...

That would at least be enough for opt out (though not that useful for opt in)

[thompsonsj]

I've tried this and unfortunately, the cookies come back.

[LPM]

I actually tried it but I couldn't get the js to store the same cookie:

document.getElementById("optOut").onclick = function() {
    _hsq.push(['revokeCookieConsent']);
    d =  new Date('{{ local_dt|datetimeformat('%d %b %Y %H:%M:%S') }}');
    d.setMonth(d.getMonth() + 13);
    document.cookie = "__hs_opt_out=yes; expires=" + d.toUTCString() + ";domain='hs-sites.com'";
    _hsq.push(['addPrivacyConsentListener', function(consent) {
      console.log(consent)
    }]);
  };

For some reason, the cookie can't be set if I specify the domain to be hs-site.com. I'm not too familiar with cookies in js so I can't really tell the limitations, but if I create a cookie with __hs_opt_out=yes without specifying a domain, the consent actually returns false. However, the issue then would be a repeat of the same cookie if HS sets one.

I've also experimented with setting the cookie to  __hs_opt_out=no after the fact, and it will still show the consent banner on reload (presumably due to all the other cookies not being present), and once the user consents/declines, it will create another copy of the __hs_opt_out cookie due to the difference in domains.

Seems there's no real way to do this without an option to manually set "Consent".

[IsaacTakushi]

Hi, @Julix.

I'll try to address each of your questions below:

"Am I correct in assuming [the WP HubSpot plugin is] essentially the same as including the HubSpot tracking codes manually with the advantage of it always being the most up to date tracking code if that ever changes? "

Yes, that is correct.

"I get the _hs_opt_out cookie after rejecting hs, but I still get an id as well... why?"

Are you referring to the __cfduid or __cfruid values? Those are cookies are set by HubSpot's CDN provider.

"Why isn't there an opt-in cookie?"

I can't speak to that decision, but the core tracking cookies __hstc, hubspotutk, __hssc,  and __hssrc are only set if consent is explicitly granted, per this screen recording.

You're probably already aware of it, but you can also set the __hs_do_not_track cookie, which prevents all information from being collected by the tracking code.

[Julix]

Oh! CF is cloudfare or cloudfront or one of those - that makes sense.

Thanks for your help!

[IsaacTakushi · Accepted solution]

Welcome, @gweaver.

Thanks so much for joining the discussion!

While there currently isn't anything like this in the pipeline, we have heard requests for more granular methods to control cookies. I'll be sharing your feedback internally (CC @Derek_Gervais, @lscanlan, and @cbarley).

That said, if you don't like the appearance of the default cookie consent banner, these threads outline ways to customize it:

• HOW TO: Customize Your Privacy Policy Banner
• Consent Banner Customization

[MTicudean]

Hello Isaac,

Is there any update on this topic?

We would like to use our own custom cookie banner and be able to granularly set necessary/functionality/analytics cookies for Hubspot, based on user's choices.

I should mention that we do not host our website with Hubspot, we just added the HS tracking script using GTM.

Any information is much appreciated, as we've been trying to find something in the documentation about this to no avail.

Thank you!

[thompsonsj]

At the very least, you could choose whether or not to load the tag containing the HS tracking script based on whether or not the user has consented to cookies.

If you are not using chatflows or any of the advertising integrations in HubSpot, then this might actually be sufficient. This is because HubSpot would only set 'analytics' cookies, and you can prevent the script from loading if your consent solution prevents analytics/performance cookies. Chances are, you are managing ad tracking through GTM anyway.

Having said all that, I'd really like to see some functions added to the Events API to have more granular control over consent because the above has its limitations.

[tstuserplzignor]

+1.. I would also like programatic control over this.

[Julix]

Any updates on this?

I was looking into using a popular Cookie Notice WordPress plugin - but it has no way of wrapping the HubSpot code (since that's included via as a plugin as well).

I'd like to programmatically tell HubSpot when consent was given and to please start loading all the tracking etc. 

Currently it looks like my options are give up HubSpot WP plugin (and pull in the snippets manually where needed wrapped with Cookie Notice plugin) - or to use the HubSpot consent event and basically write up a custom solution in place of the CN plugin.

Or really hacky, use both (one invisible somehow) and a JS listener to click on both when one is clicked? 

I mean the HubSpot cookie notice must communicate with HubSpot somehow, just want to do the same...

[IsaacTakushi]

Thanks for posting, @Julix.

At this time, it is not possible to programmatically set HubSpot cookie consent values. You've already identified the two options I usually describe in these scenarios.

Are you referring to this Cookie Notice WordPress plugin? Which functionality are you most interested in emulating?

[Julix]

Yes, that's the plugin I was talking about.

Basically I just want to wrap all tracking code in one check.

if ( function_exists(‘cn_cookies_accepted’) && cn_cookies_accepted() ) {
  // Your third-party non functional code here
}

The WP HubSpot plugin is a tad vague on what value it actually provides. Am I correct in assuming it's essentially the same as including the HubSpot tracking codes manually with the advantage of it always being the most up to date tracking code if that ever changes? 

I did try the HubSpot way 

_hsq.push(['addPrivacyConsentListener', function(consent) {
   console.log(consent.allowed);
}]);

But was getting a false positive (i.e. it returned true while opt in was required and consent had not been given yet). - Note that's on the preview `/#_hsPrivacyTest`. - Somehow it doesn't show up properly on staging.*

The HubSpot cookie notice code does programmatically set HubSpot cookie consent values; just minified and wrapped in an IIFE (immediately invoked function expression for scope), so it's not exposed for other devs to use... 

* Update: Got the staging to work finally. Guess it was an issue with "all, even unpublished, policies apply" - so there wasn't a way to turn off the default one - only could set it to not send cookies by default. Had tried that before but didn't wait long enough for it to show.

in anonymous browser
In anon browser I get the _hs_opt_out cookie after rejecting hs, but I still get an id as well... why?

Also why isn't there an opt-in cookie?  If I want to use this server side I can't. Cause the opt lack of opt out cookie doesn't mean consent (since they could just not have answered at all yet). Frustrating.

[gweaver]

Hi,

Thanks for this, yeah it would be really useful to provide methods to be able to replicate exactly what the built in hubspot consent bar does. A method to check if consent has been set and then a method to set consent to true or false.

This would be much more useful for developers like me using frameworks building SPAs.

Another reason other than for design purposes would be that it allows me to neatly use one bar to control both Google Analytics consent and Hubspot consent with one button click.

[IsaacTakushi]

Totally agree, @gweaver. Thanks for the additional context!