What This Update Actually Is
HubSpot shipped a redesigned "Privacy and Consent" section inside the new Forms editor (v2). It replaces the previous single-block consent area with two clearly labeled, independently manageable controls.
The first control covers communication consent: permission to send marketing emails and communications. The second covers legal basis for data processing: the lawful justification for storing and using a contact's data. You can now configure, hide, or delete each one on its own timeline, with its own language, tied to its own subscription preferences.
This update ships to all hubs and all tiers. Conditional logic for the "Store and process data" and "Privacy policy" fields requires Marketing Hub or Content Hub Professional or Enterprise.
Why HubSpot Shipped This
The old Forms consent block treated legal basis and marketing consent as one thing. For teams operating in a single region with a single regulation, that was fine. For everyone else, it was a compliance headache wrapped in a UX puzzle.
Here's the honest problem: GDPR requires explicit consent for data processing. CASL requires explicit consent for commercial messages. CAN-SPAM and APAC frameworks each carry their own wrinkles. When your form smashes those requirements into one checkbox, you're either over-collecting or under-disclosing. Both create risk.
We've seen this pattern repeatedly when auditing portals: the consent language is vague, the checkboxes are mislinked to subscription types, and nobody on the team is confident the form is actually compliant. This update gives the humans building and approving forms a clear, defensible structure to work from.
How to Use It Step by Step
- Open any form in the new Forms editor (v2). Navigate to the "Privacy and Consent" section in the primary left-hand navigation.
- Locate the two distinct panels: "Communication Consent" and "Legal Basis for Data Processing." Each has its own visibility toggle, text editor, and configuration options.
- For the Communication Consent panel: select one or more subscription types (tags) to associate with this form. This step is required for marketing consent to function correctly. Edit the consent language to match your use case and region.
- For the Legal Basis panel: if GDPR is enabled in your portal, explicit consent checkboxes appear by default for both data privacy and marketing communication. You can customize the text, hide, or delete either checkbox independently.
- If your portal is non-GDPR: forms display permission-to-communicate text by default. You still get full flexibility to hide, configure, or remove consent elements and edit the language inline.
- On Marketing Hub or Content Hub Professional or Enterprise: use conditional logic to show or hide the "Store and process data" or "Privacy policy" fields based on how a contact answers other form questions. This is powerful for multi-step forms where consent context changes.
- Publish and verify: preview the form in both GDPR and non-GDPR modes if your audience spans regions. Confirm subscription tags are correctly assigned before going live.
What It Touches in Your HubSpot Strategy
This isn't just a form UI change. It ripples into several layers of how your portal captures and handles contact data.
Subscription management: because marketing consent is now tied directly to specific subscription tags at the form level, your opt-in data becomes cleaner and more segmentable. That matters when you're building lists for email campaigns or auditing who should and shouldn't receive commercial messages. If you're already thinking carefully about which contacts qualify for marketing sends, this connects directly to how HubSpot counts and manages marketing contacts versus non-marketing contacts inside your portal.
Contact records: consent data captured through the updated form flows into the contact record's communication and legal basis properties. This makes your contact timeline a more accurate audit trail, which matters if you ever need to demonstrate compliance.
Key Takeaway
Separating legal basis from marketing consent means your contact records now carry two distinct, defensible data points instead of one ambiguous checkbox. That's not a minor UX tweak. It's a structural improvement to your compliance posture.
Workflows and automation: if you use enrollment triggers based on consent or subscription status, cleaner consent data means more precise triggers. Fewer false enrollments. Fewer contacts receiving emails they didn't actually opt into.
Email marketing health: sloppy consent collection is one of the fastest ways to hurt your sender reputation. Building an email list that converts without spamming starts at the form level, and this update gives you a more precise foundation to build from.
Multi-hub impact: this update is available across all hubs and tiers, but the conditional logic feature unlocks on Marketing Hub or Content Hub Professional and Enterprise. If you're running content-driven lead generation through landing pages or embedded forms, both hubs benefit directly.
Key Takeaway
If your team operates across regions, map your consent requirements by regulation before touching the form editor. Know which regions need explicit data processing consent versus permission-to-communicate, then configure each form's two panels accordingly.
Who Should Care Most
This update lands differently depending on your situation. Here's who should prioritize reviewing their forms immediately:
- Marketing ops and demand gen leads at companies with audiences in the EU, Canada, or APAC regions, where multi-regulation compliance is non-negotiable and the old single-block approach created real legal exposure.
- HubSpot admins who manage GDPR settings and have heard complaints that the consent UI was confusing for form builders or impossible to explain to legal teams.
- RevOps leads who care about contact data quality, because cleaner consent tied to specific subscription types means better segmentation and fewer compliance-driven list scrubs.
- Business owners at growing companies who've been told by legal or a consultant that their forms need work but didn't know where HubSpot gave them the controls to fix it.
- Any team using conditional logic in forms today who wants to layer in privacy-field logic for multi-step or persona-specific lead capture flows.
George's Take
I'll be direct: consent management is one of those areas where most portals are quietly broken and nobody wants to be the person who flags it. I've been inside portals where the GDPR toggle is on, the forms are technically showing a checkbox, but the language is generic, the subscription tags are wrong, and nobody could tell you with confidence what that checkbox actually commits the company to. This update gives the humans responsible for those forms a clear, honest structure to work from. Two controls. Two purposes. No more guessing which checkbox covers which obligation.
“Consent isn't a checkbox problem. It's a clarity problem. And HubSpot just gave you a much better tool to get clear.”
If your portal has GDPR enabled and you haven't audited your forms since this shipped, that's the first task for this week. If you need help mapping your consent requirements across regions and rebuilding your forms to match, that's exactly the kind of work our team does. Book a strategy call with Sidekick Strategies and we'll walk through your portal's consent setup and show you where the gaps are.
Frequently Asked Questions
What is the difference between legal basis for data processing and marketing consent in HubSpot Forms?
Legal basis for data processing is the lawful justification for storing and using a contact's information, required under GDPR. Marketing consent is permission to send commercial messages, required under regulations like CASL. HubSpot Forms now manages these as two separate controls so you can configure each one independently to meet the specific regulation that applies to your audience.
Does this HubSpot Forms consent update apply to all plans?
Yes. The separate legal basis and marketing consent controls are available to all hubs and all tiers, including free. The one exception is conditional logic for privacy fields, which requires Marketing Hub or Content Hub Professional or Enterprise.
Do I need to update my existing HubSpot forms after this change?
Existing forms won't break, but you should audit them. Open each form in the new v2 editor, check that subscription tags are correctly assigned to the communication consent section, and confirm the consent language accurately reflects your legal obligations by region. Teams with GDPR enabled should prioritize this review immediately.
How does separating consent affect my HubSpot contact records?
Each control writes to a distinct property on the contact record. Communication consent updates subscription status tied to the tags you've selected. Legal basis data is recorded separately. This gives you a cleaner, more auditable trail and makes it easier to demonstrate compliance if your data handling is ever questioned.
Can I use conditional logic to show consent fields only to certain contacts?
Yes, on Marketing Hub or Content Hub Professional or Enterprise. You can show or hide the "Store and process data" and "Privacy policy" fields based on how a contact answers other questions in the form. This is useful for multi-step forms or forms that serve audiences in different regions with different consent requirements.
What regulations does the new HubSpot Forms consent setup help with?
The redesigned Privacy and Consent section is built to support GDPR (EU), CASL (Canada), CAN-SPAM (US), and APAC regional requirements. It doesn't replace legal counsel, but it gives you the structural controls to configure your forms to match what each regulation requires from your consent collection process.
