THE 652-DAY GAP
HubSpot's August 4 enrichment sharing change, documented from HubSpot's own pages. Every claim is a quote, a date, and a link.
TL;DR
On July 2, 2026, HubSpot emailed Super Admins of accounts that use enrichment: starting August 4, enrichment data “such as business contact details, employer information, and email deliverability signals, may be shared with other customers.”
We pulled the paper trail. The authorization to copy customer-transmitted enrichment data into HubSpot's commercial dataset has been in the Product Specific Terms since September 18, 2024. The plain-language announcement arrived July 2, 2026. That is 652 days.
For part of that window, HubSpot's own help documentation stated the opposite: “HubSpot won't share the data listed above with other accounts.” That sentence was live through at least February 9, 2025, and was removed by April 4, 2025.
And the “complete control” the notice promises does not include a sharing control. Five enrichment toggles exist. All five govern whether your records receive enrichment. None governs whether your data is contributed or shared. The only exits HubSpot's own email offers are an AI-training toggle (a different data flow) and not using the feature at all.
One more pair of dates. On July 1, 2026, the Product Specific Terms gained the authorization to “supplement the data sets of other customers.” On July 1, 2026, HubSpot's AI model training help article stated: “Data is never shared between HubSpot users or accounts.” Both sentences are HubSpot's. Both carry the same date.
The timeline
Every entry is sourced to a live page or a Wayback Machine snapshot you can open today.
“Enrichment Data does not include Personal Data. We do not use Customer Data to populate Enrichment Data.”
“by using the enrichment products, you agree that only the Enrichment Data you transmit to HubSpot via the Subscription Services may be copied to our commercial dataset and processed further as HubSpot Content”
The Breeze-era terms replace the sentence above, noting this “supersedes any prior or conflicting terms.” The DPA adds Controller-to-Controller terms the same day. The 652-day clock starts here.
“HubSpot won't share the data listed above with other accounts.”
Live in the help center four months after the terms authorized copying customer-transmitted data into the commercial dataset.
“HubSpot may use enrichment data as confirming signals to verify information in the Breeze Intelligence commercial dataset.”
The “won't share” sentence is removed and replaced with this. No sharing language in either direction for roughly fifteen months.
“6.3.1 HubSpot's Authorization. You agree we may: (i) add Enrichment Data to our commercial dataset and use it to enrich or otherwise supplement the data sets of other customers”
“enrichment data such as business contact details, employer information, and email deliverability signals, may be shared with other customers”
The change takes effect.
The control surface, verified
The “Manage data enrichment settings” article (July 1, 2026) documents five controls. Exact labels:
All five control whether and how your records receive enrichment. None mentions contribution to the commercial dataset. None mentions sharing with other customers. There is no sharing-level setting documented anywhere we could find.
Three related facts, recorded as we found them: default state, unresolved (no HubSpot page states whether automatic or continuous enrichment is on or off for new accounts); no take-backs documented (every removal path belongs to the individual contact, and per HubSpot's FAQ their data “may be reintroduced” if they re-consent); contribution crosses account lines (a contact can enter the dataset via a different customer's account even if yours never enriched them).
Who carries the responsibility
“You acknowledge and agree that you will be solely responsible for providing adequate notices, obtaining any necessary consents and authorizations, and honoring opt-out preferences to collect and transmit Enrichment Data to HubSpot and for HubSpot to use such Enrichment Data as contemplated by this Agreement.”PST §6.4, July 1, 2026
“nothing in the Agreement or this ‘Controller-to-Controller Terms’ section shall restrict HubSpot in any way from collecting, using, or sharing data that HubSpot would otherwise Process independently of Customer's use of the Subscription Services, including our enrichment features.”DPA §10.2, Controller-to-Controller terms, in place since Sept 18, 2024
This behavior pattern is addressed under GDPR Art. 14, Art. 6(1)(f), and the controller and processor definitions of Art. 4; HubSpot's own pages reference GDPR and CCPA. Determinations about any of it belong to your own advisors. The full clause set, including the Article 14 notice language and what “Enrichment Data” covers, is in the PDF.
Before August 4: what to review
- 01Find out if you are in scope. The notice went to Super Admins of accounts that “have used HubSpot's enrichment features.” Ingestion flows are Contact Enrichment, Company Enrichment, and Buyer Intent via the HubSpot Tracking Code.
- 02Open Settings > Data Management > Data Enrichment. Record what is ON. The five toggles above are the whole control surface.
- 03Understand what each choice does and does not do. Turning toggles off stops enrichment behavior going forward. Nothing documented retrieves what your account has already contributed.
- 04Inventory what your tracking code feeds. Buyer intent runs on visitor signals from your own website: visitor IDs, IP addresses, page paths. Those are in the Enrichment Data definition.
- 05Read the clauses yourself. PST §6, the DPA's Controller-to-Controller section, and Privacy Policy §1.5, §1.6, and §3.10. They are short.
- 06Decide with your own advisors. The notices, consents, and opt-out obligations in PST §6.4 sit with you by contract.
Verify everything
We publish evidence, not assertions. Raw HTML of every source page was captured on July 2, 2026, hashed with SHA-256, and preserved with fetch timestamps. The 652-day figure runs from the Product Specific Terms version date (September 18, 2024, as printed on the document) to the notice email (July 2, 2026); snapshot dates are lower bounds on how early the language existed.
Methodology note: the links inside HubSpot's notice email are recipient-keyed click trackers (hubspot.com/e3t/Ctc/...). We did not follow them. Every source was pulled cold from the canonical URL. The email also carries a 1×1 open-tracking pixel; it was not loaded.
Read the full advisory.
Five pages. Every clause verbatim, every date pinned, every source linked. Scan artifacts and capture hashes are on file.
BTI-2026-0001 (PDF)BLACKOUT observes runtime GTM behavior and documents what vendors declare against what their terms and systems do.