Blocking the _ptq.gif tracking pixel from track.hubspot.com until consent is granted

[theAndreyK]

The __ptq.gif tracking pixel seems to break GDPR rules. It records anonymous activity which can later be linked to a speciifc user through a form submission. 

Ideally, that pixel would not be set until cookie banner consent is given. I'm not sure if the HubSpot cookie banner team is working on this or are considering it. 

Is there some other way to block the _ptq.gif? It seems to be loaded by the hs-analytics script. Would a content-security policy blocking "track.hubspot.com" work? Can someone please provide an example of that? It seems like that would lose anonymous data but that should be ok in theory and might be required in the future. 

At the very least, does HubSpot provide specific documentation around this tracking pixel? It would be great to reference it in our privacy or cookie policies. 

Related questions that touch on the issue: 

• https://community.hubspot.com/t5/GDPR/How-to-set-ptq-gif-tracking-pixel-only-after-visitor-has/m-p/4...
• https://community.hubspot.com/t5/Account-Settings/ptq-gif-Hubspot-Cookie/m-p/489239

[kennedyp]

Hi @theAndreyK! Thanks for bringing this up and linking those similar conversations. 

As noted in those previous replies, ptq.gifs are tracking pixels (not technically cookies) used to record analytics data such as page views and CTA clicks (i.e. tracking which URL was viewed, these do not capture any personal info).

The default way that HubSpot analytics tracking works is that when a visitor declines cookies via the banner, we do not set any analytics cookies in their browser however, a tracking pixel is still loaded which tracks an anonymous page view. This does not get saved in a visitor's browser and is not used to track any personal information.

HubSpot tracking code would not be able to fire without this pixel. That said, I provided some feedback to our documentation team to see if we could get a note about this on the Knowledge Base article linked in the posts you shared. 

Best, 
Kennedy 

[theAndreyK]

Hi @kennedyp. Thanks for all of the info. 

Can the anonymous data later be connected to a user after they submit a form? Is the situation different if they accept cookies and then submit a form? 

Scenario A: a user does not consent to cookies, they visit a few pages, and then submits a form. Is only the form data saved to their contact record? 

Scenario B: a user does not consent to cookies, visits a few pages, consents to cookies, and then fills out a form.  Is the form data and previous activity saved to their contact record?

Thanks again. I appreciate the help and clarity!

[kennedyp]

Hey @theAndreyK! Great questions. If the visitor declines cookies but fills out a form, the anonymized views will still never be associated with their record in HubSpot. The views/activity will only ever be associated with a record once they accept cookies. Let me know if that clarifies! 

Edited for accuracy

[theAndreyK]

@kennedyp Ok, just so that I'm 100% clear, anonoymous activity will be associated with a contact after they fill out a form even if they never accept cookies?

[kennedyp · Accepted solution]

Hey @theAndreyK-- my apologies, I see how my wording was incorrect above. I will edit that post. 

If a visitor converts into a contact but does not accept cookies, you will not see any activities such as page views on their record. So anonymous activity will not be associated with a contact after they fill out a form even if they never accept cookies. Unless the contact clicks a link in a tracked marketing email which directs to a page with the HubSpot tracking code installed-- this singular page view would appear on their record.