The French data protection authority (CNIL) has published its final recommendation on tracking pixels in email. It has applied since 14 July 2026, and the principle is simple: a tracking pixel is treated like a cookie. That means email tracking pixel consent is now a separate permission, on top of the permission to send the email itself.
Almost every commercial email contains a tracking pixel. If you email French contacts, this affects you today. If you don’t, there is still a strong case for getting ahead of it.
In short
- Since 14 July 2026, the CNIL treats an email tracking pixel like a cookie: it needs its own, separate consent.
- It is a French interpretation of the existing ePrivacy rules, not a new EU law. It applies to French recipients and to processing through a French entity.
- Contacts without tracking consent stay in your database. You can still email them, just without a pixel.
- We expect other European regulators to follow. Collecting tracking consent EU-wide now saves you a second consent round later.
What the CNIL recommendation says
The CNIL (Commission Nationale de l’Informatique et des Libertés) published its final recommendation on tracking pixels in emails. Under the ePrivacy rules, a pixel that records whether and when someone opens an email is now treated in the same way as a cookie. It therefore requires explicit consent from the subscriber, separate from their consent to receive emails.
An important nuance: this is not a new law. It is France’s interpretation of existing ePrivacy rules. It applies to your French contacts and to data processed through an entity established in France. It does not automatically apply to your whole EU database.
the CNIL rule has applied since this date
separate consents: one to receive email, one to be tracked
contacts you lose: without consent you simply send without a pixel
Do you email French contacts? Four steps to take now
The deadline has passed, so if you haven’t acted yet, these four steps are urgent. If you have, use them as a check.
1. Map your database
Find out how many French contacts are in your database, and whether you process their data through a French entity.
2. Ask for tracking consent in a pixel-free email
Send your French contacts an email without a tracking pixel that explicitly asks for consent to track opens and clicks. How you set this up depends on your email platform. We can advise you on the technical side.
3. Add a separate checkbox to your forms
Every sign-up form, and every booking or checkout flow where people join your database, needs a separate checkbox for email tracking consent. If you can’t change a form quickly, collect the consent through a dedicated, pixel-free email instead.
4. Split your sends
Only send emails with a pixel to contacts who have explicitly opted in. Everyone else stays in your database and keeps receiving your emails, just without a pixel. In practice, you lose visibility on opens and clicks for that segment, but you keep the contact.
Quick check for your French contacts
- You know how many French contacts are in your database
- A pixel-free consent email has gone out
- Sign-up and booking forms have a separate tracking checkbox
- Your platform sends with a pixel only to contacts who opted in
- Your reports show which segment is tracked and which isn't
No French contacts? Get ahead of it anyway
You are not bound by the French rule. But we don’t expect France to be the only country to take this view. Consent to receive an email is not the same as consent to be tracked inside it, and other European regulators are likely to adopt the same logic.
Fewer people tend to give consent through a separate email than through a checkbox at sign-up. Setting up one EU-wide standard for tracking consent now has two advantages:
- Your processes stay simple and consistent across all your markets.
- Every new contact has already given tracking consent, so you don’t need to ask your database again when the rules change elsewhere.
Also read why open rates are no longer a reliable KPI: one more reason to steer on clicks and conversions rather than opens.
“Losing tracking consent doesn’t mean losing the contact, it means going partially blind on opens and clicks for that segment.”
Email team, Red Online Marketing
Backed by DDMA's legal expertise
Red Online Marketing works with DDMA, the Dutch association for data- and marketing-driven companies. Through DDMA we have access to specialised legal advice on exactly these developments, so we can help you turn the rules into the right approach for your situation and your tools. Our email specialists at Wander Journeys handle the technical set-up in your email platform.
