HubSpot yesterday reversed a set of terms of service changes it had rolled out five days earlier, after customers using the company's customer relationship management platform raised concerns that the update would let their contact data be shared with other businesses. The reversal, announced by Chief Product and Technology Officer Duncan Lennox, closes out a brief but pointed controversy over how the company planned to build a shared "commercial dataset" out of information drawn from customer accounts.

The episode began on July 1, 2026, when HubSpot published updates to its Customer Terms of Service, Product Specific Terms, Privacy Policy, Sub-Processors Page, and Data Processing Agreement. Those changes were meant to prepare the ground for a new feature called Contact Discovery, which HubSpot said would launch on August 4, 2026. Employee adamcuzzort described the feature in a post on the company's community forum, framing it as a way to help sales teams "find, verify, and add net-new contacts without ever leaving HubSpot." Within days, customers had flagged enough confusion and concern about the underlying data mechanics that HubSpot chose to withdraw the terms entirely rather than clarify them.

What HubSpot proposed on July 1

The July 1 post laid out a specific technical claim: prospecting fails today because contact lists go stale. "Today, most prospecting fails before it starts," the post stated, adding that reps often work "from lists where half the contacts have changed jobs, the emails bounce, and nobody knows which accounts are actually in-market." HubSpot's proposed fix rested on what the post called a shared dataset, built in part from customer accounts that had enrichment enabled.

The specific data categories at stake were spelled out in some detail. According to the July 1 post, business-card-level information was in scope, meaning "name, job title, company, work email, employer." Separately, the company said it would also look at "email engagement signals from HubSpot's email delivery infrastructure, like whether an address is live, emails are getting through, and a contact is reachable." The post was explicit that this signal only confirmed deliverability status and that HubSpot does not read or share the content of emails themselves.

The post also drew a boundary around what would not be touched. Notes, deals, call recordings, and custom fields were described as out of scope, with the post stating plainly that "HubSpot does not have access to this data, and it never leaves your portal." Two separate controls were described as governing this system: an enrichment toggle that customers could switch off at any time through Settings, Data Management, and Data Enrichment, and a distinct AI Model Training setting that, according to the July 1 post, determines whether a customer's data trains HubSpot's underlying models.

Where the confusion began

That distinction, intended as reassurance, appears to have produced the opposite effect once customers started asking specific follow-up questions. A community member using the handle lexnicole opened a thread five days after the terms took effect, asking HubSpot directly to explain how the two settings interacted. The post listed six numbered questions, several of which cut to the heart of the dispute: whether turning off AI Model Training while leaving enrichment active would still let CRM data be collected or shared through enrichment features, whether opting out applied only going forward or would also affect previously contributed data, and whether disabling enrichment before the August 4 deadline would affect existing enriched properties or other Breeze-branded AI tools already in use.

The thread drew 492 views, 7 replies, 9 likes, and 6 distinct participants according to the community platform's own counters, a modest but notable volume for a technical clarification thread relative to how quickly it was later referenced in HubSpot's own response. A moderator eventually marked the thread solved, but the resolution pointed not to an answer from HubSpot but to the fact that "this update and related terms are no longer in effect," directing readers to a separate community post dated July 5, 2026, for further detail.

The reversal, in HubSpot's own words

That July 5 post, titled "We Got This Wrong. And We Are Fixing It," was published under the handle dlennox, matching HubSpot's Chief Product and Technology Officer Duncan Lennox. The post opened without qualification. "We made a mistake," it read. "Nothing matters more to us than the trust of our customers, and with our recent terms of service update we let you down. We are sorry about that. We will not move forward with the terms of service changes we communicated on July 1, 2026."

The post then set out what HubSpot said it had been trying to build. The company described a concept it called Trusted Prospecting, characterizing the existing approach to outbound sales across the industry as one that treats "outbound as a volume game, using generic lists and spray-and-pray campaigns." According to the post, that volume-first approach "has never created the best experience for buyers, and it's only become less effective as inboxes have gotten noisier." HubSpot said its goal was to apply the same trust-and-relevance principle to prospecting that it had previously applied to inbound marketing, using "a continuously refining dataset" to improve "accuracy, deliverability, and outcomes for everyone."

Where the post pivoted was in acknowledging the gap between that stated goal and how it had been communicated. "We did not meet the standard you expect from HubSpot when it comes to transparency," the post read. It went on to describe the specific failure: intending to work with "business card-level" professional details in a shared dataset, but rolling the change out in a way that made the relationship between a customer and their own CRM data feel like it was "changing underneath you." The post added a direct restatement of policy: "Your CRM data - your contacts, notes, deals, call recordings, custom fields, and customer records - belongs to you. It should not be used without your permission, and never in ways you don't expect."

What changes next, and what does not

HubSpot's July 5 post made three forward-looking commitments. First, the terms of service changes announced on July 1 would not proceed. Second, the company said it was "reassessing how to make opting into contact enrichment clearer, more easily governable, and simpler to manage" on the product side. Third, HubSpot committed that any future enrichment capability built on customer data "will be fully and transparently opt-in," with customers retaining "clear, upfront control over whether you participate and how your data is used in this context."

No date was given for when a redesigned version of the terms, or the Contact Discovery feature itself, might return. The August 4, 2026 launch date named in the original July 1 announcement was not explicitly reaffirmed or retracted in the July 5 post; the post addressed the terms of service and the trust failure directly, without restating a product timeline. The July 5 post closed with a line that reads as an acknowledgment of the process itself: "We'll take the time to do this the right way, and we'll communicate early, clearly, and across multiple channels before any future changes that affect your data."

The Contact Discovery terms were not the only change HubSpot made effective July 1, 2026, though they became the focal point of the backlash. The broader legal update, detailed in the same July 1 community post, touched several other areas of HubSpot's terms. A section previously called "Machine Learning and AI" was renamed "Artificial Intelligence," with clarified language on how a customer opts out of having their data used for model training through account settings. The product name "Commerce Hub" was changed to "Revenue Hub" throughout the agreement. A new "Agentic AI" subsection was added to the Product Specific Terms, addressing customer responsibility for authorization, supervision, and the actions HubSpot Agents take on a customer's behalf. Three new sub-processors, Baseten Labs, Bright Data, and Exa Labs, were added to HubSpot's Sub-Processors Page as part of the same update.

The Privacy Policy update also disclosed a new category of data collection tied to enrichment: Email Engagement Data, described as information gathered "via tracking technologies embedded in" emails sent through HubSpot's platform, covering opens, clicks, bounces, and delivery status. A separate addition clarified that Google reCAPTCHA Enterprise operates across HubSpot's websites and products, and a new Google Maps Integration section disclosed that HubSpot uses the Google Maps API for address autocompletion, with Google processing that data as an independent controller under its own terms. None of these secondary changes were mentioned in HubSpot's July 5 retraction, which focused specifically and exclusively on the enrichment and Contact Discovery provisions.

Why the enrichment framing triggered concern

The technical distinction at the center of the dispute, between AI Model Training and enrichment-driven data sharing, is not a new concept in CRM software, but HubSpot's July 1 phrasing appears to have made the two settings sound more separable than customers found reassuring. AI Model Training, according to HubSpot's own stated definition in the community thread, governs whether a customer's data is used to improve HubSpot's underlying AI models; the company says that opting out does not restrict access to AI features and that data is never exposed to other customers under that specific setting.

Enrichment, by contrast, was described in the July 1 post as building toward a commercial dataset, a shared pool of business contact information that draws inputs from participating customer accounts and returns more accurate data to all participants. The value exchange framed in the post was direct: "Everyone who participates gets more accurate data back in return. You never pay for a contact already in your CRM, and there's no separate contract." For customers reading closely, the practical question became whether switching off AI Model Training alone would be sufficient to prevent their account's contact data from flowing into that shared pool, or whether enrichment needed to be disabled separately and explicitly. The community thread's six numbered questions suggest that HubSpot's original explanation did not make that distinction clear enough on first reading, and the company's own July 5 statement effectively conceded the point without contesting it.

Industry context: data-sharing terms under scrutiny

HubSpot's about-face lands amid a wider pattern of scrutiny over how customer relationship management and marketing platforms handle the data flowing through their systems. Data privacy concerns are already reshaping consumer behavior at scale: a March 2026 survey of 11,000 consumers across seven markets found that only 8 percent were fully comfortable with AI systems accessing their personal data without conditions, while a further 23 percent said they would allow it only if each individual request required separate approval.

The regulatory backdrop in Europe, where HubSpot operates extensively, has also hardened. Enforcement totals under the GDPR reached record levels in 2025, with national authorities across the bloc issuing a combined 1.15 billion euros in fines. Separately, a formal complaint filed against LinkedIn in May 2026 argued that the professional network's practice of gating certain personal data behind a paid subscription tier directly conflicted with data access rights guaranteed under the regulation, illustrating how closely European regulators and advocacy groups are now examining the mechanics of business-to-business data products, not just consumer-facing ones.

HubSpot's own product direction had, until this reversal, been trending toward greater openness with customer data, not less. In May 2026, Lennox published a strategic vision describing HubSpot's plan to expose its entire data layer, including contacts, companies, deals, and tickets, to external AI agents through open APIs and a Model Context Protocol server, arguing that "agents do not click through dashboards or navigate interfaces. They call APIs, read structured outputs, and take action." That same month, HubSpot released a report projecting 42 billion dollars in partner ecosystem revenue by 2030, built substantially on the idea that partners would build agent-based tools directly against HubSpot's CRM data.

The Contact Discovery episode sits somewhat apart from that agent-access narrative, since it concerned data flowing outward to build a shared enrichment pool across customers, rather than data being made accessible to agents acting on a single customer's behalf. But both threads point to the same underlying tension for CRM vendors: the more valuable a platform's data becomes as an input to AI systems, whether HubSpot's own models, external agents, or a cross-customer enrichment pool, the more carefully vendors have to explain exactly which data moves where, and under whose control.

What marketers should take from this

For marketing and sales teams that rely on HubSpot's platform, the immediate practical effect of the reversal is that no action is required before August 4, 2026. The enrichment and AI Model Training settings that existed prior to July 1 remain in place, unchanged by a terms update that never took lasting effect. Teams that had already reviewed their enrichment settings, or disabled features in response to the original announcement, are not required to reverse those changes, though HubSpot's post did not specify whether customers who acted preemptively will see any change reflected once the withdrawal takes effect across the platform.

The broader signal for marketing operations teams evaluating CRM and enrichment vendors is less about this specific incident and more about the pace at which such terms can change, and the level of technical precision required to evaluate them. The six questions raised in the lexnicole thread, covering scope, reversibility, and retroactive application, represent a reasonable checklist for any organization evaluating a vendor's enrichment or AI training terms going forward, regardless of which company is involved.

Timeline

  • July 1, 2026 - HubSpot publishes updated Customer Terms of Service, Product Specific Terms, Privacy Policy, Sub-Processors Page, and Data Processing Agreement, alongside an announcement previewing the Contact Discovery feature.
  • July 1, 2026 (later that day, per HubSpot's own community timestamps) - HubSpot states Contact Discovery is scheduled to launch on August 4, 2026.
  • Approximately five days after July 1, 2026 - Community member lexnicole opens a thread titled "Clarification Needed: AI Model Training vs. Enrichment Data Sharing," posing six specific questions about how the new terms function.
  • July 5, 2026 - HubSpot Chief Product and Technology Officer Duncan Lennox publishes "We Got This Wrong. And We Are Fixing It," announcing that the July 1 terms of service changes will not proceed.
  • July 5, 2026 - The original clarification thread is marked solved, with a moderator directing readers to the July 5 retraction post for further detail.
  • July 6, 2026 - Duncan Lennox shares the retraction directly with customers via a LinkedIn post, describing the reversal as complete and reaffirming that customer data control remains unchanged HubSpot policy.

Summary

Who: HubSpot, the customer relationship management and marketing platform, and specifically Duncan Lennox, its Chief Product and Technology Officer, who authored both the original feature announcement context and the subsequent retraction.

What: HubSpot reversed terms of service changes tied to a forthcoming feature called Contact Discovery, after customers raised detailed questions about how the terms would affect data sharing between customer accounts through the company's enrichment features. HubSpot stated it would not proceed with the July 1, 2026 terms changes and committed to redesigning how customers opt into future enrichment capabilities.

When: The disputed terms took effect July 1, 2026. HubSpot announced the reversal July 5, 2026, four days later, with Lennox sharing the news directly with customers via LinkedIn on July 6, 2026.

Where: The dispute unfolded on HubSpot's own community forum, where both the original terms announcement and the customer clarification thread were posted, and the resolution was communicated through the same forum before being shared more broadly on LinkedIn.

Why: HubSpot said its original communication failed to meet its own transparency standard, creating the impression that customers' relationship with their own CRM data was changing without adequate explanation. The company said its underlying goal, described as Trusted Prospecting, remains intact, but that any future version will require clearer, fully opt-in controls before customer data contributes to a shared enrichment dataset.