Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that when HubSpot customers install the HubSpot Tracking Code on their own websites, HubSpot collects IP addresses and online identifiers from those website visitors and processes this data as a controller for HubSpot's own purposes, including improvement of its commercial dataset.
This analysis describes what HubSpot's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that HubSpot assumes an independent controller role over data collected from visitors to customer-operated websites via the tracking code, distinct from its processor role under customer instructions. This means visitors to third-party websites using HubSpot infrastructure may have their data processed by HubSpot for HubSpot's own commercial purposes without direct notice from HubSpot.
The updated policy now explicitly discloses that HubSpot collects Email Engagement Data (such as open, delivery, bounce, and click statuses) from emails sent through its Subscription Services using embedded tracking technologies. This represents formalization of a data collection practice into explicit policy language. However, the policy simultaneously removed a previously stated sentence directing users to a form for removing their personal data from HubSpot's commercial dataset. The updated terms do not indicate an alternative removal mechanism.
View change record →Under this clause, individuals who visit a website operated by a HubSpot customer that has installed the HubSpot Tracking Code may have their IP addresses and online identifiers collected and processed by HubSpot as a controller for HubSpot's own product improvement and commercial dataset enrichment purposes, independent of the website operator's own privacy disclosures.
Cross-platform context
See how other platforms handle HubSpot Tracking Code Controller Processing and similar clauses.
Compare across platforms →Monitoring
HubSpot has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Our Customers may install the HubSpot Tracking Code on their website to collect information about website visitors. HubSpot uses information collected by the tracking code, such as IP addresses and online identifiers, to improve our products and services, including our commercial dataset. We store information about website visitors on our servers and process this data for our own purposes as a controller.Excerpt from HubSpot's Privacy Policy
1. REGULATORY LANDSCAPE: This provision engages GDPR transparency and legal basis requirements for third-party data collection, the ePrivacy Directive (cookie and tracking consent requirements), UK GDPR, and CCPA provisions regarding collection of personal information from consumers who have no direct relationship with the collecting entity. GDPR Article 26 joint controller obligations may be implicated where both HubSpot and its customer exercise control over the same data collected via the tracking code. 2. GOVERNANCE EXPOSURE: High. The assertion that HubSpot processes tracking code data as an independent controller for its own commercial purposes creates significant exposure under GDPR's transparency and legal basis requirements, as the individuals whose data is collected have no direct relationship with HubSpot and may not have received notice of HubSpot's independent controller processing. 3. JURISDICTION FLAGS: EEA and UK individuals visiting customer websites have GDPR rights against HubSpot as a controller, including access and deletion rights. The ePrivacy Directive requires consent for tracking technologies in the EEA. California residents have CCPA rights regarding data collected about them by entities with which they have no direct relationship. 4. CONTRACT AND VENDOR IMPLICATIONS: HubSpot customers who install the tracking code should assess whether their website privacy notices and cookie consent mechanisms adequately disclose HubSpot's independent controller processing. Joint controller agreements under GDPR Article 26 may be required between HubSpot customers and HubSpot where both parties exercise control over the same tracking data. 5. COMPLIANCE CONSIDERATIONS: Compliance teams at HubSpot customer organizations should review whether their privacy notices disclose HubSpot's independent controller use of tracking data, whether cookie consent flows cover HubSpot's own processing purposes, and whether joint controller arrangements are documented. HubSpot's own compliance teams should evaluate whether Article 14 notices are provided to website visitors whose data is collected via the tracking code.
This provision establishes that HubSpot assumes an independent controller role over data collected from visitors to customer-operated websites via the tracking code, distinct from its processor role under customer instructions. This means visitors to third-party websites using HubSpot infrastructure may have their data processed by HubSpot for HubSpot's own commercial purposes without direct notice from HubSpot.
Under this clause, individuals who visit a website operated by a HubSpot customer that has installed the HubSpot Tracking Code may have their IP addresses and online identifiers collected and processed by HubSpot as a controller for HubSpot's own product improvement and commercial dataset enrichment purposes, independent of the website operator's own privacy disclosures.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by HubSpot.