Last Wednesday, HubSpot announced changes to its Terms of Service in regard to how it shares customer contact data. The move centered around its upcoming feature Contact Discovery, which will let customers find, verify, and add new contacts to their CRM using a pooled (shared) dataset from other customers. The update triggered immediate backlash from HubSpot users and partners, as well as other industry professionals, who began labeling the move as a violation of privacy and trust.
What was actually changing?
HubSpot has a new vision for prospecting, which it calls Trusted Prospecting, which uses customer data from one customer, or likely a group of customers, to enrich the datasets of other customers. The company wrote in its announcement:
“When you opt into enrichment, some of your business contact data helps keep that dataset current. Everyone who participates gets more accurate data back in return.”
The shared data included business contact info (like e-mail and LinkedIn profile), company data (like employee count and annual revenue), engagement signals (like opens, clicks, and bounces), and tracking-code and intent signals, while excluding notes, deal data, call recordings, and custom fields. HubSpot also added three new sub-processors, including Baseten Labs, Bright Data, and Exa Labs.
Why were people pissed?
Customers began rightfully fearing that their proprietary contact data could begin feeding their competitors. Imagine spending two decades building a robust digital Rolodex in HubSpot, only to have your contact data used to “enrich” a startup competitor!
Critics of the change argued that HubSpot had shifted overnight from a permission-based CRM to a shared commercial data model without explicit customer consent. A CRM contact list is a company’s competitive asset, and pooling it felt like a betrayal.
To make matters worse, HubSpot’s “opt-in” policy on data enrichment was a blatant mischaracterization of what “opt-in” truly means. Following the update, customers would’ve been opted in by default unless super admins actively opted out. To make opt-out even more convoluted, customers would’ve had to do so via three separate toggles for enrichment, AI training, and tracking-code / intent sharing in order to fully retain control of their data.
What happened next?
HubSpot reversed course on the rollout, with Chief Product & Technology Officer Duncan Lennox issuing an apology on the company’s blog entitled, “We Got This Wrong. And We Are Fixing It.” He wrote:
“We made a mistake. Nothing matters more to us than the trust of our customers, and with our recent terms of service update we let you down. We are sorry about that. We will not move forward with the terms of service changes we communicated on July 1, 2026. You control your data. This has always been our policy and will not change.”
He went on to talk about how HubSpot specifically got it wrong in terms of their data sharing changes:
“We should have been clear about what we were proposing and how it would work. While we always intended for enrichment to remain strictly opt-in, we should have communicated better how that opt-in works, and importantly, how you as a customer could ensure you remain in control of that choice.”
Here’s the thing though about opt-in: it doesn’t really need explanation. Either it’s “opt-in” or it’s “opt-out” — a binary choice. HubSpot designed it as “opt-out” and called it “opt-in” instead. Frankly, they’re lucky shit hit the fan before the changes went live or they’d likely have faced a lawsuit afterward. Now, they’ve just got a PR disaster to clean up.
One important caveat about the apology and change of course: HubSpot backpedaled on its original launch terms, but is not changing its plans to move forward with its shared dataset product. Lennox wrote that they are “reassessing how to make opting into contact enrichment clearer, more easily governable, and simpler to manage,” and that “when we introduce new enrichment capabilities,” they will be “fully and transparently opt-in.”
While many folks were supportive of the company’s quick recognition and ownership of the mistake, others were not so forgiving in the comments of Lennox’s LinkedIn post:
- “Glad the mistake is being owned. It still begs the question how this made it past countless approvals, iterations, and more.”
- “Calling this ‘wrong’ undersells it… That’s not an accident you stumble into, it’s an intentional plan 2 years in the making that got walked back once you got caught.”
- “We got it wrong = we thought our clients were too distracted or too dumb to notice us trying to flip a switch to steal all their data… BUSTED!”
- “Mission backfired, will try again later.”
It’s understandable why HubSpot wants to offer pooled data enrichment. The industry around it is moving towards this type of model, and HubSpot arguably has one of the biggest business datasets on the planet. It’s an untapped value add-on for customers and revenue stream for HubSpot. That doesn’t necessarily mean their customers like it, or that HubSpot should’ve gone about releasing the product in this manner. Either way, it’s coming.
What are your thoughts on HubSpot’s pooled data enrichment plans and on its recent announcement and subsequent apology? Join the conversation on LinkedIn.
