Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that HubSpot may update the privacy policy at any time, with notification via webpage posting and, where appropriate, by email or other means, and advises users to review the policy periodically.
This analysis describes what HubSpot's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision reserves the right to modify privacy practices with notification that may consist solely of a webpage update, without guaranteeing direct individual notice for material changes, which may require evaluation under GDPR requirements for informing data subjects of material changes to processing activities.
Interpretive note: The policy does not define what constitutes an 'appropriate' change warranting direct email notification, leaving the threshold for proactive notice undefined and subject to HubSpot's discretion.
The updated policy now explicitly discloses that HubSpot collects Email Engagement Data (such as open, delivery, bounce, and click statuses) from emails sent through its Subscription Services using embedded tracking technologies. This represents formalization of a data collection practice into explicit policy language. However, the policy simultaneously removed a previously stated sentence directing users to a form for removing their personal data from HubSpot's commercial dataset. The updated terms do not indicate an alternative removal mechanism.
View change record →Establishes procedures for policy updates and user notification, providing procedural transparency about future changes.
View full change record →Under this provision, HubSpot may modify its privacy practices and the terms of this policy by posting updated terms online; whether direct email notification is provided depends on HubSpot's assessment of whether the change is appropriate for direct notice, which is not further defined.
How other platforms handle this
If you choose to reveal any personal information about yourself to other users, you do so at your own risk. We strongly encourage you to use caution in disclosing any personal information online.
When you are asked to provide information, you may decline to do so; but if you choose not to provide information that is necessary to provide some of our Services, you may not be able to use those Services.
Monitoring
HubSpot has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"We may update this privacy policy from time to time. We will notify you of any changes by posting the new privacy policy on this page and, where appropriate, notifying you by email or other means. You are advised to review this privacy policy periodically for any changes.Excerpt from HubSpot's Privacy Policy
1. REGULATORY LANDSCAPE: This provision may require evaluation under GDPR Article 13 and 14 obligations to inform data subjects of material changes to processing purposes or legal bases. Where changes affect the legal basis for processing or the categories of data processed, proactive individual notification may be required rather than a passive webpage update. The Irish DPC has guidance on material change notifications. 2. GOVERNANCE EXPOSURE: Medium. The policy reserves discretion over when email notification is appropriate, which could result in material changes to data processing activities being communicated only through a webpage update. This may be insufficient for GDPR compliance in cases involving new processing purposes or changes to legal basis. 3. JURISDICTION FLAGS: EU and EEA users have the highest exposure given GDPR's active transparency obligations. UK GDPR imposes equivalent requirements. California users have CPRA rights to notice of material changes to data practices. 4. CONTRACT AND VENDOR IMPLICATIONS: B2B customers should monitor HubSpot's privacy policy for changes that may affect the scope of data processing covered by their DPA, and should assess whether policy changes trigger DPA amendment or re-execution obligations. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should implement a monitoring process for HubSpot privacy policy changes and assess whether any updates require notification to their own users, updates to their own privacy notices, or amendments to their data processing agreements with HubSpot.
Regulatory citations, enforcement risk, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision reserves the right to modify privacy practices with notification that may consist solely of a webpage update, without guaranteeing direct individual notice for material changes, which may require evaluation under GDPR requirements for informing data subjects of material changes to processing activities.
Under this provision, HubSpot may modify its privacy practices and the terms of this policy by posting updated terms online; whether direct email notification is provided depends on HubSpot's assessment of whether the change is appropriate for direct notice, which is not further defined.
ConductAtlas has identified this type of provision across 295 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by HubSpot.