Email tracking pixels after CNIL's July 2026 deadline: what marketers must change

Every marketing email you have sent in the last fifteen years almost certainly contained a one-pixel image with a unique URL. When the mail client fetched it, your platform logged an "open". Open rate became the first number on every campaign report and the trigger for every re-send automation.

On 12 March 2026 the French data protection authority adopted a recommendation, published on 14 April 2026 and in the Journal officiel as Délibération n° 2026-042, that treats that pixel the same way it treats a cookie. It requires prior consent for most uses, gives a short list of exemptions, and set a transitional period for existing databases that ended on 14 July 2026. Italy's Garante followed with its own provision in April. The UK ICO's May 2026 guidance lists pixel tracking among the technologies PECR covers.

The deadline has passed. This is what changed and what a marketing team should do now.

What the CNIL actually said

The legal basis is Article 82 of the French Data Protection Act, the national transposition of the ePrivacy Directive's rule on storing or accessing information on a user's device. A tracking pixel causes the mail client to fetch a URL that identifies the recipient; the CNIL considers that an access to the terminal, and therefore something that needs either consent or an exemption.

Consent is required for, among other purposes, measuring open rates to evaluate campaign performance, building recipient profiles for targeting, and tracking individual opens for deliverability beyond narrow conditions. Campaign-performance open tracking, the default in every ESP, is squarely inside the consent requirement.

Exempt from consent are two narrow families, as the CNIL's own FAQ lays them out:

• Security: pixels that protect an authentication mechanism or a password-reset flow.
• Deliverability and list hygiene: pixels used only to detect inactive recipients so that sending frequency can be reduced or the address removed, and to evaluate or adapt the communication channel.

The exemptions carry a condition: the email itself must have been explicitly requested by the recipient or be part of a service they asked for. A newsletter someone subscribed to qualifies. A prospecting email sent under the "similar products and services" soft opt-in does not; the FAQ is explicit that in that case the pixel exemption does not apply and consent becomes necessary.

Scope is broad. The FAQ answers the B2B question directly: the recommendation covers "any use of tracers in emails", regardless of whether the recipient is a customer, prospect or employee. Click-tracking links are not the direct target, but the same Article 82 analysis applies to any link that carries an identifier, and the CNIL expects senders to assess whether it is strictly necessary.

What the 14 July 2026 date meant

The recommendation created a three-month transitional regime for addresses collected before 14 April 2026. During that window, a sender could keep using pixels on those recipients provided it sent them clear, accessible information with a real possibility to object. If the information was sent before 14 July, the opt-out basis continues for that legacy base. If it was not, the FAQ is unambiguous: consent becomes mandatory for continued pixel use. The CNIL leaves room for documented, reasonable extensions where a sender can show genuine difficulty, but that is a case-by-case defence, not a policy.

For everyone added after 14 April 2026, there was never a transitional period. Consent had to be in place from the first email.

Two points of nuance matter. First, the recommendation is soft law, not a regulation, but the CNIL has said non-compliant organisations "may be subject to enforcement action", and its cookie decisions show what its Article 82 enforcement looks like: the American Express decision in November 2025 found trackers placed without consent, placed despite refusal, and read after withdrawal, and cost €1.5 million. Second, jurisdiction follows the recipient. A UK or US sender with French subscribers is inside the recommendation for those subscribers.

Italy and the UK

The Garante adopted Provision No. 284 on 17 April 2026, published in the Official Gazette on 29 April, treating open-tracking pixels as device access in the same category as cookies and requiring opt-in consent where a pixel measures opens or feeds promotional profiling. Exemptions cover anonymised aggregate counts through non-individualised pixels, security, and legally mandated service messages. Its transitional period runs six months from publication, to 29 October 2026. That summary comes from a trade source; check the Garante's text before relying on the detail.

The ICO's updated cookie guidance of May 2026 lists "pixel tracking" among the storage and access technologies PECR covers and states that pixels used for advertising and attribution require consent. Combined with the Data (Use and Access) Act raising PECR's maximum penalty to £17.5 million or 4% of turnover from February 2026, email pixels in the UK are now inside the same regime as website cookies.

What marketers must change

The following is a sequence, not a menu. It reflects what the major French-market ESPs have already built.

1. Split the pixel into two purposes

Your platform's single "open tracking" switch conflates two things the CNIL treats differently: campaign measurement (consent) and list hygiene (exempt, under conditions). Decide which you are doing for each send. If the honest answer is "both", the send needs consent.

2. Collect consent at the point of address collection

The recommendation expects consent when the email address is gathered, or, failing that, via an email that contains no consent-requiring pixel. In practice: a separate, unticked checkbox on every sign-up and preference form, with a short label and a link to a fuller description. Bundling pixel consent into the newsletter opt-in is not acceptable; the FAQ allows a global consent only where the user can make independent choices per purpose on a second level.

3. Make the pixel conditional per contact

The ESPs have converged on the same design. Brevo added per-contact pixel tracking consent, a consent checkbox for forms, an API field contactPixelTrackingConsent, and automatic attributes recording status, date and source. Batch uses a native attribute $email_open_tracking_consent with granted, denied or empty, inserting the pixel only when granted. If your platform does not offer a per-contact flag, the workaround is segment-level: two audiences, one sent with tracking on and one with tracking off, and a hard rule that the "off" segment includes everyone without a recorded consent.

4. Add a pixel-specific withdrawal link

The recommendation asks for withdrawal to be as easy as consent, via a link in the email itself. Both ESPs above ship a footer placeholder for it (Brevo's is {{ revoke_open_pixel_tracking }}). It must be separate from unsubscribe, and it should land on a page that revokes without asking the recipient to re-enter their address.

5. Document the consent

For each contact: what they were shown, what they agreed to, when and where. This is the same evidentiary standard the CNIL applies to cookies, and the same gap that turns a warning into a fine when a regulator asks and the answer is "the ESP handles it".

6. Handle the legacy base honestly

If you sent the information email before 14 July, keep the record of it (Batch recommends exporting send records 24 hours after completion) and honour every objection. If you did not, the pixel should now be off for those contacts until you have collected consent, which you can do through an untracked email with a single, clear ask.

7. Audit the flows nobody looks at

Transactional and automated emails carry the same pixel as campaigns. Order confirmations, password resets and account notifications are more likely to be exempt (security, requested service), but a "your order shipped" email with a product-recommendation block and a marketing pixel is a mixed-purpose send. Brevo's guidance is to audit automation and transactional flows for mixed-purpose sends, and it is right.

Rebuilding measurement without opens

The uncomfortable truth underneath all of this is that open rate stopped being a real metric in 2021. Apple's Mail Privacy Protection, launched with iOS 15, pre-fetches every image in an email through Apple's proxy, often within minutes of delivery, whether or not the recipient opens it. With Apple Mail accounting for roughly half of email opens by client share, a large fraction of "opens" are machine fetches. The CNIL is regulating a signal that was already unreliable.

That reframes the compliance work as an opportunity to move to metrics that still mean something and that do not depend on a pixel:

• Clicks, with consent for the identifier. Click tracking is not the recommendation's direct target, but the identifier in a tracked link is. Decide whether per-recipient click attribution is strictly necessary; for most campaigns, campaign-level UTM parameters without a recipient ID give the same reporting and sit outside the consent question.
• Conversions and revenue. Attribute to the campaign, not the person, unless the person has consented.
• Replies, forwards, list growth, complaint rate, unsubscribe rate. All observable without a pixel.
• Deliverability signals. Bounces, spam-folder placement via seed lists and postmaster tools, and the exempt hygiene pixel where you have kept its use narrow.
• Consent rate itself. The share of your list that has opted into tracking is now a metric. It tells you how much of your engagement data is usable and how well your forms explain the ask.

A checklist for the next sprint

1. Inventory every template, campaign and automation that includes an open pixel.
2. Classify each by purpose: measurement, profiling, hygiene, security.
3. Confirm the ESP supports per-contact pixel consent; if not, build the two-segment workaround.
4. Add a separate, unticked pixel-consent checkbox to every collection form.
5. Add a pixel-specific revocation link to every footer.
6. Record consent status, date and source as contact attributes.
7. For the pre-April 2026 base, locate the proof of the information email or switch the pixel off.
8. Repeat for Italian recipients before 29 October 2026, and treat UK recipients the same way.
9. Move dashboards from open rate to click, conversion and consent-rate metrics.

Email pixels are one part of a wider question: what fires without consent across your properties? The same Article 82 logic applies to your website, where the CNIL's 2025 and 2026 decisions found the same three behaviours (tracking before consent, after refusal, after withdrawal). TagPatrol's free scan at tagpatrol.app checks one page in one consent state and returns the first five findings; the full audit replays all three states across your pages. It is a quick way to see whether the web side is in the same shape as the email side after this sprint.

Written by TagPatrol's AI content team and reviewed under human direction.