The policy authorizes HubSpot to share user data with advertising vendors who use cookies, web beacons, and similar tracking technologies to deliver targeted advertisements on third-party websites and services.
This analysis describes what HubSpot's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision authorizes disclosure of user browsing and activity data to advertising technology vendors for cross-site targeting purposes, which may require evaluation under GDPR consent requirements and ePrivacy Directive guidance applicable to cookie-based tracking in EU member states.
Interpretive note: The precise scope of data shared with advertising vendors and whether that sharing constitutes a sale under CCPA or CPRA is not fully specified in the excerpted document text and may depend on the specific integrations in use.
The updated policy now explicitly discloses that HubSpot collects Email Engagement Data (such as open, delivery, bounce, and click statuses) from emails sent through its Subscription Services using embedded tracking technologies. This represents formalization of a data collection practice into explicit policy language. However, the policy simultaneously removed a previously stated sentence directing users to a form for removing their personal data from HubSpot's commercial dataset. The updated terms do not indicate an alternative removal mechanism.
View change record →Separately specifies advertising-related data sharing practices and third-party tracking for ad delivery, clarifying scope beyond general vendor sharing.
View full change record →Under this provision, HubSpot may share identifiers, browsing activity, and usage data with advertising vendors who use that data to serve targeted ads on other platforms, including through cookie and web beacon tracking mechanisms.
How other platforms handle this
We will also provide an individual opt-out choice, or opt-in for sensitive data, before we share your data with third parties other than our agents, or before we use it for a purpose other than which it was originally collected.
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
"We may share information about you with third-party vendors who assist us in delivering advertising to you on other websites and services. These vendors may use cookies, web beacons, and similar technologies to collect information about your use of our Services and other websites to provide you with targeted advertisements.Excerpt from HubSpot's Privacy Policy
1.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision authorizes disclosure of user browsing and activity data to advertising technology vendors for cross-site targeting purposes, which may require evaluation under GDPR consent requirements and ePrivacy Directive guidance applicable to cookie-based tracking in EU member states.
Under this provision, HubSpot may share identifiers, browsing activity, and usage data with advertising vendors who use that data to serve targeted ads on other platforms, including through cookie and web beacon tracking mechanisms.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by HubSpot.