Everybody clapped. Nobody diffed.
You watched it happen last week. HubSpot emailed Super Admins on July 2: starting August 4, enrichment data "may be shared with other customers." LinkedIn caught fire. Four days later, the white flag. The terms came down, the founders acknowledged the mistake, the trade press wrote the redemption arc, and everyone went back to work feeling protected by the system.
I pulled the terms they reverted to.
The sharing clause is gone. The machine that feeds it never left.
What four days of fine print looked like
The short version, every entry sourced at the bottom of this piece.
On July 1, HubSpot revised its Terms of Service, Product Specific Terms, Data Processing Agreement, Privacy Policy, and four help articles in a single day. The new PST section 6.3.1 read: "You agree we may: (i) add Enrichment Data to our commercial dataset and use it to enrich or otherwise supplement the data sets of other customers." On July 2, the email went out. By July 5, after sustained backlash, HubSpot reversed course. Co-founder Dharmesh Shah and chief product officer Duncan Lennox called it a mistake, and Lennox committed to opt-in for future data changes. Coverage settled on the obvious story: customer outrage works.
It does. Partially. Here is what the outrage did not touch.
The terms they reverted to still take your data
The live Product Specific Terms page today says "Last Modified: April 14, 2026." That is the reversion. And that April version contains this sentence, word for word:
"by using the enrichment products, you agree that only the Enrichment Data you transmit to HubSpot via the Subscription Services may be copied to our commercial dataset and processed further as HubSpot Content"
That authorization is not new. It entered the terms on September 18, 2024. BLACKOUT, my threat intelligence company, published an advisory on July 2 documenting the paper trail: 652 days passed between that clause going live and the email that finally said the quiet part in plain language. For part of those 652 days, HubSpot's own help center said the opposite: "HubSpot won't share the data listed above with other accounts." That sentence was removed from the article sometime between February and April 2025. Nobody emailed you about that one.
So read the reversal for what it reverted. The clause that shocked everyone, "supplement the data sets of other customers," is gone. Still standing, in the terms in force right now:
- Enrichment data you transmit "may be copied to our commercial dataset." Section 6.5.
- Data collected through the HubSpot Tracking Code on your website, "which may include Personal Data such as IP addresses and other online identifiers," may be used "to provide, maintain, append, improve, enhance, and develop our commercial dataset." Also section 6.5, under the heading "Data Use and Sharing Authorization."
- The commercial dataset and enrichment outputs "are considered HubSpot Content." HubSpot's property. Section 6.3.
- And the copy authorization "supersedes any prior or conflicting terms."
Your contribution to the dataset was never the four-day scandal. Your contribution to the dataset is the standing arrangement. The scandal was HubSpot telling you what the dataset is for.
The apology deleted the promise
This is the detail that should stop you cold.
On July 2, HubSpot's "AI model training" help article contained this sentence: "Data is never shared between HubSpot users or accounts." Captured that day, hash on file, in the BLACKOUT evidence set.
Today that sentence is gone from the article.
Sit with the sequence. HubSpot proposed sharing your data. You revolted. HubSpot apologized and rolled back the terms. And somewhere in that same window, the strongest anti-sharing promise in their documentation quietly came out. The walk-back did not restore the promise. It removed it.
I cannot tell you why, and I won't pretend to. Maybe legal scrubbed every absolute statement in the panic. Maybe the sentence was always writing a check the architecture couldn't cash. Either way, the direction of travel is not in dispute: before the apology, the docs said never. After the apology, they don't.
The four-day terms almost didn't exist
One more thing the redemption arc skipped. The July 1 version of the Product Specific Terms, the one with "supplement the data sets of other customers" in it, was live for roughly four days and then vanished. The Internet Archive's public record for that page skips straight from June 3 to July 6, which is the snapshot we requested after discovering the gap. No crawler caught the four-day version. The full text survives because BLACKOUT captured and hashed it on July 2, and because reporters quoted fragments of it.
A vendor rewrote the data rights of its entire customer base, un-rewrote them under pressure, and the public record of the rewrite is a set of screenshots and one hashed capture. That is how thin the accountability layer actually is. If nobody diffs the terms, the terms didn't change. You just agreed to whatever is there today.
What you do with this
Not panic. Read. Specifically:
Read PST section 6 yourself. It is short. Note what "Enrichment Data" includes: contact data, company data, and visitor signals from your own website via the tracking code. Note what "HubSpot Content" means for who owns the output.
Treat the opt-in commitment as a statement, not a setting. Lennox's promise of opt-in for future changes is a good sentence from a person. The terms are the contract. When the enrichment plan returns, and "HubSpot has not said when or whether" it will per the coverage, the version that matters is the one on legal.hubspot.com that day.
Archive what you rely on. If a clause or a help-center sentence is the reason you're comfortable, snapshot it now. February's "won't share" and July's "never shared" both left the building without a notice. The Wayback Machine is free. Use it before you need it.
Ask your vendor the question the reversal didn't answer. Not "will you share my data," they answered that under duress. Ask: "What of my transmitted data currently sits in your commercial dataset, and what is the mechanism for withdrawing it?" As of the July 2 documentation, every documented removal path belongs to the individual contact, not to you, the account that contributed them.
The field didn't change hands
HubSpot spent four days finding out its customers read email. Good. That reflex matters and you should keep it loaded.
But a retreat means leaving the field. The commercial dataset is the field. It is still there, still fed by the terms in force today, still HubSpot Content, and the one sentence that promised your data stays yours between accounts got deleted during the apology.
The white flag is real. So are the terms flying under it.
Read them.
Receipts: the September 2024 PST with the copy authorization (Wayback) · the January 2025 "won't share" help article (Wayback) · the live PST, reverted to April 14, 2026 · July 6 snapshot of the reverted page (Wayback) · the BLACKOUT advisory with the full 652-day timeline, capture hashes, and every source link · reversal coverage: CMSWire, PPC Land, Mi3, Josh Bernoff. Disclosure: BLACKOUT is my company. The receipts don't care who pulled them.