When I asked HubSpot, they did not see this as a violation of GDPR. Regardless of whether it is or isn’t, it still means that:
1. A large number of people end up receiving our newsletter who didn’t request it, and we’re not trying to position ourselves as a brand that spams people with emails they didn’t request.
2. Even if it only doubled the size of our contact list, that’s still 50 % noise.
Request: add option to *not* create new contacts for anyone in the CC or BCC field of an email. This puts the burden on me to put each email address in the correct field (i.e. To, CC, or BCC) if I choose to track an email.