Looking for the changes in email open tracking consent in France and Italy (CNIL and Garante) across platforms like HubSpot, Marketo and others? Read it here.
In June 2026, HubSpot announced that from 4 August, enrichment data from customer instances could be added to its commercial dataset and used to supplement other customers' records. On 5 July 2026, after customer backlash, HubSpot reversed: it will not go ahead with the 1 July terms of service changes, and reaffirmed that customers control their data (see the update above). So the 4 August data sharing did not take effect. This piece keeps the original analysis on the record, greys out the withdrawn mechanics, and draws the strategic lesson, which outlasts the reversal.
- 5 JUL 2026 Reversed. HubSpot announced it will not move forward with the 1 July terms of service changes and reaffirmed customer data ownership. The 4 August sharing did not take effect. See the update banner at the top of the page.
- 3 JUL 2026 HubSpot confirmed in a community clarification that turning off enrichment alone is not enough: stopping contribution takes enrichment off (both toggles), manual enrichment stopped, and AI model training opted out. The opt-out works forward only: previously contributed data is not automatically removed. Also added detail from HubSpot's updated enrichment knowledge base: buyer intent tracking-code data and the narrower stated purpose of Email Engagement Data.
Yesterday, 1 July 2026, HubSpot's updated Customer Terms of Service, Product Specific Terms, Privacy Policy and Data Processing Agreement took effect, announced a week earlier. Most admins do not read every legal update in detail. This one deserves it.
This is not legal advice. Treat this as a platform strategy and marketing operations reading of the change, and involve your DPO or legal counsel before acting on it.
What HubSpot proposed for 4 August 2026
Here is what was planned. From 4 August 2026, HubSpot would treat enrichment data from customer instances as shareable with other customers through its commercial dataset. The legal groundwork went into force first: the updated Product Specific Terms took effect on 1 July 2026, and section 6.3 stated that customers agreed HubSpot may add Enrichment Data to its commercial dataset and "use it to enrich or otherwise supplement the data sets of other customers". On 4 August, HubSpot was to launch Contact Discovery, a feature built on that shared dataset that lets teams find, verify and add net-new contacts without leaving HubSpot. Then, on 5 July, before any of it took effect, HubSpot reversed the terms of service changes (see the banner above).
HubSpot's pitch is reasonable on its face. Prospecting data decays fast, and a dataset that is continuously refreshed by signals from participating instances is more accurate than any static list.
The definition of Enrichment Data in those terms was broad: contact data including business contact information and employer information, company data, data collected through the HubSpot Tracking Code, and Email Engagement Data. A new "Emailing" section (8.7) defined that last category as opens, clicks, bounces, delivery status and other engagement signals from emails sent through HubSpot, together with associated metadata.
Was this default enrolment?
This was the sharpest point of contention, and HubSpot ultimately conceded it. HubSpot framed enrichment as opt-in, and for new adopters it was. But for instances already using enrichment features, the design behaved like default enrolment with an opt-out path, not like a fresh consent moment: in-scope customers were not being asked for anything, they were being notified of a change and told where to act if they did not want future collection and sharing. In its 5 July reversal HubSpot acknowledged exactly this gap, saying it "always intended for enrichment to remain strictly opt-in" but "should have communicated better how that opt-in works", and committed that future enrichment will be "fully and transparently opt-in".
HubSpot withdrew these terms on 5 July 2026, so this opt-out routine no longer applies. Kept for the record of what participation would have required.
The control sits with Super Admins: Settings, then Data Management, then Data Enrichment. But turning off enrichment alone is not enough. In a community clarification of 3 July, HubSpot confirmed that stopping contribution to the commercial dataset takes three actions: turn off enrichment (both the automatic and the continuous refresh toggle), stop manually enriching records, and opt out of AI model training, because the training setting covers models that power enrichment. There is no way to keep using enrichment without contributing. And the opt-out works forward only: data already contributed is not automatically removed from the dataset.
These scope details describe the withdrawn 1 July terms. HubSpot retracted them on 5 July 2026 and reaffirmed that this data belongs to the customer, so nothing here was ever shared onward. Kept for the record.
What data is in scope, and what is not
The scope is data collected through enrichment, email delivery infrastructure and tracking-code signals. That is a meaningful shift: operational data inside the customer's system of record can become part of HubSpot's commercial dataset.
In scope, per HubSpot's updated terms and its own announcement: business contact data of the kind found on a business card, employer information, company data, HubSpot Tracking Code data, and Email Engagement Data including opens, clicks, bounces and delivery status. HubSpot is explicit about what stays out: notes, deals, call recordings, custom fields and other internal CRM content are not part of enrichment or Contact Discovery, and HubSpot says it does not read or share email content.
HubSpot's community clarification lists the fields. For contacts: name, work email, job title, company, role, seniority, business location and professional profile URL. For companies: domain, name, industry, location, employee count, size, revenue and description. That includes values you imported, corrected or added manually, where they map to those fields. Older documentation described a much narrower exchange, essentially work email and company domain, so the scope has widened considerably. Buyer intent is the third ingesting feature: through the HubSpot Tracking Code it collects company domain, visitor IDs, IP addresses, visit timestamps and URL paths, per HubSpot's updated knowledge base.
One gap deserved attention. That same knowledge base describes Email Engagement Data narrowly: quality signals used "for data quality and deliverability checks", to assess whether an address is likely valid. The terms authorised broader use: section 8.7 allowed Email Engagement Data to improve the Subscription Services and provide enrichment features. The distance between the stated purpose and the authorised purpose is a precise question to hand your DPO.
HubSpot is not just enriching records. It is enriching its own gravity.
Why did HubSpot want to do this?
Because a proprietary dataset is one of the few durable advantages left in CRM. Of course HubSpot wants better data. The interesting question was always where that data would come from.
Look at what the move buys HubSpot: a richer commercial dataset that competitors cannot copy, better enrichment accuracy, better raw material for AI and data intelligence features, stronger platform gravity, higher switching costs, and proprietary leverage against point-solution data vendors. Every instance that participates makes the dataset more valuable, which makes the platform more valuable, which makes leaving more expensive. CRM data gravity is moving from "your system of record" to "our networked intelligence layer". This is where the system of record starts behaving like a data network.
ZoomInfo runs a contributory data model openly and has always been a data vendor: that is the deal, and everyone who signs up knows it. Salesforce has publicly positioned its generative AI trust layer around zero retention and no third-party LLM training on customer data. HubSpot's enrichment move was a different kind of thing from either: a commercial dataset that would enrich other customers' records, run by a mainstream CRM. HubSpot was one of the first mainstream systems of record to make this move so visibly, and then, on 5 July, to retreat from it.
In early July it became a visible controversy across the HubSpot community and MarTech circles, and on 5 July HubSpot reversed.
This is not only about AI model training
This is not only about AI model training. It is about the operating model around enrichment, commercial datasets, email engagement signals and tracking-code data. The customer experience may feel like one AI and data setting. The legal reality is more fragmented.
The 1 July DPA changes described here were withdrawn on 5 July 2026. The durable lesson stands: vendor data controls are usually fragmented, so opting out of one setting rarely turns off the others.
HubSpot's documents treat AI model training, enrichment features and commercial dataset sharing as distinct settings and processing purposes. The updated DPA now applies its Controller-to-Controller terms wherever a customer uses enrichment features, sends emails through HubSpot's sending network with AI model training enabled, or uses the Tracking Code with intent data sharing enabled. In those situations both parties act as independent controllers, and the categories of personal data transferred explicitly include Enrichment Data and Email Engagement Data. Turning off one setting does not turn off the others. An organisation that opts out of AI training and believes it is done has answered one question out of three.
The regulators got to the raw material first
The timing was awkward, and it is part of why the move landed badly. France's CNIL has a practical 14 July 2026 deadline for informing existing email recipients under its tracking pixel recommendation. HubSpot's enrichment data sharing change had been due to take effect on 4 August 2026. Italy's Garante points to a practical 28 October 2026 deadline for adapting to its tracking pixel rules. HubSpot has since reversed its change, but the regulatory dates stand, and the shared theme holds: the raw material of modern marketing systems is under regulatory and platform pressure at once.
Whether HubSpot's commercial dataset use fits or does not fit the CNIL or Garante exemptions is not a call this article can make. The question for DPOs is not whether this is automatically unlawful. The question is whether the organisation understands which engagement signals it collects, which purposes they serve, whether they are shared, and whether the relevant consent or legal basis is strong enough.
For the implementation side of that question, read the practical how-to for HubSpot, Marketo and the rest. This piece covers the strategy; that one covers the settings.
The gravity reading
Readers of the Value Gravity™ model will recognise the pattern. Value concentrates in the foundation layer: data, governance, systems, operating model. Whoever controls that layer controls where value accumulates. When a platform vendor starts converting operational signals from customer instances into a proprietary commercial asset, gravity is shifting from the customer's foundation layer to the vendor's.
That does not make the move wrong. It makes it strategic, and customers should respond strategically rather than administratively. The question is not whether a setting is on or off, but whether the signals inside your CRM are only your operating data, or also part of your vendor's commercial data asset. It is the same dynamic that makes AI ROI a gravity problem: the value of an AI feature depends on which layer feeds it, and who owns that layer.
The reversal makes the point sharper than the move did. You cannot build platform gravity by annexing the layer that creates it. HubSpot reached into the customer's foundation layer, the data customers regard as their own, and found the one layer a platform cannot take without losing the trust that gives it gravity in the first place. The retreat confirmed the model rather than denting it: gravity that rests on the foundation layer is precisely the gravity a vendor forfeits by grabbing at it. That HubSpot recognised this quickly, and reversed, is to its credit.
The 4 August 2026 deadline no longer exists: HubSpot reversed the change on 5 July 2026. This checklist is kept for the record. The durable version, the governance test that applies to any vendor, is immediately below.
What to do before 4 August 2026
- Check whether your HubSpot instance uses enrichment features.
- Check whether AI model training, enrichment and intent-data settings are enabled.
- Ask a Super Admin or your specialised HubSpot partner, like iO or Social Brothers, to confirm the relevant settings under Settings → Data Management → Data Enrichment (both the automatic and continuous toggles), and the AI settings.
- Ask legal, privacy or the DPO to weigh in. In most organisations, they will make the call.
- Make it a joint decision, and document it.
- Choose how to implement that decision in HubSpot.
- Map which data signals may be collected, shared or used by HubSpot.
Unsure what these settings mean in your setup? Your HubSpot partner agency can run this check with you before 4 August.
The governance test that outlasts the deadline
Does this feature only use data to improve our account, or does it also help the vendor improve a shared model, commercial dataset or other customers' results?
Ask that question of every AI or data feature announcement. The answer tells you whether you are looking at a product improvement or a gravity shift.
For the source material behind this analysis: HubSpot's legal update announcement, its community clarification on the opt-out mechanics, its 5 July reversal ("We Got This Wrong"), the Product Specific Terms (sections 6.2 to 6.4 and 8.7), the Data Processing Agreement (Controller-to-Controller terms), and HubSpot's knowledge base pages on data enrichment and enrichment opt-out notices. For the regulatory context, the CNIL recommendation, Garante Provision No. 284, and the analyses by Lewis Silkin, Covington and iubenda.
Frequently asked questions
Is HubSpot still going ahead with the data pooling change?
No. On 5 July 2026, HubSpot reversed course. CPTO Duncan Lennox announced that HubSpot would not move forward with the 1 July 2026 terms of service changes and reaffirmed that customers control their data. The enrichment data sharing announced for 4 August 2026 did not take effect.
Did HubSpot pull back, cancel or walk back the change?
Yes. After customer backlash, HubSpot withdrew the terms of service changes on 5 July 2026, in a post titled "We Got This Wrong. And We Are Fixing It", and committed that any future enrichment using customer data will be fully and transparently opt-in. HubSpot listened to its customers and acted within days, which is worth crediting.
What is changing in HubSpot on 4 August 2026?
Nothing now. HubSpot had announced that from 4 August 2026, enrichment data from customer instances could be added to its commercial dataset and used to supplement other customers' records, backed by Product Specific Terms and DPA changes dated 1 July 2026. After customer backlash, CPTO Duncan Lennox announced on 5 July 2026 that HubSpot would not move forward with those terms of service changes and reaffirmed that customers control their data. The 4 August sharing did not take effect.
Is HubSpot pooling customer data?
No. HubSpot announced a plan to in June 2026, then reversed it on 5 July 2026 after customer backlash, stating it would not move forward with the terms of service changes and that customers control their data. The proposal would have added enrichment data (business contact data, company data, email engagement and tracking-code signals, not notes, deals or custom fields) to its commercial dataset. HubSpot says any future enrichment that uses customer data will be fully and transparently opt-in.
How do I opt out of HubSpot enrichment data sharing?
As of 5 July 2026 the mandatory-contribution mechanism has been withdrawn: HubSpot reversed the 1 July terms that would have pooled enrichment data, and committed that any future enrichment using customer data will be fully and transparently opt-in. Enrichment settings still live under Settings → Data Management → Data Enrichment, with AI model training controlled separately. The durable governance move is to know which signals your instance contributes to any vendor dataset, and to document the decision. Your HubSpot partner agency can run this check with you.
Does this apply if we do not use HubSpot enrichment?
HubSpot ties the sharing authorisation to enrichment features, the Tracking Code and emails sent through its network. If your instance uses none of these, the controller-to-controller terms should not apply. In practice, "we do not use enrichment" may cover less than teams think: enrichment is widely promoted in-product, and tracking code and email sending are near-universal. Have a Super Admin verify the actual settings.
Does this apply to EU or GDPR-regulated data?
Yes, it can. HubSpot's DPA handles this through Controller-to-Controller terms: where a customer uses enrichment features, both parties act as independent controllers of the shared data, which can include personal data such as business contact details and email engagement signals. HubSpot says it informs EU contacts by email when they become part of its commercial dataset. Customers remain responsible for their own notices, consents and legal basis.
Is this the same as HubSpot AI model training?
No. They are distinct settings and processing purposes in HubSpot's legal documents. But they are entangled: AI model training covers models that power enrichment, and HubSpot has confirmed that both controls must be off, and manual enrichment stopped, to prevent your data contributing to the commercial dataset.
How is this different from ZoomInfo contributory data?
ZoomInfo runs a contributory data model openly and has always positioned itself as a data vendor: participants share business contact data in exchange for access to the dataset. HubSpot is different because it is a mainstream CRM and marketing automation system of record. When the system that holds your operating data also starts pooling signals from it, the governance question changes character.
How does this relate to CNIL and Garante email tracking rules?
HubSpot's move to expand commercial use of email engagement and enrichment signals came at almost the same time France and Italy were tightening email pixel rules. HubSpot reversed its change on 5 July 2026, but the regulatory deadlines stand: France's practical deadline for informing existing recipients is 14 July 2026, and Italy's adaptation window runs to 28 October 2026. The DPO question is durable: whether you understand which signals you collect, which purposes they serve, whether they are shared, and whether the legal basis holds.
Why is HubSpot doing this?
Because a proprietary commercial dataset is one of the few durable advantages left in CRM. Pooling enrichment data would make HubSpot's AI and data intelligence features better, make the platform stickier, raise switching costs, and give it leverage against standalone data vendors. The logic held up better than the rollout did. HubSpot reversed the change on 5 July 2026, which is the point: you cannot build platform gravity by annexing the layer that creates it.
What is Value Gravity™?
Value Gravity™ is Arjen Segers' model for explaining why modern companies create or lose commercial momentum. It argues that durable growth comes from the strength of the foundation layer: data, governance, systems, operating model and decision quality. HubSpot's attempt to pool customer enrichment data, and its reversal days later, is a useful case: it shows that the foundation layer is the one layer a platform cannot annex without losing the trust that gives it gravity.