Third-party Cookies Ban

[PHerreroMKT]

Hello, We've recently encountered a warning message from Chrome on our website, indicating that the following cookies will be blocked: 

_cfuvid .hsforms.com
hubspotapi-prefs .hubspot.com
_hjSessionUser_XXXXXX .hubspot.com
_hjSessionUser_XXXXX .hubspot.com
_hjSessionUser_XXXXXXX .hubspot.com
hubspotapi-csrf .hubspot.com
csrf.app .hubspot.com
_hjSessionUser_XXXXXX .hubspot.com
_cfuvid .hubspot.com
__cf_bm .hubspot.com
hubspotapi .hubspot.com

This prompts us to question whether HubSpot cookies are first-party or third-party, as Google Chrome will soon block third-party cookies (starting this month).

Cookies with the SameSite=None; Secure and not Partitioned attributes that operate in cross-site contexts are third-party cookies. In future Chrome versions, reading third-party cookies will be blocked. This behavior aims to protect user data from cross-site tracking.

Hence, we're concerned about the implications in various scenarios:

• Pages hosted on HubSpot with HubSpot cookie windows.
• Pages hosted on HubSpot with non-HubSpot cookie windows.
• External pages to HubSpot with HubSpot cookie windows.
• External pages to HubSpot with non-HubSpot cookie windows.

Is anyone else facing similar challenges?

Thank you for your ongoing support.

[trevordjones · Accepted solution]

Hi @PHerreroMKT ,

I recommend using Google Tag manager to connect HubSpot to GA4 and Google Ads using Custom HTML tags.  Doing so will help Google Understand that your HubSpot cookies are first-party. It will also get you a more accurate count of conversions in GA4 and Google Ads.

I cover the process for doing that in this thread.

Depending upon how you are deploying your HubSpot tracking code, you might also want to consider using Tag Manager to install it.  This won't apply if you are using the HubSpot CMS, but it could be done on WordPress if you aren't using the HubSpot plugin for that.

[TomM2 · Accepted solution]

Hey @PHerreroMKT I'm not sure I entirely understand the situation you're explaining, my apologies! 

When you say your clients who have you registered as a contact in HubSpot, do they have you registered as a user in their HubSpot account? 

If you mean a contact specifically, the only way your browser would be registered as a contact in HubSpot would be if you filled out a HubSpot form on that website, on that specific browser. There's no way for someone to register your browser within their HubSpot account "on behalf" of you. So even if you haven't submit a form, and are a contact in their portal, your browser would not be known. 

Does your customer have HubSpot chat/conversations enabled on their site? From what I'm seeing I can only trigger the HubSpotapi-prefs cookie when a chatbot is enabled on the site. Since the chatbot is a widget that embeds a specific HubSpot url on the page it wouldn't be a first party source, so I would imagine this would be deemded a third party widget. 

[PJohnstone]

Hi All,

Has anyone found a solution to this issue?

I've noticed that the __cf_bm and _cfuvid cookies appear in the PageSpeed Insights report under "Best Practices" for WordPress sites using the HubSpot plugin. I understand these cookies are related to the HubSpot chatbot functionality.

Any recommendations on how to address this?

Thanks!

[radapop · Accepted solution]

Hi everyone! My name is Rada and I'm a product manager at HubSpot. Thanks for the discussion on this thread

The warnings about HubSpot cookies in Chrome concern login functionality and are under active resolution. In the meantime, the deprecation of third-party cookies is not expected to affect the performance of HubSpot's tools. Timely updates will be provided should any action become required

[222support]

Hi, 

Any update on this?

We are solely using HubSpot Chatbot and can see that __cf_bm and _cfuvid coming from HubSpot are recognised as third-party cookies in Google Privacy Sandbox. Hubspot Script is set as custom HTML in Google Tag Manager.

[clopeza]

Hi,

Have you had any luck with this? I'm running into the same issue and I'd like to improve my PageSpeed score.

[trevordjones · Accepted solution]

Hi @PHerreroMKT ,

I recommend using Google Tag manager to connect HubSpot to GA4 and Google Ads using Custom HTML tags.  Doing so will help Google Understand that your HubSpot cookies are first-party. It will also get you a more accurate count of conversions in GA4 and Google Ads.

I cover the process for doing that in this thread.

Depending upon how you are deploying your HubSpot tracking code, you might also want to consider using Tag Manager to install it.  This won't apply if you are using the HubSpot CMS, but it could be done on WordPress if you aren't using the HubSpot plugin for that.

[SSecosh]

Trevor - thank you. Finally a path to try.

The issue is with embedding HubSpot forms in multiple CMS.

Can anyone explain why HubSpot hasn't been more forward offering solutions themselves? We have seen this coming for a couple years. The threads are full of HubSpot evading the issue without offering any solution or path to explore. And instead often offering advice that you need a basic definition of cookies.

I can't even imaging the impact on conversions if we need to start requesting potential customers follow a how-to on managing cookie setting in their browser before communicating with us. So many of us have made the investment of trust in HubSpot. Why are there no webinars or detailed articles hitting this issue head on? It is wide spread.

Thank you Trevor - I appreciate something to try!

[danmoyle]

Thanks for sharing this @PHerreroMKT - good question indeed. I haven't personally seen these warnings (our site is 100% hosted in HubSpot) so I'm not sure about them. As I've always understood the definition, HubSpot cookies are first-party. But this does make me question it, for sure. 

Is your entire site in HubSpot? Or do you use HubSpot and another CMS like WordPress, using HS tools embedded? 

[PHerreroMKT]

Thank you very much for your response Dan.

We have indeed encountered this message on practically all the pages we work with, hosted on HubSpot and other CMS platforms, using both HubSpot and external cookie banners.

Furthermore, upon inspecting your website, the same warning message appears, as if it recognizes HubSpot API as third-party.

[TomM2]

Hey @PHerreroMKT do you see these same issues if you test on a fresh browser/private browser? 
The url parameters from your screenshots kinda make me think the cookies you're seeing warnings for are related to you being logged into the HubSpot portal that the website is built on. 

[PHerreroMKT]

Thanks for your message Tom! 

we did some testing in incognito mode, and indeed, the alert didn't appear. However, when I logged into my personal Gmail account and accessed the website of clients who have me registered as a contact on HubSpot, the alert did appear.

(In this case is an external website)

[TomM2 · Accepted solution]

Hey @PHerreroMKT I'm not sure I entirely understand the situation you're explaining, my apologies! 

When you say your clients who have you registered as a contact in HubSpot, do they have you registered as a user in their HubSpot account? 

If you mean a contact specifically, the only way your browser would be registered as a contact in HubSpot would be if you filled out a HubSpot form on that website, on that specific browser. There's no way for someone to register your browser within their HubSpot account "on behalf" of you. So even if you haven't submit a form, and are a contact in their portal, your browser would not be known. 

Does your customer have HubSpot chat/conversations enabled on their site? From what I'm seeing I can only trigger the HubSpotapi-prefs cookie when a chatbot is enabled on the site. Since the chatbot is a widget that embeds a specific HubSpot url on the page it wouldn't be a first party source, so I would imagine this would be deemded a third party widget. 

[danmoyle]

Oh snap. Thanks for the heads up, @PHerreroMKT