HubSpot’s Contact Discovery feature formally launches today, August 4, 2026, letting customers find, verify, and add new contacts inside their CRM by drawing on a shared enrichment dataset built from business contact details, company data, tracking-code signals, and email engagement data pulled from participating accounts. That description alone would be an unremarkable martech product update. What makes it worth a closer look is how HubSpot got here: on July 1, the company quietly rewrote its terms of service to enroll every eligible customer into that shared pool by default, under a feature internally called Trusted Prospecting. The backlash, concentrated heavily on LinkedIn, was fast and specific enough that HubSpot reversed the opt-out default within days, with co-founder Dharmesh Shah and chief product officer Duncan Lennox both publicly calling the rollout a mistake. The version launching today is opt-in only.
What Was Actually Going to Be Shared
The scope of the original plan is what should catch the attention of anyone running an email program, not just privacy teams. Alongside business contact and company data, the enrichment pool was set to include tracking-code signals and email engagement data, opens, clicks, bounces, and delivery status pulled from customer sending activity and shared back into a commercial dataset other HubSpot customers could draw on. Notes, deals, call recordings, and custom fields were excluded, but engagement data was not. That is the same category of signal mailbox providers use to judge sender reputation, and it was set to move across company boundaries by default, without an affirmative choice from the account it came from.
Why Engagement Data Is Not a Minor Category to Pool
Open, click, and bounce data is not incidental exhaust. It is the closest thing a sending domain has to a real-time report card, and it accumulates meaning specifically because it is tied to one sender’s history with one list. Once that data starts flowing into a shared pool used to build discovery and prospecting features for other accounts, the sender that generated it loses visibility into where it ends up and who benefits from patterns extracted out of it. That is a different kind of exposure than a leaked contact list. It is a company’s own sending behavior being repackaged as someone else’s product input, decided on their behalf.
The comparison critics reached for during the backlash was ZoomInfo, a company built entirely on aggregating and reselling exactly this kind of pooled business data. Being compared to that model by your own customers, days after a terms change, is not a subtle signal.
The Reversal Timeline
HubSpot moved unusually fast once the backlash gained traction. The July 1 terms change was fully reversed by July 5, with Enrichment and AI Model Training settings automatically reverted to their pre-July-1 state for every account, and Lennox committing publicly to an opt-in-only standard for any future data-sharing change. Today’s Contact Discovery launch is the result of that commitment: the feature exists, the underlying shared dataset exists, but participation now requires an account to affirmatively choose in rather than having to notice and opt out before a deadline.
The Principle That Applies Beyond HubSpot
Set the specific vendor aside and the underlying question generalizes to every tool in a marketing stack that touches sending data: does this platform treat my engagement history as mine, or as a resource it can repurpose once enough other customers are doing the same thing? HubSpot answered that question the wrong way first and had to be forced back to the right one publicly. Other vendors sitting on similar data are watching the same backlash and drawing their own conclusions, some toward opt-in defaults, some simply toward being quieter about it.
The same instinct that makes a marketer uneasy about a CRM vendor repackaging their engagement data should apply to every other place sending data leaves their direct control, including who else is authorized to send mail as their domain. A DMARC record with full visibility into every authorized source answers a version of the same question: not who might see your engagement metrics, but who is actually allowed to act as you in a recipient’s inbox at all.
What This Means for Your Program
Read the enrichment and data-sharing settings in every platform touching your sending data, today, not after the next terms update. HubSpot’s episode shows how quickly a default can change and how easy it is to miss the window to opt out before a new setting takes effect.
Treat engagement data, opens, clicks, bounces, complaint signals, as sensitive by default. It documents your actual relationship with your list and your sender reputation. Any vendor proposing to pool it across customers should have to ask first, not assume consent until told otherwise.
Push vendors for an explicit answer on data reuse, not a vague privacy policy reference. Ask directly whether your engagement data trains shared models, feeds other customers’ features, or leaves your account in any aggregated form, and get that answer before signing a renewal.
Apply the same consent standard to your own list. A vendor defaulting customers into data sharing without a clear opt-in is the same governance failure as a marketing program defaulting contacts into a mailing list without confirmed consent. Both erode trust in ways that show up later as complaints, unsubscribes, or churn.
The Takeaway
HubSpot’s Contact Discovery launches today with better guardrails than it would have had without a month of public pressure, which is itself worth noting. Data sharing defaults tend to move toward opt-out unless customers make the cost of that choice visible and immediate, and this time they did. The lesson is not specific to one vendor. Every tool sitting on your sending and engagement data is one terms-of-service update away from making a similar decision on your behalf, and the only real defense is treating that data, and who has access to it, as something you monitor continuously rather than something you assume is handled.
Excello Mail gives you a clear, continuous record of every source authorized to send under your domain, so you always know exactly who is acting as you, no shared dataset, no default you have to notice and opt out of. Sign up for free to Excello Mail and keep that visibility in your own hands.