HubSpot Cookie Banner with GTM, GA4, and Clarity: Tracking That Respects Consent

Adding Google Tag Manager, GA4, and Microsoft Clarity to a HubSpot site is easy: paste a script here, another there, and the data starts showing up. The problem is that "easy" and "right" are different things when the subject is privacy. Tracking the visitor before they consent is not a technical detail, it is a GDPR violation waiting to happen.

The good news is that you can measure everything you need while respecting consent, and HubSpot already brings the pieces for it. In this guide, I will show how to wire the native HubSpot cookie banner to Google's consent mode, configure GA4 and Clarity through GTM, and get the script order right, so no analytics tag fires before the visitor's acceptance.

The native banner and the consent policy

HubSpot has a native cookie banner, configurable in the portal's privacy options. For consent mode to work in the EEA, EU, and UK, it has to be the opt-in banner, the one that asks for permission before collecting, not the opt-out or notify-only variants. It classifies cookies into categories, like necessary, analytics, and advertising, and records each visitor's choice. That record is the basis of the whole strategy: it is the consent signal your tracking scripts need to read and respect before collecting anything.

Many people's mistake is treating the banner as a compliance ornament, something you put on the page to look adequate, without linking the visitor's choice to the tags' real behavior. A banner that records consent but does not prevent unauthorized tracking protects no one. The banner only does its job when it is actually connected to the firing of the tags.

Consent mode: track only with permission

Consent mode is the mechanism that makes GA4 and the other Google tags behave according to the visitor's consent. Before acceptance, the tags run in a restricted mode, without personal cookies, collecting at most anonymous, aggregated data. After acceptance of the analytics category, they measure normally, with the cookies they need.

The orchestrator of all this is Google Tag Manager. It is what reads the consent state, set by the HubSpot banner, and releases or holds each tag according to the category the visitor authorized. That centralized orchestration is what makes the setup manageable: instead of spreading consent logic across several loose scripts, you concentrate everything in GTM.

On a HubSpot-hosted site, you do not have to wire this by hand. You turn consent mode on natively by integrating GA4 with its Measurement ID, which gives you the advanced consent mode, or GTM with its GTM ID, which gives you the basic one, straight from the HubSpot account, and HubSpot connects the banner's choice to Google's consent state for you. The advanced mode is worth knowing about, because it models part of the data lost before consent, while the basic one simply holds the tags. The manual choreography of script order below is what you need when the site is external, when the GTM or GA setup is custom, or when the banner is not HubSpot's.

Script order matters (a lot)

The detail that makes the difference between a compliant setup and a flawed one is the order in which things load. If an analytics tag loads before the consent layer, it has already collected data without permission, and the damage is done, regardless of what the banner shows afterward. The correct sequence is precise and cannot be improvised.

1. Load the consent layer first, so the default state is restricted, with no personal tracking.
2. Load GTM, which will read that consent state.
3. Configure GA4 and Clarity as tags inside GTM, fired only when the matching category is consented.
4. Update the consent state the moment the visitor accepts or declines in the HubSpot banner.

Clarity and analytics consent

Microsoft Clarity records sessions and generates heatmaps, which means it collects detailed visitor behavior. So it belongs in the analytics category, the same one as GA4. One precision, though: Clarity is a Microsoft tool, so it is not governed by Google's consent mode the way GA4 is. You gate it yourself, with a GTM trigger that checks the analytics consent state and fires the Clarity tag only once that category was accepted, never before. The end result is the same, the how is just different.

Forgetting Clarity in this logic is a common slip, because it is usually added later, as an extra tool, and ends up pasted loose in the theme without going through consent mode. The result is a tool recording the screen of someone who did not authorize it, which is exactly the kind of violation the banner was supposed to prevent. Treat Clarity with the same rigor as GA4.

GDPR in practice

Privacy laws essentially ask for the same baseline when it comes to tracking: informed consent before collecting, a clear option to decline as easy as the one to accept, and a record of the visitor's choice. You do not need to be a lawyer to meet these principles, but the technical setup does need to actually respect them.

The native HubSpot banner plus consent mode orchestrated by GTM meet these requirements when the script order is right and no analytics tag fires before acceptance. Compliance, in the end, is not a matter of having a pretty banner, it is a matter of the tags' real behavior matching what the visitor authorized. That is what an audit will check.

Why this matters for your operation

Well-configured tracking is what gives marketing reliable data without exposing the company to legal risk. You measure the visitor's journey, understand what converts, optimize campaigns, all based on those who consented, within the law. It is the best of both worlds: data intelligence and compliance moving together, instead of one getting in the other's way.

A flawed setup, on the contrary, puts the company in a fragile position. Collecting data without consent can lead to fines and, worse, reputational harm, at a time when privacy has become a value customers demand. Investing in getting tracking right is not just compliance, it is protecting the brand and building the trust that sustains the customer relationship.

In practice: the site that tracked before acceptance

A company had a nice cookie banner on the page, but on testing it turned out that GA4 and Clarity fired the moment the page loaded, long before the visitor clicked anything in the banner. In practice, the banner was decorative: it recorded the choice but prevented nothing. Every visitor was tracked without consent, a direct privacy risk.

The fix was to reorganize the setup with consent mode: the GA4 and Clarity tags came to be fired through GTM only after analytics consent, and the consent layer was set to load first, with a restricted default state. After the adjustment, no tracking cookie was born before acceptance. The same banner, now actually connected to the behavior, came to protect the company instead of just appearing to.

Checklist of compliant tracking

1. Is the HubSpot opt-in banner configured and classifying cookies by category?
2. Does the consent layer load first, with a restricted default state?
3. Are GA4 and Clarity fired through GTM, and not pasted loose in the theme?
4. Do analytics tags fire only after consent of the matching category?
5. Does Clarity get the same consent treatment as GA4?
6. Did you test in the browser that no tracking cookie is born before acceptance?

Frequently asked questions

Does the HubSpot banner alone guarantee compliance?

No. It records the visitor's choice, but you still need to ensure GA4, Clarity, and other tags only run after consent. That is done with consent mode orchestrated by GTM.

Where do I configure GA4 and Clarity, in HubSpot or in GTM?

The most controllable path is configuring them as tags in GTM, fired according to the consent state, instead of pasting loose scripts in the theme, where it is hard to control when they run.

What happens if an analytics tag fires before acceptance?

You start collecting data without consent, which violates privacy laws like GDPR. That is why script order and consent triggers in GTM are essential.

Does Clarity need consent?

Yes. Clarity records sessions and heatmaps, collecting detailed behavior, so it falls under the analytics category. Fire it through GTM only after analytics consent, just like GA4.

How do I test whether my setup is compliant?

Use the browser's developer tools to check, before and after accepting cookies, whether any analytics tag fires or any tracking cookie is born before acceptance. The real behavior is what counts, not the banner's appearance.

Does consent mode reduce my data?

Before acceptance, yes, tags run in restricted mode with anonymous data. After analytics consent, they measure normally. You fully measure those who consented, which is exactly what the law allows.

Want tracking that measures everything it can while respecting visitor consent? At Insight Sales we configure the banner, consent mode, and tags in HubSpot the right way, in line with privacy law. Talk to our team and find out how we can help.