Facebook Pixel, HubSpot & Intercom: Managing Third-Party Cookie Consent (2026)

When you embed a third-party script — Meta Pixel, HubSpot tracking, Intercom, a YouTube video — you are not just adding a feature to your website. You are instructing your visitor's browser to execute code written and controlled by another company, which may set cookies, transmit identifiers to foreign servers, and create a data relationship that GDPR holds you partially responsible for.

The problem is not hypothetical. German and French regulators have fined companies specifically for third-party script consent failures. The Hungarian DPA issued a €92,000 fine in 2023 for a website embedding Meta Pixel without proper consent. Understanding what each script does — and how to block it — is not optional compliance hygiene; it is risk management.

Why Third-Party Scripts Are High-Risk

They fire before you expect. Unless actively blocked, third-party scripts execute as soon as the page loads — before any consent banner has been displayed, let alone accepted. A visitor who lands on your homepage and immediately clicks "reject" has already had the Meta Pixel fire in the background.

They set cookies you did not create. Third-party scripts set their own cookies on your domain (or theirs) using their own logic. You cannot predict exactly what a third-party script will set without testing, and vendors update their scripts without always notifying customers.

They transfer data to US processors. Meta Pixel sends data to Meta Platforms Inc in the United States. Google Tag Manager calls Google's servers. HubSpot tracking sends data to HubSpot Inc. Each of these transfers requires a valid legal mechanism under GDPR Chapter V — which today means the EU-US Data Privacy Framework (for DPF-certified companies) or Standard Contractual Clauses.

They create joint controller obligations. As confirmed in the CJEU Fashion ID case (C-40/17, 2019), embedding a third-party tracking script can make you a joint controller with the vendor for the data collection phase. This means you share legal responsibility for ensuring that collection is lawful.

The 5 Highest-Risk Third-Party Embeds

1. Meta Pixel (Facebook Pixel)

Sets _fbp (90-day persistent cookie), transmits page view events, visitor browser fingerprint, and potentially hashed email addresses (if you pass them) to Meta Platforms Inc. Requires marketing consent. Creates a joint controller relationship — use Meta's Business Terms Joint Controller Addendum.

2. Google Tag Manager

GTM itself is a container — low risk. The tags inside GTM are the risk. Common GTM configurations fire GA4, Meta Pixel, LinkedIn Insight Tag, and Google Ads conversion tags simultaneously. Without Consent Mode v2, all of these fire on every page load regardless of consent status.

3. HubSpot Tracking Code

Sets hubspotutk (180-day persistent cookie) for visitor identification and CRM lead tracking. Also sets __hstc, __hssc, and __hssrc for session tracking. All require marketing consent. HubSpot provides a cookie policy and DPA, but you must implement consent blocking — HubSpot does not block its own cookies by default.

4. Intercom Widget

The Intercom JavaScript widget sets intercom-id-* (9-month persistent cookie) and intercom-session-* (session cookie) on load. Even if the user never opens the chat widget, the cookies are set when the page loads. For anonymous visitors on marketing pages, this requires consent. For logged-in users using Intercom as a support tool they requested, strictly necessary arguments may apply — but this is context-dependent.

5. YouTube Embeds

Standard embeds (youtube.com) set advertising cookies before play. "Privacy Enhanced Mode" (youtube-nocookie.com) reduces pre-play cookies but does not eliminate tracking on playback. Full consent compliance requires a facade/placeholder that loads the embed only after consent and user interaction.

How to Block Each Script Correctly

Method 1: Consent Management Platform (CMP) Blocking Rules

Most CMPs (Cookiebot, OneTrust, Axeptio, Klaro) offer script blocking features: they replace <script> tags with <script type="text/plain"> and add a data-cookiecategory attribute. The CMP's JavaScript then re-enables and executes the script when the user consents to the relevant category.

Example for Meta Pixel:

<script type="text/plain" data-cookiecategory="marketing">
  !function(f,b,e,v,n,t,s){...}  // Meta Pixel code
</script>

Method 2: Google Tag Manager Consent Mode v2

GTM Consent Mode v2 allows GA4 and other Google tags to respect consent signals without being completely blocked. Configure it as follows:

1. Add the Consent Initialisation trigger with default consent states set to denied for all storage types
2. Map your CMP's consent signals to GTM's consent types (analytics_storage, ad_storage, ad_user_data, ad_personalization)
3. Configure each tag's Consent Settings to require the relevant consent type before firing
4. For non-Google tags (Meta Pixel, HubSpot), use GTM's "Tag Firing Options" > "Once per event" and add a custom consent check trigger

Method 3: Server-Side Script Loading

For high-risk embeds, route the script through your own server-side proxy rather than loading it directly from the vendor's CDN. This prevents the third-party server from receiving the visitor's IP address directly and allows you to strip identifiers before forwarding data. Requires more technical implementation but significantly reduces data transfer risk.

Script-by-Script Consent Reference

The "YouTube nocookie" Limitation

Many developers believe youtube-nocookie.com eliminates the consent requirement. It does not. YouTube's own documentation acknowledges that the Privacy Enhanced Mode reduces cookie setting when the page loads, but cookies are still set when the user plays the video. The data still flows to Google's servers, and the visitor's IP address and interaction data are still transmitted.

The only fully compliant approach is a facade: display a static thumbnail image until the user actively clicks to load the video. At that point, you can either (a) require consent before loading, or (b) accept that the user's click to load the video constitutes a "strictly necessary" action — but regulators have not consistently accepted this argument for advertising-purpose cookies.

What About Programmatic Display Ad Networks?

Everything above covers marketing and analytics pixels like Meta Pixel, HubSpot, and Intercom — none of which use the IAB Transparency and Consent Framework (TCF). If your site instead runs programmatic display advertising through Google AdSense, Google Ad Manager, or a third-party SSP, those networks read a separate consent signal (the TCF euconsent-v2 cookie) to decide whether to serve personalised ads. That is a different consent mechanism from the script-blocking approach described here — see our IAB TCF explainer for whether your site actually needs it.

Enforcement Context: Real Cases

The Hungarian DPA fined a Hungarian news portal €92,000 in 2023 specifically for firing Meta Pixel without consent on page load. The French CNIL's 2021 enforcement sweep found hundreds of sites loading advertising scripts before any consent mechanism was displayed. The German DPA coalition (DSK) published a technical guidance note in 2022 confirming that pre-consent script firing constitutes a GDPR violation regardless of whether any individual can be identified.

The consistent regulatory message: the moment a script fires before consent, you are in violation — regardless of what the script actually does with the data.

Generate your consent banner with built-in script blocking using our Cookie Consent Generator, which includes pre-configured blocking rules for the most common third-party embeds including Meta Pixel, GA4, HubSpot, and YouTube.