Managing Multiple Cookie Banners with HubSpot

This case study won the 2024 HubSpot Impact Award for Technical Excellence. 

Challenge: Managing Cookie Preferences Across Platforms

Tracking cookie and private data consent is critical for all businesses, especially those who are operating in strict data collection and protection jurisdictions. Most tools that collect and use cookie data have cookie notification banners built into them but this can in itself become an issue. When our client, a leading financial services company, turned on their HubSpot cookie notification banner, they found themselves in an awkward situation where they now had two cookie notification banners on the site - their new HubSpot cookie banner notification and their existing InvestisDigital banner that alerts website visitors to the cookies that are being collected for their advertising platform.

Collecting cookie permissions in both the advertising platform (IDX), and in the main CRM (HubSpot), were critical. We needed to be able to ensure that we were not showing ads or collecting cookies for those who declined them (IDX) or tracking website visit data or behavioral data (HubSpot), all of this tied into their website which is built on Drupal and is collecting website analytics data (Google Analytics).

Failure to adhere to data collection and storage policies could result in huge fines and as a leading financial institution, any violation of data collection and protection could be a serious reputation risk. It also ran the risk of conflicting feedback: if a contact accepted cookies for one platform and not another, and those same cookies were collected for both platforms, how were they going to prove that they had the right to collect or use any cookies? It was a risk that needed a clear solution. 

We had to find a way to manage the permissions for multiple platforms with just one notification banner.

Solution: Mapping Out the Data Transmission Flows

1. Identify which cookies are collected, how, and what they’re used for.

In order to find the right solution for this particular challenge we had to do a few workshops between the client, their analytics team, their advertising partner and their HubSpot consultants.

In these workshops we were able to identify:

• Which cookies are being collected by each platform?
• How are those cookies being triggered and collected? 
• Which are necessary cookies or performance cookies, and which are used for analytics or advertising?
• What other platforms are using these cookies?
• How are they being connected and stored with IP records?
• Where are the greatest risks?

Pulling together a list of which cookies were duplicated on each platform let us narrow the scope of what we needed to collect and pass through. It also helped us to identify several old scripts that were collecting data but were no longer needed. 

2. Optimization of the cookie collection workflow.

What we found in our workshops is that the Investis Cookies and Analytics Cookies were both being collected and managed via Google Tag Manager. Our ideal solution quickly became clear: use the HubSpot cookie banner to broadly accept or decline cookies and push that response to Google Tag Manager, which would update Investis and Google Analytics.

3. Build the integration.

We used Google Tag manager to set up the Triggers, Tags and Data Layers to collect and push the relevant information.

Triggers

• In the HubSpot cookie banner there are two buttons: Allow & Deny.
• While we could leave it as two different triggers (one for allow and one for deny) because there are 4 different types of cookies (analytics, advertising, functionality & necessary) we recommended 4 triggers that execute when the allow or deny button is clicked to update the Allow/Deny options for each of those 4 cookie types. Those 4 triggers will execute 4 tags. 

Tags

• This is the Allow or Deny information for each of the 4 cookie types. When triggered, they will push the information on whether the button was Allow or Deny. 

Data Layers

• We grouped the info into data layers to help to keep everything organized and together so we can communicate that to Google Analytics in a nice, clean way.

Results: Easy Management, Low Risk of Non-Compliance

What started as a challenge involving multiple stakeholders and platforms was simplified and streamlined into one simple Google Tag Manager listener. Cookies permissions are still being tracked at a granular level which allows the possibility for easy change management moving forward, but with a very simple user experience now.

Impact: One Tool to Manage Multiple Cookie Permissions

The impact on the brand reputation for this large financial institution is significant. Removing the second cookie banner greatly improved user experience on the site. Prior to completion, the website was seeing an average bounce rate of around 93-94%. After the second cookie banner was removed we saw that average bounce rate improved significantly, down to 83%.

Managing their cookie settings via Google Tag Manager has greatly improved their response time to make changes to the cookie tracking code and no longer requires workshops of several agencies and stakeholders, saving hundreds of dollars in consulting fees per change.

Conclusion: Turning Tech Stack Weaknesses Into Strengths

What started as a complicated compliance risk and poor user experience became a unified, consolidated data management strategy. Taking the time to discuss the issues at hand and collaboratively work to find the best solution resulted in a well thought through approach that will keep it easy for our client to manage their user data collection moving forward. We are grateful to our client for trusting us with this complicated issue and for the partnership and collaboration of Investis to work together to find the best solution for all.