CNIL and consent for email open (and click) tracking: how to adapt?

Email tracking is under the CNIL's radar. In June 2025, the National Commission for Information Technology and Freedoms published a draft recommendation on the request for consent for tracking pixels (and in particular for email open pixels), the final version of which was published on April 14, 2026.

This request for consent, which is currently ignored by most shippers, could revolutionize the way they do business. emailing practices. The CNIL's approach is logical: under the RGPD, tracking data is considered personal data requiring explicit consent. Let's take a look.

The CNIL is concerned about email tracking pixels

As stated in its preamble, the CNIL initiated this clarification initiative following reports and complaints from individuals who felt they were being spied on via emails. Through this document, the CNIL wishes to clarify the provisions of the GDPR that have been misinterpreted by organizations since 2018.

In reality, in recent years, CNIL lawyers have informed several audited brands that their open and click tracking measures were not legal without prior consent. Surprised, email marketers asked the CNIL for clarification on their lawyers' positions. And this recommendation followed.

Important points to remember

• In its recommendation, CNIL primarily targets the email open pixel. And more specifically, the ability to track opens by name.
• It is highly likely that clicker tracking so be the next on the list in the coming year. So it's best to comply now by applying the same principles.
• For addresses already in your database, You have 3 months as of the publication of the recommendation to inform your recipients about the use of the pixel and to allow them to object, by July 14 at the latest.

What you can still do without consent ✅

• Statistics Measure the overall open rates of your campaigns (if anonymized by your sending platform).
• Deliverability Measure aggregate open rates by destination domain (on domains large enough to prevent individual identification, to be verified with your sending solution)
• Inactive Push back inactive emails from your mailings or adjust the sending frequency based on the last opening date of your contacts.
• Security / Authentication : tracking to verify that an authentication email (2FA code, password reset link, etc.) is indeed opened on the recipient's terminal.
• Legal duty to inform tracking to prove the proper transmission of legally required information (pre-contractual information, mandatory disclosures, rate changes, etc.).
• Transactional e-mails insertion of pixels into emails directly related to a service requested by the recipient (welcome, account alert, order confirmation, shipping, appointment reminder, etc.), provided that the pixel itself serves an exempted purpose (deliverability, security, legal obligation).
• A/B Tests Performing A/B tests based on open rates appears to remain permissible since it concerns audience opening performance and is therefore non-nominative. However, you should inquire with your sending platform about the effective anonymization of data.

This will require explicit consent ❌

• Tracking Individually identify who opens your emails.
• Targeting Target your contacts based on their opening behavior (e.g., non-openers from a previous campaign).
• Profiling Determine your contacts' interests based on their opening behavior.
• Targeting Adjust your sending frequency based on individual behaviors (based on something other than last opened or clicked date).
• Customization Personalize your content based on each contact's opening interactions.

No need for tracking pixel consent in a deliverability context

To measure campaign deliverability, we need to be able to examine openings by email domain (to detect a reputation problem with Gmail, Orange, Outlook...).

To maintain a good reputation, it must be possible to exclude inactive contacts from mailings. And the common definition of an inactive contact until now is: «Any contact that has not opened and/or clicked at least one email in the last X months.».

In both cases, it is necessary to know the opening (and/or click) action and the email domain.

Good news The final version of the recommendation explicitly recognizes these two uses as exempt from consent. This was one of the most anticipated points by market players.

Three uses are exempted (page 5 of the recommendation):

• Identify inactive users to remove them from the database.
• Adjust the sending frequency to inactive users (e.g., moving from several sends per week to one per month).
• Switch to an alternate channel when email no longer functions (SMS, push...).

The technical trade-off: minimizing data

The CNIL mandates that only the date of last opening, without time, overwritten with each new opening. Storing a complete history is no longer compatible with the exemption.

The line to respect: disengage, don't re-engage

The exemption covers everything used for less demanding an inactive contact:

• ✅ Remove or exclude inactive users.
• ✅ Target inactive users with reduced frequency.
• ✅ Send an informational campaign announcing the frequency reduction or unsubscribe («This is our last email before unsubscribing»).

Orange Square Launch a marketing reactivation campaign (Super promo, strong editorial content): This is no longer «strictly necessary.» The logic of exemption is to disengage, not to re-engage better. A reactivation campaign with a commercial purpose requires consent.

A limit to know: small estates

Aggregate measurement by domain remains possible without consent, provided that anonymization is effective. On major domains, no problem. But on a company domain with two or three addresses, aggregation does not guarantee anonymity. Check with your sending solution how these cases are handled.

What impact does B2B have?

The recommendation applies to both B2C and B2B! And the CNIL takes care to specify it explicitly (page 10):

«The consent regime for tracking pixels is independent of the one applicable to sending the email in question: consent for tracking pixels may therefore be necessary for emails that do not, in principle, require the recipients» consent (...) prospecting business professionals in a field related to the work of the person being solicited (...)»

In short, inserting a tracking pixel in B2B emails requires specific opt-in.

Some good news, after all Consent exemptions (deliverability, security, legal obligation) also apply in B2B. Therefore, you can continue to manage your B2B assets without consent, under the same conditions as in B2C.

Complying: 11-Step Action Plan

Before diving in! We've chosen a maximalist and exhaustive approach for this action plan (it's long 😉): you'll find both what's strictly necessary to be compliant and what we consider best practices. Not all brands will go all the way with every priority, and that's normal. It's up to your teams to decide where to draw the line based on your context, resources, and strategy. This article is here to inform your decisions, not to impose them.

Priority 1 – Diagnose: Audit Your Current Practices

Before any update, take the time to take an honest photograph of the current situation. This requires collaboration between CRM, IT, legal, and deliverability teams. It's also an opportunity to bring everyone back to the table on a topic that concerns all these professions at once.

Examples of questions to ask me:

• Where are your email addresses currently collected? With which mentions or checkboxes? The goal is to be exhaustive so as not to miss any element (there's more to life than just digital, think about your partners).
• What are the uses of data from tracking Openings (and clicks) in your CRM strategy
• Which consent collection wording would allow you to group this collection? The CNIL authorizes a single consent for commercial prospection and tracking pursuing a purpose directly related to that prospection (see priority 5).
• What types of emails do you send?, Do they all fall under the same legal regime and/or benefit from exemptions?
• What tools will you need to leverage these consents? (where they are stored)? It's likely that they aren't *only* in your main email sending tool.

If this has not already been done, organize a workshop as soon as possible with the relevant teams. And if you need outside help to facilitate this workshop, do not hesitate to contact Badsender.

Following this diagnosis, you will know which projects to prioritize, which can be simplified, and which require bringing in external providers. Without this initial snapshot, the following steps will be taken blindly.

Priority 2 – Diagnose: Assess Your Shipping Platform's Capabilities

In the concrete actions that will follow, you will be autonomous on one part, but clearly dependent on your email sending platform on others. We recommend that you contact them or read the publications and documentation they have on the subject.

A few essential questions:

• Granular consent Can you handle multiple consent fields (opens, clicks, cross-channel profiling) according to your strategy?
• Minimized storage Are the opening dates retained by day without time, overwritten with each opening (CNIL requirement for deliverability exemption)?

• Pixels differentiated by consent Does the platform generate a different pixel based on the recipient's status? A full pixel for consenting users, and a restricted pixel (last opened date, domain, campaign ID, aggregated A/B version) for others?

• Deletion of history in case of objection When a recipient withdraws their consent, is the behavioral data history concerning them effectively deleted?

• Separation of transactional and marketing flows Is the distinction manageable at the template and workflow level, or only on a case-by-case basis?

• Individualized proof of consent date, context, version of the information...

A platform that has not yet communicated publicly by mid-May 2026 is probably behind schedule. We absolutely must question them!

Priority 3 – Decide: Rethink your targeting and personalization strategies

The idea isn't necessarily to implement a complete overhaul. But, with your improved understanding of the legal framework, you'll need to streamline your practices to comply, and also to avoid unnecessary complications. It's important to strike a balance between:

• Continue collecting without scaring off your potential contacts
• Keep offering relevant content to your recipients

Three questions to structure this reflection :

1. Do you really need to track openings individually?Many brands track individual opens out of habit, without actually using the data downstream. The advent of recommendations is an opportunity rather than a constraint: disable individual tracking, and you'll gain simplicity and compliance all at once. Caution: it's not enough not to exploit the data; your platform must also not store it (minimization principle).

2. How to redefine your inactive contacts?
The last opening date is now the only usable signal to identify inactive users, if they have not given their consent. If your current definition relies on other indicators, you will need to verify their compliance. Our Reference article on inactive contacts remains valid in its principles, but its operational implementation may vary.

3. Which first-party signals should be strengthened in parallel?
Openings will become a partially blind signal: reduced coverage due to consent, Apple Mail Privacy Protection, and anti-tracking filters. Reducing your reliance on this signal by strengthening other sources is a good sustainable practice: authenticated clicks on your site, purchases, customer service responses, declared preferences, and your own transactional events. These will better withstand future changes.

Priority 4 – Decide: Define your consent strategy

This is the legal translation of the choices you made in priority 3.

Three decisions to make:

1. What level of consent?

The CNIL authorizes a single consent for commercial prospecting and tracking pixels that serve a purpose directly related to that prospecting: content personalization, adaptation of sending frequency, fraud detection. Conversely, cross-channel profiling (using opens to then target on the web, mobile, or in display advertising) is not related to email prospecting and requires a separate consent box.

The more distinct use cases you have, the more checkboxes you'll have. Choose the tightest scope that serves your CRM strategy.

2. Which coverage: opens only, or clicks too?

The recommendation literally concerns opening pixels, but the same legal framework applies to tracking links. Covering them now in your consent strategy will save you from having to redo the work in 12 to 18 months, when the CNIL or an audit formally clarifies the subject.

3. What to do with the existing base?

Your contacts have already given a «simple» opt-in. For them, the recommendation provides for simple information within 3 months with the possibility of opting out (see priority 10). You can also take advantage of this communication to request explicit consent... but the conversion rate is likely to be very low. This needs to be decided in consultation with your DPO and legal team.

Priority 5 – Implement: Update your collection forms

You now know what consent to collect (priority 4). Now you just need to phrase it.

The consent must be free, specific, informed, and unambiguous. The simplest way is to add a checkbox (not pre-checked) to your forms, with clear wording about the purposes.

Two examples:

«I agree that [Brand] may use tracking pixels to offer me content relevant to my interests and reduce the number of irrelevant emails I receive.”

«I agree to receive commercial communications by email from [Brand Name], personalized based on my interactions with these emails (opens and clicks). I can withdraw my consent at any time via the link in each email.»

The word «personalized» (or an equivalent) is legally decisive: it is what makes it possible to couple opt-in and consent to pixels in a single box. Without this coupling, the CNIL requires finer granularity.

Go beyond formal compliance

A legally correct move is not necessarily an effective move. A job of Plain language writing and UX Design is necessary. This is the point that will make the difference between brands that do the bare minimum and those that will transform this obligation into a customer relationship lever.

Target all collection points

Web, paper, oral, partners, contests, physical events. The mapping carried out as priority 1 must lead to a systematic update here. A single missing mention can invalidate the proof of consent for all contacts collected on this channel.

Priority 6 – Implementation: Distinguish transactional and marketing flows in your ESP

Transactional emails (order confirmations, account alerts, package shipments, appointment reminders, password resets, etc.) benefit from a specific regime: they can be sent without consent, and the pixels they contain can be exempted if they serve an exempted purpose (security, deliverability, legal obligation).

Still, your platform must clearly distinguish these flows from marketing flows. In practice, many ESPs apply the same tracking rules to all campaigns, which means losing the benefit of the transactional exemption.

Based on the priority 1 diagnosis, two concrete actions:

• Set up distinct tracking rules pixels and tracking links exempt on pure transactional flows, conditional pixels on marketing flows.
• Handle the case of hybrid emails a transactional email that also contains product recommendations, a welcome email with a promotion... These emails mix a transactional part (exempt) and a marketing part (which requires consent). Either you separate the two into distinct emails, or you apply the strictest regime to the whole.

A warning sign to watch out for: if your ESP cannot simply explain how it distinguishes these flows, then it probably doesn't. Investigate further during the meeting scheduled as a priority 2.

Priority 7 – Implement: Integrate an opt-out link in your emails

As with opt-in, consent for open tracking must be revocable at any time with a single click. Therefore, you must include an opt-out link next to the unsubscribe link in your footers (and headers, if you follow this practice).

Unsubscribe and withdrawal of consent: two different things

Many brands merge the two into an «all or nothing» mechanism, even though they are legally distinct. Our advice: offer both a one-click global withdrawal (to comply with the «as easy to withdraw as to consent» requirement) and granular withdrawals by purpose, for those who want finer control.

Retroactive neutralization

The recommendation requires that the pixels of the emails already sent will no longer be exploited if the recipient reopens them after withdrawing their consent. This is one of the points to explore as a priority 2, and likely one where you will be most dependent on product developments from your email sending platform.

Priority 8 – Implementation: Update or create your Preference Center

The multiplication of consent choices (reception, opens, clicks, cross-channel profiling...) makes the preference center more relevant than ever. Well-designed, it can even replace the classic unsubscribe page: the recipient arrives on a single interface where they fine-tune their choices.

If you don't have one, now is a good time to create one. If you already have one, it probably needs to be reviewed to incorporate the new granular withdrawal choices defined in priority 7.

One requirement not to forget: withdrawal must be made without re-entering the email address (recommendation, page 10).

Priority 9 – Implementation: Implement a consent proof system

Proof of consent for email tracking must be kept for the entire duration of that consent's validity. Specifically, you must be able to produce at any time, for each recipient individually: the date of consent, the collection context (web form, partner page, dedicated campaign, etc.), the exact version of the displayed information, and the scope of the accepted purposes.

An explicit warning from the CNIL

A contractual clause between you and your provider (ESP, collection partner, list lessor) is not sufficient to transfer proof of consent. The recommendation is very clear on this point (page 11):

«The obligation to prove consent cannot be fulfilled by the mere presence of a contractual clause obligating one party to obtain valid consent on behalf of the other.»

If your addresses are collected by a third party (partner, rental provider, co-organized event, etc.), you must technically receive proof of this, not just contractual assurance. This point directly conditions the validity of all emails sent to these contacts.

Concretely

This is one of the projects most dependent on your sending platform (see priority 2). Questions to explore: what evidence is kept natively? Is it exportable? How are subsequent consent changes managed? How do you connect evidence from multiple sources (web form, preference center, email opt-out, etc.)?

Priority 10 – Regularize and Formalize: Inform your existing recipients

Regarding consent for existing databases, the CNIL does not require consent to be re-collected on existing databases. However, it announces the obligation to send a campaign to inform subscribers about the tracking of their opens (and, by extension, their clicks) and to offer them an easy way to opt-out for future emails sent.

You have 3 months from the publication of the recommendation to proceed with it. So, by early July 2026 at the latest.

Essential prerequisite

This campaign can only be launched if the entire opt-out system is operational: updated forms and preference center (priorities 5 and 8), opt-out link in emails (priority 7), history nullification in case of objection, technical differentiation between pixels with and without consent (priorities 2 and 6), proof mechanism in place (priority 9). Without these foundations, the information campaign would be useless at best, and counterproductive at worst: a recipient who objects but whose choice is not correctly taken into account puts you in a worse situation than before the campaign.

Priority 11 – Regularize and Formalize: Update your privacy page

This is the least technical step, but it should not be forgotten. Your privacy policy (or «privacy» page) must reflect the new practices implemented in the previous priorities.

To add or update:

• Mentioning the use of tracking pixels and tracking links in your emails.
• The specific objectives pursued (personalization, deliverability, security, etc.), in line with the strategy defined in priority 4.
• The terms and conditions for withdrawing consent and the existence of a preference center, if applicable (priority 8).
• Potential third-party service providers involved in the processing (ESPs, pixel providers, partners).

This step has no direct operational impact, but it plays a legal role: it is on this page that recipients (and, in case of inspection, the CNIL) will look for detailed information. It's better for it to be consistent with what you are actually doing. Work with your legal counsel and/or your DPO.

Example of writing a privacy page: look at the last paragraph

FAQ: Frequently Asked Questions About Email Tracking Consent

How much time do brands have to comply?

0 days. Compliance is required immediately, and brands should have been applying it since May 2018 (the effective date of GDPR). Nevertheless, for address databases already collected, the CNIL grants a transitional period of 3 months (i.e., until early July 2026) to inform recipients about the use of pixels and allow them to opt-out for future emails. However, for any new address collection, the rules apply immediately.

Does this recommendation concern the click-through rate?

Technically, the recommendation only concerns opening tracking pixels. However, tracking links used to measure clicks fall under the same legal framework. The CNIL explicitly recalls this in its recommendation (page 8). In practice, the topic of clicks will follow: it's better to prepare for it now by integrating consent for clicks into the same project.

Is there a distinction between transactional emails, service emails, order confirmations, etc. and marketing emails?

Yes. So-called «transactional» emails (order confirmations, shipping notifications, security alerts, 2FA codes, invoices, customer service responses, appointment reminders, Terms of Service updates, etc.) benefit from a specific regime: they are linked to a service expressly requested by the recipient, and the pixels they contain can therefore be exempted from consent. Provided that these pixels themselves have an exempted purpose (security, deliverability, legal obligation).

Watch out for the trap: a transactional email does not allow just any pixel. If the pixel serves a marketing purpose (personalization, performance measurement), consent is still required, even in a welcome or order confirmation email.

Can a welcome email be considered a transactional email?

Yes, the CNIL explicitly cites welcome emails among the examples of transactional emails (recommendation, page 6). But be careful: everything depends on the actual content and the purpose of the pixel.

A strictly informative welcome email (registration confirmation, service overview, account access) is transactional. However, if the email leans heavily towards marketing content (promotions, product recommendations, acquisition workflow triggers), its transactional classification becomes questionable. And even in a purely transactional email, a marketing-oriented pixel is still subject to consent.

Does the CNIL make a distinction between using tracking to target openers and using it to exclude inactive users?

Yes, that is even the structuring distinction of the entire recommendation. See the paragraph on deliverability above.

Can a group collect a single, valid consent for tracking across multiple brands or entities?

The subject is more complex than it appears. The CNIL requires that the recipient clearly understands who will use the tracking pixels (recommendation, page 7). As soon as a group comprises several distinct legal entities, each can be responsible for its own processing, which argues for explicit consent per entity.

Broader consent may be possible when all entities are named at the time of collection and their uses are closely linked. However, the exact framework still needs to be specified on a case-by-case basis with your DPO or legal counsel.

Our practical recommendation: When in doubt, prioritize distinct consent per brand. This is more readable for the recipient and more robust in case of an audit.

How can you know an open rate without tracking?

The pixel is not prohibited. Without consent, it is still possible to use an anonymous pixel associated with a campaign ID (and not an individual contact) to measure an overall open rate (if your email sending solution allows it). This aggregated measurement, which does not allow tracing back to an identifiable recipient, falls outside the scope of consent, provided that anonymization is effective (recommendation, page 6).

Is email marketing doomed to die?

Clearly not. The recommendation does not call email marketing into question; it frames it.

The challenge isn't to abandon email, but to shift towards more first-party data-driven management (authenticated clicks, purchases, declared preferences) and be less dependent solely on open and click signals. Brands that anticipate this shift will gain resilience against future regulatory changes as well as increasing protections from email clients (notably Apple Mail Privacy Protection).

Can this consent counteract AMPP or Google Image Catching?

No. Consent obtained from your recipient has no effect on the protections put in place by email providers. If a user has enabled Apple Mail Privacy Protection, Apple will continue to pre-load the pixel and obscure open data, regardless of your consent mechanism. The CNIL also confirms this in its recommendation: the email service provider is neither a data processor nor a data controller (page 4). It acts according to its own rules, which are binding on you and your recipient.

Should the email open pixel be included in the list of cookies on your website?

No, the open pixel is not a cookie: it is not a web browsing tracker, and therefore it is not intended to be included in your site's cookie banner.

The CNIL itself urges caution on this point (recommendation, page 10): using a CMP designed for web cookies to collect consent for email pixels is technically possible but legally tricky. The recipient may not understand that their choice also applies to an environment (their inbox) separate from the one where they express it (your website).

Which countries does this regulation concern?

The legal framework is European. However, the recommendation published on March 12, 2026, comes from the CNIL and represents the French interpretation of this common framework. Authorities in other countries may adopt slightly different interpretations. If you operate in multiple European countries, you must verify the stance of each national supervisory authority.

If I only have one checkbox for consent to receive personalized commercial emails, as well as tracking of opens and clicks, can I have separate opt-out checkboxes for this consent?

The CNIL does not explicitly rule on this issue (page 10 of the recommendation), but specifies that it must «be as easy to withdraw consent as to give it.» In practice, in this case, we advise you to do both: offer a one-time withdrawal AND individual withdrawals. Be careful, however: if a recipient deselects tracking but continues to receive emails, you must be able to send them non-personalized emails. Your platform must be able to manage this.

Conclusion – Is this really the end of the world?

Honestly, no. And that's maybe part of the problem.

Compared to the initial project submitted for public consultation in June 2025, it is evident that market lobbies have had an impact. The exemptions granted on deliverability seem balanced to us, and serious players will be able to continue their work. However, other concessions appear more questionable to us.

The mechanism provided for bringing existing databases into compliance is particularly problematic: a simple information campaign with a right to object, without collecting explicit consent. This is convenient for brands, but offers no protection for recipients! A brand with a disengaged database will automatically end up with a «consenting» database. Since the information email simply won't have been opened. Silence equals acceptance! Not really an incentive to do better!

That's why we made the choice of reading maximalist In this article. Minimal compliance is a starting point, not a horizon. Taking advantage of this period to rethink your relationship with your recipients, simplify your forms, and switch to more robust first-party signals is an investment that will pay off far beyond the CNIL compliance issue.

And if you need an outside perspective to help you place that slider, you know where to find us.