If you are planning HubSpot cold email to people who never signed up, read HubSpot’s own Anti-Spam Policy first. It asks that messages sent through HubSpot’s services go only to recipients who gave express, verifiable consent, and it forbids contacting people from purchased, rented or other third-party lists in violation of applicable laws or third-party terms. Breaking it can end in a warning, a restriction or the loss of the account.
Briefly:
- HubSpot’s consent section asks for express, verifiable, documented consent before you send (section 3.1).
- It forbids contacting people from purchased, rented, borrowed or other third-party lists through its services when that breaks the law or third-party terms (section 2.1.1). Cold emails with HubSpot to people who never opted in therefore fall outside the policy.
- Cold outreach needs your own mailbox and careful habits, and the law of the recipient’s country decides whether it is allowed at all.
The quotes come from the version last modified on 2 February 2026, read on 2 October 2026.
HubSpot cold email rules in the Anti-Spam Policy
The Anti-Spam Policy supplements HubSpot’s Acceptable Use Policy and is part of the customer agreement. Three sections matter most for outreach.
Section 2.1 defines spam. It includes “(i) unsolicited bulk messages sent to recipients who have not provided verifiable, explicit consent, (ii) unsolicited commercial messages or one-to-one commercial communications that violate applicable anti-spam laws, and (iii) messages sent in violation of applicable data protection regulations.”
Section 2.1.1 is about lists. “You are strictly prohibited from using the HubSpot Services to directly contact recipients from purchased, rented, borrowed, or other third-party lists, including email append services or enrichment services lists in violation of applicable laws or third-party terms.”
Section 3.1 sets the consent bar. Messages sent through HubSpot’s services must go only to recipients who have “(i) provided express, verifiable consent to receive such communications, (ii) opted in through a clear, documented process, and (iii) not withdrawn their consent or unsubscribed.” The exceptions in section 3.1.1 cover purely transactional messages without marketing content and internal communications to employees.
What else the policy asks of senders
- Every marketing message needs a clear unsubscribe link with one-click unsubscribe, and you must keep and respect suppression lists (section 3.4).
- You must configure SPF, DKIM and DMARC and identify your organisation clearly (section 3.2).
- You must keep bounce and spam complaint rates under the ceilings the policy sets, remove hard bounces immediately and send relevant, targeted content (section 3.6).
- Messages must not mislead recipients about whether they are dealing with a human or an automated system (section 3.3).
What happens if you break it
HubSpot reserves the right to monitor sending patterns, review lists and request documentation of consent (section 4.1). Section 4.3 says violations “may result in warning, temporary restriction, suspension, account termination, or other remedies available under applicable law.” When the CRM, the website forms and the marketing all live in HubSpot, one campaign puts a lot at risk.
Why HubSpot is strict about it
HubSpot says the policy exists to protect “the integrity of our email infrastructure and users’ communications.” Mailbox providers judge mail from a shared platform partly by the platform’s reputation. Complaints about one customer’s cold list can hurt delivery for everyone else, including your own newsletters and customer emails.
What HubSpot is good for inside the rules
The policy leaves room for contacts who opted in through a clear, documented process and have not unsubscribed (section 3.1), and for purely transactional messages without marketing content (section 3.1.1). In practice that covers:
- newsletters and marketing emails to people who signed up through your forms,
- order, account and other transactional emails to your customers,
- follow-ups to people who downloaded a guide or registered for an event and agreed to hear from you.
For each of them you can show when and how the person said yes.
One-to-one sales emails: read the scope
If your team uses HubSpot for sales, the question may be about personal emails rather than campaigns. Section 1 says the policy applies to outbound communications sent directly through HubSpot’s services and to “all message types (i.e., marketing, transactional, and operational messages)”. Section 2.1 above also names one-to-one commercial communications.
How that applies to you depends on the way your emails are sent and on the law in the recipient’s country. If you are unsure, ask HubSpot before the first send.
Reaching companies with care
Some items on HubSpot’s sender list above, such as authentication, a working unsubscribe and a suppression list, belong in any cold outreach. Writing to a business that has not heard from you yet adds more. Your own mailbox provider has anti-spam terms of its own, and the consent rules of the recipient’s country apply there just as they do here. Where the law allows it, the message should read like one person writing to one company for a real reason:
- Use your own mailbox on your own domain, authenticated with SPF, DKIM and DMARC, so the reputation is yours.
- Choose companies your offer is relevant for. A clear ideal client profile keeps complaints low.
- Identify yourself, give the reason for writing and say where you found the contact.
- Include an easy opt-out in every message and honour it at once. Keep your own list of everyone who said no and check it before every send.
- Keep the volume low and each message personal.
- Read each reply yourself before you respond.
Who is responsible under the law
HubSpot’s policy is one layer. The recipient’s country decides whether you may send at all, and for a sales team the first question is who carries the responsibility. Czechia is a strict example: its data protection authority (ÚOOÚ) says both the sender and the business the message promotes are responsible, so changing the sending tool changes nothing. Its rules are stricter than the American ones. Asked whether contact details freely available online may be used for a promotional email, it answers “Nelze”, which means “You can’t”. A commercial message may go only to people who agreed beforehand, or to an existing customer you write to about your own similar products or services, whether the address is a person’s or a company’s. An email asking for consent is itself a commercial message, so that route is closed too. A reply to a specific inquiry someone sent you is not a commercial message, but you must be able to prove the inquiry.
In the United States, the FTC’s guide to the CAN-SPAM Act says the law “makes no exception for business-to-business email”. Each commercial message must explain clearly how to opt out, and opt-outs must be honoured within 10 business days. For other countries, see our article on cold email law in B2B.
How HypeLead approaches outreach
HypeLead sends from your own mailbox and your own LinkedIn, so the sender reputation stays under your control. Before sending, it warms the mailbox up, verifies SPF, DKIM and DMARC and checks the spam score. Every email gives the people you write to a one-click unsubscribe, and they can open a privacy notice page. A campaign aimed at a country that requires prior consent for business email brings up a warning and a single question for that campaign. AI prepares reply drafts, and by default you send each one with a click. As the sender, you stay responsible for who you write to under each country’s law. See how the product works and how B2B service firms use it.
The same question, asked about other tools, gets a similar answer in Mailchimp’s policy and Brevo’s anti-spam rules.
Want personal outreach from your own mailbox, checked before it goes out? Your next step is at the end of this page.
