Can HubSpot track you?

If you run a small business, the question "Can HubSpot track you?" isn't really about you — it's about your customers. They're the ones being tracked, and they've noticed.

The numbers are stark. According to privacy research from Usercentrics, 92% of Americans are concerned about their online privacy. North of the border, government-commissioned research from the Office of the Privacy Commissioner of Canada found that 91% of Canadians are concerned about their data being used to build marketing profiles — the exact activity CRM tracking exists to perform.

This isn't abstract hand-wringing. It translates directly into buying behavior. Data compiled by Termly shows that 75% of consumers will not purchase from organizations they don't trust with their personal data. Nearly half have already stopped buying from a company over privacy concerns.

Tracking is no longer a technical decision — it's a trust decision. Every analytics script, CRM pixel, and enrichment tool you embed on your website is a promise you're making to visitors about what happens to their information. And your customers are increasingly reading the fine print on that promise.

HubSpot's own recent history shows how fragile this trust is. In July 2026, the company attempted an automatic opt-in policy that would share customer enrichment data — business contact details, employer information, email deliverability signals — across accounts unless users manually opted out. As Salesforce Ben reported, community backlash forced a full reversal within four days, with founder Dharmesh Shah publicly apologizing. One fractional CRO's warning captured the moment: business owners need to "read the small print" because "your data" has started becoming "our data."

The legal stakes compound the reputational ones. Under GDPR, website owners are accountable for the third-party tools they embed — including CRM and analytics integrations — with fines reaching €20 million or 4% of global revenue. That responsibility doesn't disappear because a vendor made the choice for you.

So what does trustworthy data practice actually look like for a small business?

• Collect only what you use. If a data point doesn't improve a customer's experience, don't gather it.
• Prefer privacy-first tooling. Analytics that work without cookies or third-party trackers remove the problem at the source.
• Say it plainly. 83% of users are more inclined to shop on sites that openly discuss their privacy practices.
• Own your data outright. Your customer list should live in systems you control, not ones a vendor can reclassify overnight.

This is the philosophy behind how we build at AI Business Sites. Our platform's analytics are privacy-first by design — no cookies, no consent banners, no third-party tracking — and clients own everything: code, content, domain, and data. When your customers ask what happens to their information, you should love your answer.

The businesses that win the next decade won't be the ones that tracked the most. They'll be the ones customers trusted enough to never have to ask.

Embedding a tracking script on your website isn't a technical detail — it's a legal commitment you're making on behalf of your business. Under GDPR, website owners are held responsible for the data practices of third-party tools they embed, including CRMs and analytics platforms, regardless of who built the tool.

The stakes are not abstract. GDPR applies to any website collecting data from EU or UK visitors, no matter where the business is physically located, and non-compliance can trigger fines of up to €20 million or 4% of global annual revenue. Regulators across Europe have collectively imposed more than €4 billion in GDPR fines since 2018, with €2.1 billion levied in 2024 alone. A small local business with a handful of EU visitors carries the same legal exposure as an enterprise.

The Google Analytics precedent shows exactly why. GA drops a first-party cookie containing a persistent ClientID, and regulators treat both that identifier and the IP addresses it transmits as personal data — even without a name or email attached. A series of 2019 rulings sharpened the picture:

• The German Conference of Data Protection Authorities ruled that third-party analytics tools do not qualify under "legitimate interest" — consent is required.
• The Court of Justice of the European Union categorized analytics and tracking cookies as non-essential, meaning they cannot run before a visitor opts in.
• Default data retention compounds the issue: Google stores user-tied data for 26 months, and the "_ga" cookie persists for 24.

The lesson for small business owners is simple: the tracking script you paste into your site header creates obligations you own. HubSpot's own 2026 data-sharing controversy — where an automatic opt-in policy was reversed within four days after backlash — illustrates how quickly data practices inside a CRM can change, while the legal accountability for what runs on your site stays with you.

This is why the architecture of your website stack matters as much as its features. AI Business Sites takes a privacy-first approach: analytics run on a cookie-free, Umami-based system with no third-party tracking and no consent banners to manage — because the safest tracking setup is the one that doesn't collect personal data you don't need. You get traffic sources, geography, devices, and real-time visitor counts without inheriting the compliance burden that comes with embedded tracking scripts. For a business that just wants to know how many people visited and where they came from, that trade is easy to make.

The consent banner is a confession. Every time a visitor clicks "Accept all cookies," your website admits it's about to do something they wouldn't like if they understood it — and most don't. According to privacy research, 56% of Americans click "agree" without reading a word, and 50% of Canadians say they've felt tricked or pressured into handing over more information than necessary, per Canada's privacy commissioner.

There's a better model: privacy by default. Instead of collecting everything and asking forgiveness through a banner, you build systems that simply don't collect what they don't need. No persistent identifiers, no third-party pixels, no 24-month cookies quietly profiling visitors.

The business case is stronger than most owners realize. Research shows 83% of users are more inclined to shop on sites that openly discuss their privacy practices, and 60% would spend more with brands they trust on privacy. Transparency isn't a compliance cost — it's a competitive edge. Meanwhile, 75% of consumers won't buy at all from organizations they don't trust with personal data.

There's also a legal dimension worth understanding. Under GDPR, website owners are accountable for third-party tools embedded in their sites, with fines reaching €20 million or 4% of global revenue. Rulings have classified persistent tracking identifiers as personal data even without a name attached, per legal analysis of analytics tracking. Every tracking script you add is a liability you carry, not your vendor.

This is the approach AI Business Sites takes with its own platform. Website analytics run on a privacy-first, Umami-based stack — no cookies, no GDPR banners, no third-party tracking. You still get the numbers that matter:

• Traffic, sources, geography, and device data
• Real-time visitor counts
• Bot-filtered, clean data the SEO engine acts on

The difference is what's absent: no consent wall between your visitor and your content, and no data flowing to outside networks.

Ownership follows the same philosophy. Clients own their code, content, lead data, and domain outright. There are no long-term contracts — just month-to-month terms with 30 days' notice. The platform earns its keep through the work it does, not through lock-in.

Privacy-by-default beats consent theater. A banner asks permission to erode trust; a cookie-free design never spends it in the first place. For a small business, that means a faster site, no compliance headaches, and a message that resonates with the 92% of Americans who are already concerned about online privacy. Your visitors notice — even if they never say so.

Knowing what's tracking your visitors is one thing. Doing something about it is where most small business owners stall — so here's a checklist you can actually finish this week.

Step 1: Audit every script on your site. Open your website, load your browser's developer tools, and watch what fires on each page. Every tracking pixel, CRM embed, and analytics snippet is a data pipeline leaving your site. Under GDPR, website owners are accountable for what third-party tools collect — with fines reaching €20 million or 4% of global revenue. If you can't explain what a script does, that's your answer about whether it belongs there.

Step 2: Read the small print — the HubSpot lesson. In July 2026, HubSpot announced an automatic opt-in policy to share customer enrichment data across accounts, then reversed it within four days after backlash. As fractional CRO Saarika Chotai put it, this is your PSA to read the small print — because "your data" can quietly become "our data." Check your CRM's data-sharing defaults today, not when the next policy email lands.

Step 3: Apply GDPR standards globally. Don't try to map 144 countries' privacy laws. Compliance experts recommend treating GDPR as your global baseline for simplicity and trust — one standard, everywhere, no jurisdiction guessing games.

Your week-one checklist:

• Inventory every tracking script and CRM integration on your site, and document what each one collects
• Review your CRM's data-sharing and retention settings — assume nothing is private until confirmed
• Adopt GDPR-level consent standards for all visitors, not just EU ones
• Write a plain-language privacy statement visitors can actually read
• Set a quarterly reminder to re-check defaults — vendors change them without asking

Step 4: Choose tools where privacy is the default. The opt-out model exploits a real weakness: 56% of Americans click "agree" without reading a word. A settings maze means most people never change anything — which is exactly the point. Tools built privacy-first skip the maze entirely. AI Business Sites, for example, runs cookie-free analytics with no third-party tracking, so the compliant choice is made before you ever log in.

The payoff is real: 83% of users are more inclined to shop on sites that openly discuss privacy. Privacy isn't a cost center — it's a trust signal your competitors are probably ignoring.

Want to see what a privacy-first system looks like when it's also a lead machine? Book a free strategy call — 30 minutes, no obligation, no sales pitch. We'll show you a setup that captures and follows up on every lead without treating your visitors like data points.