The French Data Protection Authority (CNIL) has released its final recommendations on the use of email tracking pixels, which provide guidelines on when digital marketers can monitor email activity and when they must first obtain user consent. This complements the existing GDPR and Google’s bulk senders guidelines for digital marketers.
In the recommendations, CNIL notes that companies cannot use invisible tracking pixels embedded in emails (hidden images that load when an email is opened for open rate and engagement tracking purposes) without explicit user consent.
The consent should contain the following details;
- Clearly explain what tracking pixels do
- Identify which email address the consent applies to
- Make it as easy to refuse tracking as it is to accept it
- Provide a simple link in every email to withdraw consent
- Not ask users to provide their email address again when withdrawing consent
CNIL also recommends allowing users to accept or reject each tracking purpose separately instead of bundling multiple purposes into one consent option.
However, some tracking activities can continue without consent if they are strictly necessary. Examples of such tracking include:
- Security measures used during user authentication,
- Monitoring email deliverability to remove inactive email addresses
- Transactional emails such as Order confirmations, Password reset emails, Shipping notifications, Account alerts, Appointment reminders, and Customer service responses.
- Public sector organizations may also qualify for exemptions when emails support public service missions.
The authority encourages organizations to obtain consent when users first provide their email address. Where consent was not collected at that stage, businesses should send a separate email requesting permission. That consent request email should not itself contain tracking pixels.
If you are a business sending marketing emails, a public sector organization, an email marketing service provider, or a third-party analytics provider, you should ensure that you have complied with the requirements by July 14th.
The recommendations were first published on April 14, 2026, with a compliance deadline set after 3 months which will be July 14, 2026.
You can read the French version of the full recommendations.
