Problem
In HubSpot’s native Double Opt-In (DOI) process, a contact’s activity timeline shows that a confirmation email was sent, but the link tied to that activity always opens the currently active version of the confirmation email template, not the version that was actually in effect and sent to the contact at that point in time. If the template content is edited later, the historical activity entry reflects the updated content rather than what the contact originally received.
There is currently no mechanism, documented or undocumented, to retrieve or export the exact historical version of a native DOI confirmation email as sent to a specific contact at a specific point in time. The system records the send event and confirmation status with timestamps, but it does not store a snapshot of the rendered email content per send.
Why this matters
Under Article 7 GDPR, a data controller must be able to prove that a data subject gave valid consent. A recent German administrative court ruling (Verwaltungsgericht Düsseldorf, 29 K 9714/24, judgment of 27 July 2026) confirmed that metadata alone, such as an IP address and timestamp, is not sufficient proof of consent, and placed clear weight on whether the actual confirmation email content, as sent, could be produced.
This is not Germany-specific. Article 7 GDPR applies across the entire EU and EEA, so any HubSpot customer relying on native DOI for consent management faces the same evidentiary gap, regardless of country. Germany may currently be ahead in enforcing this in practice, but the legal basis is the same for all HubSpot customers operating under GDPR.
Court ruling reference: Verwaltungsgericht Düsseldorf, 29 K 9714/24
Requested feature
-
Version-control the native DOI confirmation email content per send event, so each version sent is stored as an immutable snapshot.
-
Link each contact’s activity timeline entry to the specific version that was actually sent, instead of the currently active template.
-
Provide a way to export or print that historical version per contact, to support audit and legal defense requirements under Article 7 GDPR.
Impact
Any HubSpot customer operating under GDPR (EU/EEA) who uses or wants to use the native DOI process is affected. Customers with strict evidentiary requirements for consent proof, especially in DACH markets, are forced to maintain custom workflow workarounds instead of using the native DOI feature, because the native process cannot produce the exact confirmation email content as sent when needed for legal defense or audit.