HubSpot Forms API Legal Consent Example

When you need `legalConsentOptions`

You usually need a legal consent block when the HubSpot form uses GDPR settings, processing consent, privacy text, or communication subscription opt-ins.

A simple form may submit without this block. A consent-enabled form may reject the payload or accept it without the subscription state you expected.

Common mistakes

1. Sending no consent block for a consent-enabled form

If the HubSpot form requires processing consent, a normal `fields` payload may not be enough. Add the legal consent object that matches the form's visible consent language.

2. Setting consent without user action

The API payload should represent what the visitor actually accepted. Do not set subscription opt-ins to true unless your form UI collected that opt-in.

3. Using the wrong subscription type ID

Communication consent needs the correct `subscriptionTypeId`. A placeholder or wrong ID can produce unexpected behavior.

Processing consent example

Use this shape when the visitor agreed to processing consent and your HubSpot form expects that consent.

{
  "fields": [
    {
      "name": "email",
      "value": "developer@example.com"
    }
  ],
  "legalConsentOptions": {
    "consent": {
      "consentToProcess": true,
      "text": "I agree to allow this website to store and process my personal data."
    }
  }
}

Processing plus communication consent

Use communication consent only when the visitor opted in to receive that type of communication. Replace `999` with the real HubSpot subscription type ID.

{
  "fields": [
    {
      "name": "email",
      "value": "developer@example.com"
    }
  ],
  "legalConsentOptions": {
    "consent": {
      "consentToProcess": true,
      "text": "I agree to allow this website to store and process my personal data.",
      "communications": [
        {
          "value": true,
          "subscriptionTypeId": 999,
          "text": "I agree to receive product updates."
        }
      ]
    }
  }
}

PHP payload pattern

In PHP or WordPress, build the consent block only from real submitted form values. Keep the legal text aligned with what the visitor saw.

$payload = [
    'fields' => [
        [
            'name' => 'email',
            'value' => 'developer@example.com',
        ],
    ],
];

if (!empty($_POST['privacy_consent'])) {
    $payload['legalConsentOptions'] = [
        'consent' => [
            'consentToProcess' => true,
            'text' => 'I agree to allow this website to store and process my personal data.',
        ],
    ];
}

if (!empty($_POST['marketing_opt_in'])) {
    $payload['legalConsentOptions']['consent']['communications'] = [
        [
            'value' => true,
            'subscriptionTypeId' => 999,
            'text' => 'I agree to receive product updates.',
        ],
    ];
}

HubSpot Forms API legal consent examples.

Fast checklist