On July 1, HubSpot announced new terms of service that allowed the company to acquire enrichment data from one company and use it to enrich or supplement another company’s records. Then he automatically opted in to all his customers.
Their response was swift and quite furious.
“What the hell is HubSpot thinking?” Gabe Larsen, CRO of Atomom, he wrote on LinkedIn. “Imagine sending your customers an email that basically says, ‘Thank you for spending years developing your CRM. We may use your data to improve our product for everyone else. You’re on by default.'”
Channing Ferrer, CRO of Brevo and former HubSpot executive, he wrote“Using one company’s data to help a competitor is madness. Disappointed with this decision by HubSpot. Proprietary customer data should not be shared by a CRM vendor. Period.”
Within days, HubSpot reversed course, but the reversal raised a bigger question for users: If your data is used by a vendor to make money, what do you get in return?
Your customers search everywhere. Make sure your branding introduces himself.
The SEO toolkit you know, plus the AI visibility data you need.
Start your free trial
Start with
We are very, very sorry
By July 5, HubSpot was in emergency mode my fault mode. “We made a mistake. Nothing is more important to us than our customers’ trust,” said Duncan Lennox, Chief Product and Technology Officer, in a post on the company blog titled “We Were Wrong and We’re Fixing It.”
The cause of the disaster was Contact Discovery, a product launching on August 4, designed to let teams find, verify, and add new contacts without leaving HubSpot.
On the surface, it’s a smart product. Prospecting data has a slightly long shelf life longer than a flyso automatically updating the dataset is a good idea. HubSpot wanted to use shared enrichment pools to solve the problem by allowing participating customers to improve each other’s records. The more organizations provide up-to-date information, the more valuable the data set becomes.
That’s why the company has updated its Terms of Service, Privacy Policy, and Data Processing Agreement to allow business contact, company, and email engagement data, as well as participating customer tracking data, to be added to a shared dataset for this purpose. HubSpot called it “Trusted Prospecting”.
“Read kindly, this was ‘business card level’ data in a shared pool, with stewardship controls,” Melissa Rosenthal said on her blog, The status of the brand. “Reading the way customers actually read it, the CRM they were told they had was quietly becoming an input to a data product resold to everyone else, including potentially their competitors.”
The paper trail grows longer
The controversy might have ended with an apology from HubSpot if Clark Barron hadn’t started digging into the company’s historical documentation.
Barron, founder of threat intelligence firm GTM Blackout, traced the language surrounding HubSpot’s enrichment program through archived product terms, help articles and policy documents. It turns out that July’s announcement wasn’t an entirely new direction.
“Permission to copy enrichment data into HubSpot’s commercial dataset is in the Product Specific Terms as of September 18, 2024,” Barron wrote. “The Internet has lost control. Right. ‘They’re going to start sharing my data’ – no. They were already doing it. I got the paper trail back.”
Blackout expanded that research in a notice titled “The gap of 652 days.” This gap is the time between HubSpot changing the terms and sending the notification email to customers.
“They didn’t just let you down.”
The report showed changes to HubSpot’s help documentation during that time. For part of 2025, a knowledge base article stated: “HubSpot will not share the data listed above with other accounts.” That language was later removed. Barron highlighted the discrepancy in a LinkedIn post:
“Not only did they not tell you. They told you the opposite, then deleted the sentence.”
The advisory also examined the controls available to customers. It identified five enrichment settings that control how records receive enrichment, but concluded that none specifically governed whether customer-provided data was included in the shared enrichment dataset. “There are five enrichment options. All five govern whether your records receive enrichments. No rules whether your data is provided or shared.”
All of this seems to contradict the core value of the HubSpot brand.
“HubSpot’s entire market position, what has allowed it to charge SMBs a premium over Salesforce for two decades, is ‘we’re the vendor on your side,’” Melissa Rosenthal said. “A data cooperative is not incompatible with this position. Many customers would happily exchange business card-level data for significantly better prospecting. The value exchange is defensible. But a value exchange must be offered, visibly, with the price tag on display.”
World-class emergency response, but…
So far, HubSpot’s response to all of this has been a model of crisis management.
The blog post “came quickly, four days from the effective date to full retraction, over a holiday weekend no less,” Rosenthal said. “It’s written in the first person. Mention the specific failure… rather than the typical ‘we’re sorry you were confused.’ Explain the original intent without using it as an excuse. And thanks customers for “feedback, criticism and honesty,” which is an admission that the fix came from outside the building.”
However, as Rosenthal noted, “apologies reverse terms. They do not reverse strategy,” he wrote. HubSpot still intends to build a shared enrichment network because “the only durable data moat is a network effect, a data set that gets better because customers use it.”
Or, as Duncan Lennox put it, “We still believe there is a better, more effective way to prospect than the status quo. But we need to earn your trust as we build it together.” It also pledged to ensure that future enrichment features provide customers with “clear and immediate control over participation and how data is used in this context.”
Thanks to artificial intelligence, operational marketing data, including delivery signals, engagement metrics and behavioral insights, is becoming the fuel that powers products. As vendors build systems that depend on that data, marketers must evaluate AI capabilities, governance, transparency and customer control. They also need to ask themselves whether the value they get justifies the data they help improve someone else’s product.
