Email open tracking pixel: what changes for marketing campaigns
June 1. 2026
The recent publication, on 14 April 2026, of the final recommendations from the Commission Nationale de l’Informatique et des Libertés (“CNIL”), the French data protection authority, on tracking pixels in emails invites brands to review certain uses of email opens, without calling into question the sending of marketing communications to newsletter opt-in contacts.
As a reminder, an email open tracking pixel is an invisible pixel embedded in each email sent to detect whether the recipient has opened the email. In email marketing campaigns, open tracking pixels are used to personalize communications, improve certain deliverability parameters, or build segmentations.
Following numerous consumer complaints, the CNIL decided to review the legal framework around the use of open tracking pixels in emails. This change impacts French contacts in databases, as well as any contacts whose device is located in France when the email is opened. This article is therefore also intended for non-French companies that communicate with contacts located in France.
For brands operating in other European markets, it is necessary to remain vigilant about how legislation evolves across Europe, especially if they choose to implement a market-by-market strategy. This regulatory movement is not limited to France. For instance, the Garante, the Italian data protection authority, adopted its own Guidelines on the use of tracking pixels in email communications on 17 April 2026 (decision no. 284, published in the Gazzetta Ufficiale on 29 April 2026). Other European authorities may follow and publish similar texts in the coming months.
For marketers, this topic is not entirely new. The open rate had already been weakened by Apple Mail Privacy Protection in 2021, as well as by other protection mechanisms introduced by mailbox providers, such as image proxies in Gmail and Outlook. Since then, the open rate can no longer be interpreted as a reliable measure of a contact’s engagement.
In deliverability, an open is a positive signal, but it is not necessarily a reliable engagement signal. It does not indicate whether the contact actually read the message. The CNIL update therefore adds to a context in which open rates already need to be interpreted with caution.
What does the CNIL require?
The insertion of open tracking pixels in emails now requires the recipient’s prior consent. This consent must cover the use of the pixel, and not only the sending of the email.
A transactional email, such as an order confirmation, an account alert, or a password reset email, can be sent without marketing consent. However, if the pixel embedded in that email is used to feed the CRM, trigger a cross-sell campaign, or measure an engagement score used to personalize future campaigns, then it no longer falls under a purely transactional purpose. In that case, consent for the use of the pixel becomes necessary.
When does the open tracking pixel require consent?
The recipient’s consent is required when the tracking pixel is used for marketing purposes. This is the case when it is used to analyze opens in order to optimize email sends, or to understand a contact’s interests in order to better target them.
Consent is also required when the data collected through the pixel is used to enrich a contact’s marketing profile. This includes, for example, segmentation, scoring, personalization, or targeting on other channels.
When does the open tracking pixel not require consent?
Some pixels may be exempt from consent when they are strictly necessary for a non-marketing purpose. This is notably the case for pixels used for security reasons, for example to protect the user during a login, authentication, or a sensitive action on their account.
The CNIL also provides for a possible exemption for certain uses related to deliverability. In this case, the pixel may be used to check that emails are correctly received or to avoid continuing to send messages to contacts who have been inactive for a long time. However, this exemption requires that the data collected be limited to this purpose and not reused to measure marketing performance, profile contacts or personalize future campaigns.
What can no longer be done in email marketing
In practice, opens can no longer be used as a marketing trigger without consent. This means that a brand can no longer activate scenarios based solely on whether an email was opened, for example to follow up with openers or non-openers after a one-off campaign.
The same principle applies to automated campaigns built around open inactivity. If a scenario aims to retarget contacts because they have not opened recent emails, or to adjust marketing pressure based on this data, it relies on open data used for marketing purposes. It therefore falls within the scope of consent.
What can still be done
Opens do not disappear entirely from CRM and deliverability practices. It remains possible to create segmentations based on the last open, notably to exclude very inactive contacts from the start and limit sends to more engaged audiences. For example, it is still possible to identify openers over the last six months as part of a strategy to manage contact pressure and maintain database quality.
Campaign reports can also continue to include open statistics, provided they are anonymized and used at an aggregated level. The objective is no longer to identify an individual contact’s behavior, but to provide an overall view of performance.
Finally, open rates can still be monitored by ISP for deliverability purposes. This view helps detect potential reception issues or inbox blocking, without using opens as an individual signal for marketing targeting.
What are our recommendations?
The first step is to audit existing practices. Before modifying forms or scenarios, brands need to identify all current uses of the open pixel: performance measurement, segmentation, scoring, personalization, campaign triggering, inactivity management, deliverability monitoring, and transactional uses. This audit should make it possible to distinguish between uses that are subject to consent and those that may, where applicable, be exempt.
At Splio, we then recommend setting up a strategy based on two distinct consent statuses.
The first relates to the newsletter opt-in: the contact agrees to receive communications from the brand by email.
The second relates to the use of the open pixel: among newsletter opt-in contacts, brands will need to distinguish those who agree that the brand may use the open pixel for marketing, scoring, personalization, or targeting purposes.
For newsletter opt-in contacts who are opt-out from the open pixel, the brand will still be able to send marketing communications by email. However, it will not be able to rely on open data from a given campaign for segmentation or marketing activations. For example, these contacts should not be included in follow-ups built around opener or non-opener status.
For the contacts suscribed 14 april 2026, brands must inform the contacts before July 14th 2026 about the use of tracking pixels and allow them to object to this tracking for future emails.
Contacts who request not to be tracked must be excluded from the use of the open pixel.
Contacts who do not object may continue to be tracked.
It is not necessary to target the entire database with this communication. It is preferable to address contacts who are usually targeted by newsletters or marketing communications, in order to limit the impact on deliverability. Before this communication, it is also recommended to clean the database, notably by removing contacts who have been inactive for a long time, to avoid degrading sending performance.
In parallel, data collection forms should be adapted to include a dedicated field for consent relating to the open pixel. This field must be distinct from the newsletter opt-in, so that the contact can clearly understand what they are agreeing to: receiving marketing communications by email, and/or authorizing the use of the open pixel for marketing purposes.
For retailers who also collect newsletter opt-ins in-store, two approaches are possible:
The first is to collect a separate consent for the use of the open pixel directly in-store, in addition to the newsletter opt-in. This option is possible, but it may be more difficult to explain clearly in a sales or quick registration context.
The second approach is to send a newsletter subscription confirmation email, in which the brand asks the contact whether they also agree to the use of the open pixel for marketing purposes.
If the contact clicks to give their agreement, they become opt-in for open tracking.
If they do nothing, they are subscribed to the newsletter but are not considered opt-in for the open pixel.
This approach makes it possible to clearly separate consent to receive email communications from consent to the use of the open pixel.
After 14 July 2026, all new contacts will need to opt in to newsletter subscription and to the use of the open tracking pixel. The objective is to allow the brand to continue communicating with newsletter opt-in contacts, while respecting their choice regarding the use of open data.
If the brand chooses to collect explicit consent through a form, a preference center, or a dedicated campaign, the open pixel opt-in must not be pre-ticked. In this case, the contact’s lack of action cannot be interpreted as free, specific, informed, and unambiguous consent.
We will share more information in the coming weeks to help brands understand this change and its operational implications.