If you use email tracking pixels in France, CNIL’s 2026 recommendation generally requires consent for campaign analytics, personalisation and profiling. Limited deliverability and authentication-security tracking can be exempt when strictly necessary for a service the recipient expressly requested. 

Permission to send an email does not give you permission to track it. You also need to honour withdrawal, including for messages already sent, and check whether your existing mailing lists met the 2026 transitional requirements.

Your email service provider (ESP) may use the same open-tracking setting for mailing-list maintenance, campaign reporting and customer profiling.

What Changed in CNIL’s 2026 Guidance

An email tracking pixel is a remotely hosted image that an email client may request when displaying or preloading a message. The request can reveal a recipient identifier, its timing and an IP address.

Your ESP may count this as an email opening, although image blocking, caching and preloading can make the figures unreliable.

A pixel is not a cookie hidden inside an email. It is a different tracking technology, but it can still fall under France’s rules on accessing information on a user’s device.

CNIL adopted its final recommendation through Deliberation No. 2026-042 of 12 March 2026. The recommendation was published on 14 April 2026, followed by a professional FAQ on 22 July 2026.

These are clarifications of existing rules, not a new ban on email tracking. Article 82 of the French Data Protection Act implements the terminal-access framework under Article 5(3) of the ePrivacy Directive. The European Data Protection Board Guidelines 2/2023 explain its technical scope.

The GDPR separately governs personal-data processing and valid consent. If you operate across Europe, bear in mind that CNIL’s specific recommendations concern the French framework and are not automatically mandatory in every country.

When Email Tracking Pixels Require Consent

You generally need prior consent to measure how individual recipients respond to marketing emails.

The main consent-required uses include:

• Campaign analytics and optimisation: Measuring individual openings to evaluate performance, change marketing frequency or adjust future campaigns.
• Personalisation and lead scoring: Using opening behaviour to tailor offers, select content or identify promising sales contacts.
• Cross-channel profiling: Combining email engagement with website, app or other behavioural information to build customer profiles.

Suppose your customer relationship management (CRM) system notifies a salesperson when a prospect opens a promotional email. You are using that information to improve a campaign or prioritise a lead, not to maintain deliverability.

An aggregated dashboard does not exempt the underlying collection of individual opening events. CNIL does allow information lawfully collected through an exempt pixel to be effectively anonymised and reused for aggregated campaign statistics. That does not authorise unnecessary collection at the outset.

When Consent Is Not Required

CNIL recognises two narrow exemptions to the consent requirement. Neither exemption applies simply because your ESP describes a feature as necessary or security-related.

Deliverability management. If someone has expressly requested an email service, you may be able to use opening information where it is strictly necessary to manage its delivery.

For example, you might identify inactive recipients, reduce how often they receive messages or stop emailing them. In appropriate circumstances, contacting them through another lawful channel may also qualify.

If you start using the same opening events to personalise marketing or identify sales opportunities, that additional purpose requires consent. You therefore need to understand where the data go, particularly if your ESP exports them into a CRM or another marketing platform.

CNIL recommends limiting deliverability data to the last known opening date, recorded at day-level precision and replaced after another opening, rather than prescribing a specific database structure.

If you need more information, you must document why. Collecting unnecessary IP addresses or device details and deleting them afterwards does not resolve the initial collection problem.

Authentication security. CNIL also recognises an exemption where a pixel is strictly necessary to protect a requested authentication function. A password-reset email is one possible example, particularly where opening information helps detect suspicious activity associated with that process.

You cannot extend this exemption to general advertising-fraud detection or unrelated bot analysis.

You may use the same pixel for exempt and consent-dependent purposes, but any additional purpose requiring consent must remain inactive until you obtain it.

Even exempt tracking remains subject to applicable GDPR transparency and individual-rights obligations. CNIL also recommends informing recipients about such pixels.

Consent to Receive an Email Is Not Consent to Be Tracked

You may be allowed to send an email under French electronic-marketing rules while still needing consent for the tracking pixel inside it.

CNIL treats abandoned-cart reminders as promotional, while adding offers to an otherwise transactional email can change how the message is classified.

If you use the same tracking settings for newsletters, sales campaigns and account notifications, review each use separately. The fact that your ESP offers one setting does not mean every message qualifies for the same exemption.

How to Collect and Document Email Pixel Consent

CNIL recommends asking for consent when you collect someone’s email address, such as during newsletter signup or account registration.

1. Explain what you want to track

   Tell the recipient who is responsible, which address the choice covers and how you intend to use opening information. Tracking may occur across different devices.

   Instead of asking for permission to collect “marketing insights”, tell the recipient: “We use your email opens to personalise future newsletters.”

2. Obtain an affirmative choice

   You cannot treat silence, continued receipt or failure to opt out as consent. If you track emails for unrelated purposes, such as newsletter personalisation and advertising profiling, provide separate choices.

   CNIL does allow closely connected email and tracking purposes to share one clearly explained consent. A personalised newsletter whose content depends on opening behaviour is one example. If those purposes are inseparable and properly explained, refusing consent may mean the recipient cannot receive that particular newsletter.

   You do not need a separate checkbox for every tracking pixel.

3. Allow consent to be collected later

   If you did not ask when collecting the address, you can request consent afterwards. The request email itself must not contain a pixel that requires consent.

   You can link to a preference page where recipients actively accept or refuse tracking. Automatic link prefetching cannot count as agreement.

4. Keep evidence of the decision

   Under GDPR Article 7, you need to demonstrate valid consent. Keep the decision, its date, the relevant address, the purposes covered and the version of the information shown at the time.

   If you obtain leads or consent records from another organisation, do not rely solely on a contractual statement that consent was collected. You need access to supporting evidence and appropriate checks.

You can use a Consent Management Platform (CMP) to collect the choice, but an ordinary website Cookie Consent interface does not necessarily cover tracking in emails. Your notice must expressly explain the email purposes and which communications the decision covers.

Withdrawing Consent and Stopping Tracking

Your recipients must be able to withdraw consent as easily as they gave it. CNIL recommends providing a convenient link in emails, and you can use a preference centre to manage both subscriptions and tracking choices.

Where those purposes are separate, someone should be able to continue receiving messages without being tracked.

Unsubscribing from a newsletter and withdrawing pixel consent are not necessarily the same action. If one valid consent covers both newsletter personalisation and tracking, withdrawing it may also stop that newsletter.

Previously sent emails need attention too. A recipient can reopen an old message long after withdrawing consent, and its original tracking URL may still work.

Your tracking endpoint must stop consent-dependent collection from previously sent messages, for example by disabling the relevant identifier or suppressing further processing.

You must also delete previously collected personal data unless another valid legal basis justifies keeping them.

If your ESP operates the tracking endpoint, establish how withdrawal is enforced and who can disable tracking for individual recipients. If your provider uses tracking data for its own purposes, it may also have controller responsibilities rather than acting solely as a processor on your instructions.

Reopen an older email after withdrawing consent and check whether tracking continues. Testing more than one email client is useful because image proxying and preloading can affect the requests you observe.

What About Email Lists Collected Before 14 April 2026?

CNIL allowed a temporary arrangement for email addresses collected before publication of its recommendation.

14 April 2026 — Publication of the recommendation.

If you collected an address before this date, CNIL allowed you to provide clear information about tracking and give the recipient an easy opportunity to object.

14 July 2026 — Ordinary transition deadline.

The three-month period ended on this date. CNIL recognised reasonable extensions only where implementation difficulties were objectively justified and documented.

If you failed to provide the required information within the applicable period, you must stop consent-dependent tracking unless you have valid consent.

Where recipients were properly informed and did not object, tracking may continue under the existing conditions, provided no new consent is required.

You cannot use this temporary arrangement to justify new tracking purposes, materially changed campaigns or tracking associated with addresses collected after the recommendation was published.

Your Email Tracking Compliance Checklist

• Find every pixel: Review newsletters, CRM automations, transactional templates and your ESP’s default settings.
• Identify each purpose: Separate campaign reporting, personalisation, profiling, deliverability and authentication security.
• Check sending permission: Assess whether you may send the email independently of whether you may track it.
• Justify exemptions: Document the requested service, strict necessity and data minimisation.
• Review message types: Include B2B prospecting, newsletters, similar-product marketing and promotional additions.
• Update consent wording: Identify the tracking purposes, responsible organisation and relevant email address.
• Separate unrelated choices: Do not bundle newsletter personalisation with unrelated advertising profiling.
• Audit existing lists: Confirm how you handled the April–July 2026 transition.
• Provide withdrawal: Make tracking preferences accessible without unnecessary steps.
• Handle old messages: Ensure withdrawal stops consent-dependent tracking through previously issued pixel URLs.
• Retain evidence: Keep consent records and supporting proof obtained from third parties.
• Test your setup: Compare consented and non-consented recipients, withdraw consent and reopen an old email.

How CMPs Might Help You Manage Tracker Consent

A Consent Management Platform (CMP) can help you collect and document tracking choices on your website. To use those choices for email tracking pixels, you also need to link them to the relevant email addresses and ensure your email systems follow them.

The most relevant CMP features include:

• User consents recording lets you keep evidence of the choices visitors make on your website. If you collect email-pixel consent through that interface, you also need to record which email address and purposes the decision covers.
• Consent events can help you detect when a visitor accepts, refuses or updates a website tracking preference. You can use those events in a separately configured process for updating the relevant consent records in your CRM or email platform.
• Geo targeting helps you display different website consent configurations by location. This can be useful when you operate internationally, although website location detection does not establish which rules apply to every email recipient.
• Cookie Scanner helps you identify website cookies, scripts and trackers, including those on signup or preference pages. You still need to inspect your ESP separately for pixels inserted into outgoing emails.

Other CMP features include:

• Third-party cookie blocking
• Automatic script blocking
• Google Consent Mode v2
• Google Tag Manager integration
• IAB TCF 2.4 integration
• Automatic monthly scans
• Advanced reporting
• Cookie Banner sharing
• Global privacy regulation support
• 42 languages
• Privacy Policy Generator
• Cookie Policy Generator

CookieScript is a Consent Management Platform (CMP) that Google includes among the CMP partners available for Consent Mode setup. It is also a Google-certified CMP with Gold tier status.

A 14-day free trial of the Plus plan is available without requiring a credit card.

These features help you manage website tracking and consent, but they do not automatically control pixels embedded in outgoing emails. You must still configure your ESP and tracking endpoint to respect email-specific choices, including refusals and withdrawals.

The Bottom Line

Our advice: treat your ESP’s “track opens” switch as a compliance decision, not just a reporting feature. Get consent for campaign analytics, personalisation and profiling, and reserve the narrow deliverability and authentication-security exemptions for cases you can actually justify.

Keep permission to send separate from permission to track, document your recipients’ choices, and make withdrawal work for old emails too. If you relied on the 2026 transition for addresses collected before 14 April, check that you met its conditions. A CMP can help manage consent, but your ESP must enforce it.

Unfortunately, there’s no “make this legal” checkbox next to “track opens”.