HubSpot’s move to pool customer contact data survived four days. On 5 July, chief product and technology officer Duncan Lennox told customers the company had “made a mistake” and would not proceed with terms-of-service changes that took effect on 1 July, which had allowed business contact data held in customer accounts to be added to HubSpot’s commercial dataset and used to enrich other customers’ records.

The episode is a test case for a question hanging over every large martech vendor: whether the customer data sitting in a CRM can be converted into a proprietary dataset for AI-powered prospecting without a fresh, affirmative choice from the customers who put it there. HubSpot’s answer, forced by a week of pressure from customers, partners and consultants, is that it cannot — at least not by default, and not from a vendor that says it serves more than 299,000 customers built on permission-based marketing.

What did HubSpot’s 1 July terms change?

HubSpot announced the changes on 25 June in a community post that paired a legal update with news of Contact Discovery, a prospecting product scheduled to launch on 4 August that lets teams find, verify and add net-new contacts without leaving the platform. Six core legal documents were updated with effect from 1 July, including the General Terms, Product Specific Terms, Privacy Policy, Data Processing Agreement and sub-processors page.

The substance sat in the redrafted enrichment section. Customers using HubSpot’s enrichment features agreed the company could add defined “Enrichment Data” to its commercial dataset and use it to supplement other customers’ records. In scope was business-card-level contact detail — name, work email, job title, employer, role, seniority, business location and profile URL — plus company data, signals from the HubSpot Tracking Code, and a new category of Email Engagement Data covering opens, clicks, bounces and delivery status from emails sent through the platform. Notes, deals, call recordings and custom fields were excluded, and HubSpot said it does not read or share email content.

HubSpot framed the model as give-to-get: accounts using enrichment contribute data that keeps the shared dataset current, and receive more accurate data back. There was no way to keep using enrichment without contributing. A HubSpot community clarification on 3 July confirmed that fully stopping contribution required turning off both enrichment settings, halting manual enrichment and opting out of AI model training — and that the opt-out worked forward only, leaving data already contributed in the dataset.

Why did customers and partners push back?

The objection was less the dataset than the default. For accounts already using enrichment, participation from 4 August was automatic unless a super admin acted across several separate settings. Partners, consultants and customers argued on the community forum and LinkedIn that HubSpot had shifted from a permission-based CRM into a data-pooling business without asking affected customers to make a fresh choice — and that a brand’s contact data could end up improving a competitor’s records. Trade publication Mi3 reported that rivals seized on the controversy, comparing the approach to ZoomInfo’s data-aggregation model.

Inconsistent language sharpened the criticism. Mi3 reported that HubSpot’s own opt-out page said its AI models used customer data to improve results for all users while also stating that data was never shared between users or accounts, even as emails to customers warned that enrichment data could be shared with other customers from 4 August.

For European customers, including those in the UK, the change raised data-protection questions that HubSpot’s terms place on the customer. Enrichment already triggers privacy notices to contacts in Europe under Article 14 of GDPR, and the updated Data Processing Agreement extended controller-to-controller terms to email engagement and tracking-code data. Whether marketing teams held notices and consents covering a new sharing purpose was, for many, an open question. Salesforce faced a similar opt-out controversy over customer data and its AI models earlier this year, but HubSpot’s terms went further by expressly feeding a commercial dataset used to supplement other customers’ records.

What has HubSpot withdrawn, and what still stands?

The terms are withdrawn; the strategy is not. Lennox’s 5 July post, titled “We Got This Wrong. And We Are Fixing It”, confirmed HubSpot will not move forward with the 1 July changes and restated that customer CRM data — contacts, notes, deals, call recordings, custom fields and customer records — belongs to the customer. On LinkedIn, Lennox wrote that the company was “reverting those changes completely”. The 25 June announcement now carries a notice that the terms are no longer in effect.

HubSpot also committed that future enrichment features using customer data will be opt-in from the outset, with clear upfront control over whether an account participates and how its data is used. The company maintains its intent was always opt-in, on the basis that choosing to use enrichment constituted the choice — a framing critics rejected, since existing enrichment users would have been swept into sharing by default.

What survives the retreat is the ambition. HubSpot still describes a shared, continuously refreshed dataset as central to what it calls Trusted Prospecting, and says it is reassessing how enrichment opt-in should work so that it is clearer, easier to govern and simpler to manage. Marketing teams running HubSpot are left with the settings that triggered the row — data enrichment, AI model training and, from launch, Contact Discovery — as the levers to audit before a revised version returns.

HubSpot’s post did not say whether Contact Discovery will still launch on 4 August, or under what terms. The company has said it will communicate early, clearly and across multiple channels before any future change that affects customer data.