The CNIL wants to regulate email tracking: what you need to know

Email tracking is in the sights of the CNIL. The French Data Protection Authority (Commission Nationale de l'Informatique et des Libertés) recently published a draft recommendation on tracking pixels that could upset your emailing practices. This makes sense: tracking data can be considered personal data requiring explicit consent under the GDPR. We've deconstructed the document for you.

The draft recommendation can be viewed here : https://www.cnil.fr/fr/consultation-publique-projet-recommandation-pixels-de-suivi

Key points to remember

For the time being, CNIL only targets the open rate. But let's face it: click-through rate is likely to be next on the list in the coming year.

Please note: this project concerns both B2C and B2B! And this, even though consent to receive prospecting/retail emails is not required in B2B. (surprising, isn't it?)

What you can still do without consent

• Measure overall opening rates (not by name)
• Maintain subscriber security tracking (e.g. password reset emails)
• Keep the tracking necessary for the execution of a contract with your customer
• Analyze the deliverability of your campaigns (e.g.: analysis of opens by e-mail domain): data anonymized at campaign level (or even by recipient domain) will remain usable without consent.

This will require explicit consent

• Identify who individually opens or clicks on your emails
• Target your contacts according to their opening behavior
• Perform A/B tests based on opening rate
• Determine your contacts' interests based on their reading behavior
• Tailor your mailing frequency to individual behaviors
• Personalize your content according to the opening interactions of each contact

Action plan for brands

First decision point: would you like to track individual email opens? Is this necessary to your emailing strategy?

If this is the case, here are the actions you'll certainly need to plan:

• Update your forms by adding a checkbox (not pre-checked) such as: "I accept that [Your Brand] uses trackers to adapt emails to my reading behavior".
• Launch a campaign to collect consent from your existing customer base
• Include a "detracking" link in all your emails (the CNIL requires that consent can be withdrawn at any time).
• Rethink your targeting and personalization strategies (in particular your definition of "inactive" contacts)
• Set up a system to retain proof of consent
• Block off time between now and the end of the year to implement these new recommendations (prevention is better than cure!).

Is it really the end of the world?

Let's be honest: when it comes to targeting, personalization and A/B testing of objects based on openings, things are looking pretty bleak. Even with the best re-targeting campaign in the world, there's little chance of obtaining the consent of the majority of your existing contacts.

But let's not forget something we've been saying for years: the open rate is already not very reliable (it's still useful for tracking trends by e-mail operator, but not on an individual level). Isn't this new regulation the perfect opportunity to mourn the passing of this overvalued indicator? Is it really a great loss? Couldn't we take advantage of this change to focus on more qualitative and relevant data?

For companies already aware of the limits of the open rate, the impact will be limited. However, many still use this criterion to define their inactive segments (paradoxical, isn't it?) or rely on predictive tools that integrate this data into their targeting and personalization algorithms.

For those who have not yet questioned their practices, adaptation will certainly be more difficult.

On the other hand, click tracking remains (for the time being) a valuable indicator: it enables us to identify interests, refine segmentation, reduce mailing volumes and thus commercial pressure. If tomorrow's CNIL also attacks link tracking, that'll be a different kettle of fish!

What's next?

At Badsender, we're following this issue like the proverbial proverbial cat, and we're planning a live broadcast at the start of the new school year to help you make sense of these changes. The best way to find out the exact date is to subscribe to our emailing newsletter. You should also be aware that the suppliers of e-mail databases and the routers that manage tracking are becoming co-responsible for processing. Don't hesitate to ask them about their adaptation plans and share their answers with us in comments or via our contact form. We'll be adding to this article as we receive feedback from the field.