Enrichment data sharing with "other customers" starting Aug 4...can someone from HubSpot clarify the legal basis?
Baseline question: is this rolling to Europe anytime soon??
Now, with more details.
Per the screenshot, HubSpot is expanding "data discovery and intelligence" starting August 4, and enrichment data (business contact details, employer info, email deliverability signals...) "may be shared with other customers."
A few specifics that aren't clear: for accounts already using enrichment features, this isn't a fresh opt-in, it's opt-out, controlled by a Super Admin. If nothing changes on our end, are we automatically enrolled as a data source into the commercial dataset for other customers?
The Product Specific Terms and DPA updates went live July 1.
Turning off enrichment doesn't automatically turn off AI model training on sent emails or tracking-code intent sharing, those are separate toggles under the Controller-to-Controller terms. Has anyone mapped which settings actually need to change together to fully opt out?!
HubSpot's stated legal basis is legitimate interest, not consent. I'm a partner (SmartLinks) based in Lisbon/Portugal and for EU contacts specifically, that's a contestable position under GDPR Art. 6(1)(f) since legitimate interest isn't an automatic win against data subject rights.
Has HubSpot published a DPIA or a legitimate interest assessment alongside this change, or is that left entirely to each customer?
Trully not trying to start a pile-on, genuinely asking. If someone from HubSpot, or a partner who's already dug into this, can point to documentation that clarifies the legal basis and exactly what "opt-out" covers across enrichment / tracking code / email AI training, that would help a lot of admins right now.
