What Actually Happened
On July 1, HubSpot quietly updated its Terms of Service to enroll every customer into a feature called Contact Discovery—set to launch August 4. The default-on settings allowed HubSpot to share business contact data, company information, email engagement signals, and tracking-code intent across accounts to build a shared enrichment dataset.
The backlash was fast. Partners and CRO-level critics flagged it publicly, and by July 5, HubSpot's CPO had apologized and reversed the opt-in-by-default policy. That's the headline most people read.
Here's what most people missed: Contact Discovery still launches August 4. Previously contributed data is not automatically removed. And the opt-out required navigating three separate toggles—not one.
The Three-Toggle Problem
This is the operational detail that matters. HubSpot's privacy settings are not a single switch. To fully opt out, a super admin needed to disable:
- Enrichment sharing — controls whether your contact data feeds the shared pool
- AI model training — controls whether HubSpot trains on your data
- Tracking-code intent — controls whether behavioral signals from your site are included
Any customer who turned off only