To maintain the privacy of contacts within the HubSpot database, we will be sunsetting the ability to pull the IP address of Contacts via HubSpot’s API or the exports of email event (emailEvents) records.
Geo-location data (e.g. city, state, region, country, timezone, etc.) derived from the IP address will continue to remain accessible via the API and on contact records within HubSpot.
What’s changing?
The sunset of the IP address from HubSpot’s APIs will affect the following:
Email APIs: Event APIs & Event Exports All existing IP location data will be purged from our datastores.
Contacts APIs: The `ip_address` contact property will be removed. This property will no longer be accessible via the API. Associated IP location properties will continue to function as they do today.
Subscriptions API Timelines: IP data will still be stored for subscriptions compliance with a 3 year Time to Live, but will not be publicly accessible.
When is this happening?
The sunset will take place on Monday, May 29, 2019.
Can you elaborate a bit on why this was done? Is there any legal requirement?
I use IP targeting regularly in our advertising (mostly to avoid targeting remote employees or message segmentation). This feels abrupt/extreme to come without warning if there was no legal requirement to do so.
Yes- there was a legal requirement for it. The decision was made because IP addresses is considered personal data under some data privacy laws. Further, IP address is considered more sensitive data as it deals with location and requires consent for collection and processing.
These aren't new laws. They are existing data privacy laws (such as GDPR or other data privacy laws like it). This is higher risk data. Thus we didn't feel that it was necessary for us to continue to collect it on contact records.
What specifically prompted the need for removal of reporting IP addresses? I assume it was for legal reasons, but is there a specific law or legal ruling that HubSpot is attempting to be in compliance with as a result of this change?
Yes, the decision was made because IP addresses is considered personal data under some data privacy laws. Further, IP address is considered more sensitive data as deals with location and requires consent for collection and processing.
