HubSpot decides whether a contact can receive a marketing email by checking their status for the email's subscription type, and what it enforces depends on whether your account's data privacy settings are turned on. With them off, you can email any contact who has not unsubscribed. With them on, you need explicit consent, and you can restrict sends to contacts who have a legal basis to communicate and an Opted in status.
Checked against the HubSpot Knowledge Base, the GDPR text, ICO guidance and the FTC CAN-SPAM guide on October 20, 2026.
This guide describes what HubSpot's documentation and the regulations say. It is not legal advice. HubSpot itself says "your legal team is the best resource to give you compliance advice for your specific situation," and the same applies here: confirm your consent model with your own counsel.
The core rule: three statuses, two modes
Every subscription type has one of three statuses on a contact record: Subscribed, Not specified or Unsubscribed. HubSpot maps those statuses to opt-in states differently depending on your data privacy settings.
| Status on the contact | Data privacy settings off | Data privacy settings on |
|---|---|---|
| Subscribed | Can be emailed | Opted in. Can be emailed |
| Not specified (default) | Can be emailed. HubSpot "highly recommends" getting explicit consent first to protect your sending reputation | Not opted in or out. You cannot email the contact without first obtaining explicit consent |
| Unsubscribed | Cannot be emailed for that subscription type | Cannot be emailed for that subscription type |
So the rule "no consent, no send" is only true in an account with data privacy settings on. In an account with them off, HubSpot blocks only the Unsubscribed contacts, and keeping the rest of the list clean is your job.
There are two more filters on top of subscription status:
- The enforcement switch. With data privacy settings on and the Limit emails to contacts with a subscription switch on, HubSpot sends only to contacts with a valid legal basis to communicate and an Opted in status. HubSpot recommends this switch "to comply with GDPR and other privacy laws."
- Marketing contacts. If your account uses marketing contacts, only marketing contacts can receive marketing emails, and HubSpot says all marketing contacts "should meet opt-in consent requirements."
One exception to know: emails that contain a subscription confirmation link (the double opt-in link) bypass the data privacy enforcement process and still reach contacts who did not explicitly opt in.
How to turn on data privacy settings
You need Super Admin or Edit account defaults permission. The settings are available on all products and plans.
- Click the settings icon in the top navigation bar.
- In the left sidebar, select Privacy & Consent.
- Toggle Data privacy settings on, then click Yes, turn on data privacy settings.
- Under Recommended next steps to stay compliant, toggle Limit emails to contacts with a subscription on.
Accounts with data hosted in the EU have data privacy settings on by default. Turning the settings on also adds a cookie consent banner, a data privacy section on newly created forms, data privacy messaging on scheduling pages, and unsubscribe links in sales one-to-one and sequence emails. HubSpot does not add open and click tracking for contacts who have no legal basis value. Existing forms and scheduling pages are not updated for you, so review them after you switch.
What lawful basis means in HubSpot
GDPR Article 6(1) lists six lawful bases for processing personal data: consent, contract, legal obligation, vital interests, public task and legitimate interests. Recital 47 adds that processing for direct marketing "may be regarded as carried out for a legitimate interest." For email specifically, separate e-privacy rules also apply (more on that in the comparison table below), which is why many teams rely on consent for marketing email.
HubSpot stores this in the contact property Legal basis for processing contact's data. Its six default options are:
- Legitimate interest - Lead
- Legitimate interest - Customer
- Legitimate interest - Other
- Performance of a contract
- Freely given consent from contact
- Not applicable
HubSpot also keeps a separate legal basis to communicate for each subscription. When data privacy settings are on, subscribing or resubscribing a contact to a subscription type requires choosing a legal basis for communicating and entering an explanation for communication consent.
Set legal basis on import
- Go to Data Management > Data Integration (click More first if you see it), or click Import on the contacts index page.
- Choose your file and map the columns.
- Select the Consent checkbox to agree that contacts expect to hear from you and that your file does not include a purchased list.
- In the additional options, use the legal basis setting to choose the basis for importing and using the contacts' data. This option appears only when data privacy settings are on.
- If you set imported contacts as marketing contacts, you need Marketing Hub Starter, Professional or Enterprise with marketing contacts.
The legal basis for processing is not the same as an email opt-in. After the import, imported contacts still show Not specified for each subscription type until you subscribe them, they opt in, or they confirm through double opt-in.
Set legal basis and subscriptions in bulk
- Legal basis: go to CRM > Contacts, select the contacts, click Edit, choose Legal basis for processing contact's data, pick the options and click Update.
- Subscriptions: on the contacts index page, select the contacts, click More, then Edit communication subscriptions. Choose the channel, the status (Opt in, Not opted or Opt out when data privacy settings are on), the subscription types, and with data privacy settings on, a legal basis and explanation.
- Workflows: the Manage communication subscriptions action does the same job on Professional and Enterprise plans.
Neither bulk actions nor workflows can resubscribe a contact who opted out on their own. That has to be done on the individual contact record, and HubSpot's guidance is to make sure you have consent before you do it.
Double opt-in in HubSpot
Double opt-in adds a confirmation step. A new contact fills in your form, HubSpot sends a confirmation email, and the contact is not emailable until they click the link.
Where to turn it on: Settings > Marketing > Email > Double opt-in tab.
| Basic double opt-in | Advanced double opt-in | |
|---|---|---|
| Plans | Marketing Hub Starter and free tools | Marketing Hub Professional or Enterprise |
| Toggle | Send double opt-in email | Turn on double opt-in |
| Scope | All forms and pages | All forms and pages, on for some only, or off for some only |
| Customization | Sender, language and subject line | Also a confirmation page and an optional follow-up email |
Who receives the confirmation email automatically: contacts created through HubSpot forms, non-HubSpot forms, lead ad form submissions and the Forms API. Contacts created manually or by import do not get it automatically, but you can send one from the contact record with Actions > Send opt-in email.
Two details that catch teams out:
- Existing contacts who were already sent a marketing email before you turned on double opt-in count as confirmed. Existing contacts who were never sent one do not.
- The Marketing email confirmation status property tracks progress. Values include Confirmation pending, Confirmation email sent, User clicked confirmation, Confirmed from previous behavior and Confirmed due to form. If the confirmation email bounces, the status goes back to Confirmation pending.
Is double opt-in required by GDPR? GDPR does not name a specific confirmation method. Article 7(1) says the controller "shall be able to demonstrate" that consent was given. A confirmed click is strong evidence that the person who gave the address agreed, which is why many teams use it. Whether you need it for your audience is a question for your counsel.
Sample consent wording for HubSpot forms
HubSpot forms offer three data privacy options: Implicit processing consent and individual checkboxes for communications, Separate consents (Individual checkboxes per consent), and Legitimate interest. To add them, open the form editor, click the + icon, select Other, and drag the Data Privacy field onto the form. Use Add another subscription to give each subscription type its own checkbox.
The rules that shape the wording: GDPR Recital 32 says "silence, pre-ticked boxes or inactivity" do not count as consent, and HubSpot does not let you pre-check the communication checkbox. The ICO says to provide "a separate opt-in for each" purpose unless bundling is appropriate, and to name your organization. GDPR Article 7(3) says withdrawing must be as easy as giving consent.
The samples below follow those rules. They are starting points, not approved legal text. Replace the company name and have counsel review them.
| Subscription type | Sample checkbox text |
|---|---|
| Newsletter | I agree to receive the monthly [Company] newsletter by email. |
| Product updates | Send me emails from [Company] about new features and product changes. |
| Event invitations | I'd like emails from [Company] about upcoming webinars and events. |
| Offers and promotions | I agree to receive promotional offers from [Company] by email. |
Sample notice under the checkboxes: "You can unsubscribe from any of these emails at any time using the link in every email. See our privacy policy for how we use your information."
When a contact submits a form with consent, HubSpot sets Legal basis for processing contact's data to Freely given consent from contact. If they leave a communication checkbox unticked, the form still submits but they are not subscribed. Leaving it unticked on a later form does not withdraw an earlier consent.
What a consent record should hold
The ICO lists what a consent record should show: who consented, when, how, what they were told, and whether and when they withdrew. In HubSpot, much of that lives on the contact already: the subscription status, the legal basis, the explanation entered when someone was subscribed, and the form submission.
What HubSpot does not store for you is the exact wording of the form at the time. The ICO recommends keeping "a master copy" of the consent statement in use, with version numbers and dates. A simple approach is to version your form wording in a shared document and record the version in a hidden form field. The ICO also suggests reviewing consent "every two years" if you are unsure it is still valid.
GDPR, UK PECR and CAN-SPAM compared
| EU GDPR and ePrivacy | UK PECR (ICO guidance) | US CAN-SPAM (FTC) | |
|---|---|---|---|
| Model | Prior consent for email marketing, with an exception for your own customers | Specific consent for individuals, with a "soft opt-in" for existing customers | Opt-out. Consent is not required before sending |
| Existing customers | Can market your own similar products if they can object free of charge at collection and in each message (ePrivacy Article 13(2)) | Soft opt-in if they bought or negotiated to buy a similar product and were given a simple opt-out at collection and in every message | Must still be offered an opt-out |
| Business recipients | Check the national rules where your recipients are | You can email corporate bodies, but sole traders and some partnerships count as individuals | Same rules for all commercial email |
| Opt-out | Withdrawing must be as easy as giving consent, and objection to direct marketing must be honored at any time (Article 21) | Valid contact address to opt out in every message | Honor requests within 10 business days |
| Sender details | Check the national rules where your recipients are | Do not disguise or conceal your identity | Valid physical postal address, accurate headers and subject lines |
The FTC says each separate email in violation of CAN-SPAM can carry penalties of up to $53,088 (figure updated January 2024). The ICO notes its PECR guidance is under review following the Data (Use and Access) Act, so check the current version before relying on it.
Common setup mistakes
- Assuming imports are blocked. Without data privacy settings, Not specified contacts from an import can be emailed. If you do not have consent, do not send.
- Confusing the two legal bases. The legal basis for processing data is set on import. The opt-in for each subscription type is separate.
- One vague subscription type. Specific types like "Event invitations" match specific consent better than "Marketing information."
- Forgetting the confirmation link exception. Emails with a double opt-in link go to contacts who have not opted in, so keep them limited to the confirmation request.
- Re-adding opted-out contacts in bulk. HubSpot blocks this for self opt-outs, and you should not work around it.
A worked example (hypothetical)
Imagine a software company that collects leads at a trade show in Berlin and through a webinar form aimed at US prospects.
- With counsel, the team decides EU contacts need consent and double opt-in, and turns on data privacy settings and the Limit emails switch.
- The webinar form uses Separate consents, with one checkbox for Event invitations and one for the Newsletter.
- Badge scans are imported with a legal basis for processing, and all subscription types stay Not specified.
- Each imported contact gets an opt-in email from the contact record. Contacts who click become emailable for the types they chose.
- The team records the form wording version in a hidden field and reviews consent coverage with a contact report filtered by subscription status.
Getting help with HubSpot consent setup
INSIDEA is an Elite HubSpot Partner and the growth operating system for modern businesses. Our HubSpot team can review your subscription types, forms, double opt-in and data privacy settings with you, alongside your own legal counsel.
How INSIDEA works
