Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that HubSpot may send marketing communications about third-party products and services using personal information, and provides opt-out by unsubscribe link or email to privacy@hubspot.com.
This analysis describes what HubSpot's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision authorizes use of personal information for third-party promotional communications, which engages CAN-SPAM Act requirements in the US and GDPR consent or legitimate interests analysis for EU users, as well as CASL for Canadian users.
The updated policy now explicitly discloses that HubSpot collects Email Engagement Data (such as open, delivery, bounce, and click statuses) from emails sent through its Subscription Services using embedded tracking technologies. This represents formalization of a data collection practice into explicit policy language. However, the policy simultaneously removed a previously stated sentence directing users to a form for removing their personal data from HubSpot's commercial dataset. The updated terms do not indicate an alternative removal mechanism.
View change record →Explicitly discloses marketing use of personal information and provides clear opt-out mechanisms, enhancing user control transparency.
View full change record →Under this provision, HubSpot may send promotional emails about third-party products and services to users; users may opt out at any time by using the unsubscribe mechanism in those communications or by contacting privacy@hubspot.com.
How other platforms handle this
We may use your information to let you know about new products or features we think you'll like...You may opt-out of receiving such marketing communications.
You may opt-out of receiving any, or all, of these communications from Us by following the unsubscribe link or instructions provided in any email We send or by contacting Us.
If you choose to reveal any personal information about yourself to other users, you do so at your own risk. We strongly encourage you to use caution in disclosing any personal information online.
Monitoring
HubSpot has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"We may use your personal information to send you promotional information about third parties' products and services. You can opt-out of receiving this type of communication by following the unsubscribe instructions in any such communications or by contacting us at privacy@hubspot.com.Excerpt from HubSpot's Privacy Policy
1. REGULATORY LANDSCAPE: This provision engages the CAN-SPAM Act for US-based recipients, GDPR consent requirements for EU recipients of marketing communications, and Canada's CASL for Canadian recipients. The FTC enforces CAN-SPAM compliance. Where third-party promotional use constitutes processing for direct marketing purposes, GDPR Article 21 provides an unconditional right to object. 2. GOVERNANCE EXPOSURE: Low to Medium. Third-party promotional communications are a disclosed practice with an available opt-out mechanism. EU compliance depends on whether marketing to EU users is based on consent or legitimate interests, and whether the opt-out mechanism is sufficiently prominent. 3. JURISDICTION FLAGS: EU and EEA users may have stronger opt-out rights under GDPR Article 21 (object to direct marketing) than the policy's opt-out language alone suggests. Canadian users may have additional rights under CASL. California users may have CCPA disclosure rights related to sharing data with third parties for promotional purposes. 4. CONTRACT AND VENDOR IMPLICATIONS: Organizations that have shared contact lists or CRM data with HubSpot should confirm whether that data could be used for HubSpot's own marketing purposes, which would require evaluation under their own data processing agreements. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should verify that marketing opt-out requests submitted to privacy@hubspot.com are processed within CAN-SPAM's 10-business-day requirement, and that EU users' objections to direct marketing are treated as absolute and not subject to a balancing test.
Regulatory citations, enforcement risk, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision authorizes use of personal information for third-party promotional communications, which engages CAN-SPAM Act requirements in the US and GDPR consent or legitimate interests analysis for EU users, as well as CASL for Canadian users.
Under this provision, HubSpot may send promotional emails about third-party products and services to users; users may opt out at any time by using the unsubscribe mechanism in those communications or by contacting privacy@hubspot.com.
ConductAtlas has identified this type of provision across 295 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by HubSpot.