Picture the box of business cards your sales team hauls back from every trade show. Years of them. Scanned, deduped, chased, and filed in HubSpot.
That list is the most valuable thing your company owns that isn’t cash.
On July 1, a quiet terms-of-service update turned it into an ingredient.
This is the plain-English version of what HubSpot actually did, what the July 5 apology reversed, and what still ships on August 4.
You’ll get the three settings to audit, the give-to-get call to make before launch, and the one line in the fine print that should worry anyone with EU or UK contacts.
What changed on July 1, and what the apology undid
Here’s the short version, before the noise.
On July 1, 2026, HubSpot updated its terms to feed customer enrichment data into a shared commercial dataset. That dataset powers a new feature, Contact Discovery, built to let teams “find, verify, and add net-new contacts without ever leaving HubSpot.” It was set to launch August 4, with every enrichment customer opted in by default.
Then the backlash hit.
Within days, HubSpot withdrew the terms. As PPC Land reported, the company scrapped the July 1 changes outright rather than clarify them. But it kept the product.
That last line is the one everyone missed.
The apology reversed the terms. It did not reverse the strategy.
Chief Product and Technology Officer Duncan Lennox published a post titled “We Got This Wrong. And We Are Fixing It.” It opened without a hedge: “We made a mistake.”
Founder and CTO Dharmesh Shah replied to a critic on LinkedIn with four words most executives never say: “Sorry. You are right.” As Salesforce Ben reported, leader after leader lined up to own it.
But read what Lennox promised next.
Future enrichment will be “fully and transparently opt-in.” Not scrapped. Rebuilt, re-worded, and shipped. No new date was reaffirmed for the August 4 launch, and none was retracted either.
HubSpot pulled the July 1 terms after the backlash. It did not cancel the shared dataset. The same give-to-get product is coming back, promised as opt-in this time. Your decision was postponed, not made for you.
Why your contact list is the whole argument
Strip away the terminology and the fight is about one thing.
Your CRM is a moat. The reason a marketing ops lead can charge a premium, forecast a quarter, and out-prospect a bigger rival is that your list is yours. A pooled “find and verify” dataset quietly changes that.
The second you let a shared pool verify contacts, every customer becomes two things at once: a buyer of the dataset, and a supplier to it.
Nobody knowingly signed up for the supplier half.
Play it out with a real scenario, the kind partners posted within hours. A niche manufacturer works a trade show and captures a stack of hard-won prospects that barely exist online. They load them into HubSpot.
With enrichment on, those freshly verified records refresh across the pool. A direct competitor running a “job change” signal gets an instant read on the exact contacts that manufacturer just paid to capture.
You paid for the lead. The pool hands your rival the freshness.
The leads you paid a booth, a flight, and a week to capture are often the ones with the thinnest public footprint. Feed them to a shared pool and they become fresh signals a competitor can read the same week you filed them.
Brand strategist Melissa Rosenthal caught why. Customers read the change the way it landed, not the way it was drafted: the CRM they had been told they owned “was quietly becoming an input to a data product sold back to everyone else, potentially including their competitors.”
That is why the reaction wasn’t confusion. It was betrayal.
The lesson underneath it: the pattern of who actually buys from you is an asset only you can see clearly. Before you rent it out, make sure you have it mapped. Our zero-to-one guide to defining your ICP is the place to start.
Is your data still being shared? The three settings to audit
Now the part the apology conveniently skipped.
A lot of people read “we reversed it” as “nothing to do.” That is the wrong read. The give-to-get plumbing did not appear on July 1.
According to GTM threat-intelligence firm Blackout, the authorization to copy enrichment data into HubSpot’s commercial dataset had been sitting in the Product Specific Terms since September 18, 2024. As MarTech detailed, a help article that once read “HubSpot won’t share the data listed above with other accounts” was later quietly deleted.
“They didn’t just fail to tell you. They told you the opposite, then removed the sentence.”
So don’t wait for August 4. Go audit your own account now. Trade press and partners traced the exit to three separate switches, and you have to check all three:
- Enrichment participation: whether your contact data is contributed to the shared pool, not just whether your records receive enrichment.
- AI model training: whether your account’s data helps train HubSpot’s underlying models.
- Tracking-code and intent signals: whether behavioral and deliverability signals from your tracking code flow outward too.
Turning one off does not turn off the others. That is the trap.
Blackout’s audit found the real gap: “There are five enrichment toggles. All five govern whether your records receive enrichment. None governs whether your data is contributed or shared.”
The controls you could see managed what you got. The one that mattered, whether you gave, was the hard one to find.
Shopifreaks noted that a super admin would have needed to work three separate toggles to fully opt out. That’s a strange definition of “opt-in.”
Open Settings, then Data Management, then Data Enrichment, and record the state of every enrichment, AI-training, and tracking-signal control. Screenshot it with the date. When the rebuilt terms land, you will know exactly what changed and what you already agreed to.
”Legitimate interest, not consent”: the GDPR problem
Here’s the line in the fine print that should stop any team with EU or UK contacts.
HubSpot’s stated legal basis for this kind of sharing is legitimate interest. Not consent. The two are worlds apart, and the difference is your problem, not the vendor’s.
You cannot simply reject legitimate interest with a toggle.
Consent is a yes you actively give. Legitimate interest is a basis the processor claims, which you then have to challenge. And under the UK ICO’s guidance on lawful basis, legitimate interest is the most flexible basis precisely because it is the one that carries the most responsibility to justify.
Here’s the part that lands on your desk: for the contacts you uploaded, you are the data controller. HubSpot is your processor. If a prospect’s details flow into a pool and surface in a stranger’s portal, “the platform did it” is not a defense a European regulator accepts from the controller.
For every EU or UK contact you loaded into HubSpot, the compliance obligation is yours, not the vendor’s. Before any give-to-get feature goes live, read the updated data terms and confirm this use is covered by the basis you told those contacts about.
This is not a hypothetical risk. European enforcement is at record levels, and regulators are now examining business-to-business data products, not just consumer apps. A vendor’s “opt-out” default does not clear your books.
Decide your give-to-get stance before the relaunch
So the terms are dead and the product is resting. Good. That is your window.
Don’t spend it waiting. Spend it deciding.
Because a data co-op is not automatically evil. Plenty of teams would happily trade business-card data for sharper prospecting. As Rosenthal argued, the value exchange is defensible. “But a value exchange has to be offered, visibly, with the price tag showing.”
So put the price tag up yourself. Ask three questions before you flip any switch:
- What exactly leaves my portal? Business-card fields, engagement signals, tracking data. Name each one.
- Who can see it? If the answer includes a direct competitor, the “get” has to be worth the “give.”
- Is the give reversible? Contributed data already in the pool rarely comes home. Assume it doesn’t.
Then decide your default: participate, or hold your list back. Write it down before the relaunch, so a re-worded email in August can’t decide it for you.
And here’s the strategic turn most teams miss in the panic.
The durable advantage was never a list you rent from a pool everyone else rents too. It’s the first-party signal you own outright: why your best customers actually bought, what nearly made them leave, what they’d pay more for.
A shared dataset can’t tell you that. A real conversation can.
That matters more the moment your CRM becomes a commodity. hollie goes and has real conversations with your customers, then brings back the why, ranked, so the insight lives with you and not in a pool.
Start with the signal you already generate. Our guide to collecting customer feedback that actually moves the number and our breakdown of how to use AI in sales without the hype both lean on data you keep, not data you surrender.
Frequently asked questions
Is HubSpot Contact Discovery cancelled?
No. HubSpot withdrew the July 1, 2026 terms of service changes after backlash, but the Contact Discovery feature and the shared dataset behind it are still on the roadmap. Duncan Lennox confirmed future enrichment would return as “fully and transparently opt-in.” The terms were reversed. The product was not.
Was my HubSpot data being shared before July 1?
Possibly, if you had enrichment enabled. Blackout’s research traced authorization to copy enrichment data into HubSpot’s commercial dataset back to Product Specific Terms dated September 18, 2024. A help-center line stating data would not be shared with other accounts was later removed. July 1 made it visible, not new.
How do I stop HubSpot from sharing my contacts?
Audit three separate controls in Settings, under Data Management and Data Enrichment: enrichment participation, AI model training, and tracking-code or intent signals. Switching one off does not disable the others. If a dedicated “do not contribute” control is missing, turning enrichment off entirely is the only certain way to stop giving.
Does this create a GDPR problem for my EU contacts?
It can. HubSpot’s stated basis is legitimate interest, not consent, and you remain the data controller for contacts you uploaded. Before any give-to-get feature launches, read the updated data terms and confirm the sharing is covered by the lawful basis and privacy notice you gave those contacts.
The window is open. Use it.
The story reads like a vendor stumble. It’s really a rehearsal.
The pooled-data model is coming back, re-worded and calmer, and next time the fine print will be tidier. Audit now. Decide now. Own your signal.
The Bottom Line
HubSpot pulled its July 1 terms, not the product, so the give-to-get call is only postponed. Audit the three settings, confirm your GDPR duties as the data controller, and pick your stance before the relaunch. Then stop renting a pooled list and own the answers only your customers can give. See how hollie does it.
