Email Tracking Pixels: What the CNIL Recommendation Changes

The French data protection authority, the CNIL, now expects consent for most uses of an email tracking pixel. And no, the agreement to receive your emails doesn’t cover it - this is a separate consent. If you send to people in France, this concerns you and your technical providers. One caveat up front: this is a French regulator’s position, and what follows is a practical reading of it, not legal advice. Below: what changes at signup, what to do with existing subscribers, and how to report on campaigns when your open data has holes in it.

What is an email tracking pixel and why did the CNIL step in?

An email tracking pixel is a tiny, invisible image embedded in a message. The image loads, the open gets recorded. The CNIL describes it as a tracing method alternative to cookies, which is why the same consent logic applies. It only works when the mail client actually downloads pictures (a dependency we covered in our guide to images, alt text and blocking). Why step in now? Because the practice has been growing for several years, and complaints about it keep rising.

What the CNIL tracking pixel recommendation says

The CNIL adopted the text on 12 March 2026 as deliberation no. 2026-042 and published it on 14 April 2026, as set out in its final recommendation on tracking pixels in emails, following a public consultation. It addresses all organisations that use such pixels, plus their technical providers, and separates pixels that need consent from exempt ones, under article 82 of the French Data Protection Act. For addresses collected before publication, senders have three months to inform recipients clearly and let them object easily.

After a support phase with webinars for professionals, the authority intends to verify compliance as part of its regular checks.

When open tracking consent is required and when it is exempt

Short version: most tracking pixels need consent, and that agreement is distinct from saying yes to the emails. The narrow exemption covers individual deliverability measurement for messages tied to a service the recipient requested or for which consent was given. Here is how typical purposes fall:

• Consent needed: profiling based on opens, engagement scoring, personalisation driven by open behaviour, and per-recipient open reporting for marketing.
• Exempt: measuring deliverability for an individual address, within the limits described above.

What does that do to email open rate GDPR reporting? Opens turn into a metric that covers only the recipients who agreed. And because roles and purposes are assessed case by case, take the edge cases to your DPO or legal counsel.

How to collect pixel consent on the signup form

Ask at the point of collection. Tracking consent should be its own choice, separate from the newsletter subscription itself. A workable pixel consent signup form comes down to five steps:

1. Add a distinct option for open tracking and leave it unticked.
2. Explain in plain words what the pixel measures and why you use it.
3. Keep the subscription valid when someone declines tracking.
4. Record the choice together with the signup data.
5. Make withdrawal as easy as giving the agreement.

In MailCraft, that means embeddable signup forms combined with double opt-in, so go through the wording on each one. Fair warning: extra text can affect conversion. To my mind that’s a good excuse to revisit how you present lead magnets and signup forms on the page.

What to do about subscribers you already have

Good news here. For addresses collected before the recommendation was published, the CNIL only asks senders to inform recipients clearly within the transition period and give them a simple way to object. That means an information notice, not a fresh consent campaign. A short checklist:

• Segment recipients located in France.
• Write a brief notice explaining that your messages contain tracking pixels and what they measure.
• Add a visible objection link to that notice and to later emails.
• Update the privacy policy to match.
• Log who objected and when, and keep those contacts out of any segment built on open behaviour.

Measuring campaigns with clicks when opens are missing

Part of your list has no open data. Shift reporting towards clicks, click maps, replies, conversions and unsubscribes, since each of those reflects a deliberate action by the reader. Same goes for re-engagement and sunset rules: base them on click or purchase activity, or people who simply declined tracking get mistaken for inactive contacts. MailCraft supports this with clicks tracking, click maps and custom tracking domains. Dashboards need adjusting too, and our notes on reviewing email marketing reports show how to restructure them around outcomes.

So the email tracking pixel stays usable. But consent is the default now, and the deliverability exemption is narrow. Three things to sort out before summer: a separate consent choice at signup, a clear notice for existing French subscribers, and reporting built on clicks. And confirm the details with your own advisers.

FAQ