Skip to content
Guide Updated on Sept. 7, 2026 12-minute read

This page explains the French rule, set by the CNIL. In the United Kingdom, the rule has its own page: Tracking pixels in emails: what PECR and the ICO require, explained

Tracking pixels in emails: the CNIL rule, explained simply

Since 14 April 2026, a CNIL recommendation sets out when a pixel placed in an email requires the recipient's consent, and when it is exempt from it. The subject sounds technical. In reality it comes down to a single question, asked email by email.

This page explains it without jargon, with the source code in front of you, concrete cases for each type of email, and the texts cited so you can check for yourself. You don't need to be a lawyer to read it to the end.

Take the free diagnostic

Seven to ten questions, two minutes, immediate score

The short answer

Pixels are not banned.

Nothing in the text prohibits them. What changes is the basis on which you set them.

Measuring opens requires consent.

A consent specific to tracking, distinct from the one given to receive your emails.

Two exemptions, under precise conditions.

Securing an authentication. And measuring opens for deliverability alone: spacing out or stopping emails to inactive recipients, switching channel, keeping a record that information owed has been delivered.

A freely accessible guide, no paywall, no sign-up. Sharing it is what helps us most.

What a pixel is, in the code

A tracking pixel is an image. A real image, served by a remote server, usually one pixel by one pixel and transparent, placed in the body of the message. It is not attached to the email: it is called over the network the moment you display it.

It is this call that interests the sender. It tells them that the message was displayed, when, and by whom — since the image's address contains an identifier specific to each recipient. Here is what that looks like, as found at the bottom of the source code of a campaign email.

Excerpt from an email's source code — last line before the body closes 
<!-- suivi d'ouverture -->
<img src="https://mail.exemple-esp.com/o.gif?c=8412&u=a3f9d2e1c7&t=1755400981"
     width="1" height="1" alt="" style="display:block;border:0" />

mail.exemple-esp.com

The server that serves the image. Often the sending platform's, sometimes a domain of your own. It is the one that logs the call.

c=8412

The campaign identifier. Harmless on its own: it does not designate anyone.

u=a3f9d2e1c7

The recipient identifier. It is this that turns an image into an individual measurement, and that tips the whole legal reasoning.

t=1755400981

A timestamp to the second. Useful for marketing, but it is precisely the kind of data the exemptions do not allow you to keep.

Why the law takes an interest: displaying the image causes a read and a write on the recipient's device. Article 82 of the French Data Protection Act makes these operations subject to prior consent, unless the purpose is strictly necessary. The fact that it is an image, and not a cookie, changes nothing.

On the French market, 93% of the emails we receive carry one (2366 out of 2548, snapshot of Oct. 26, 2026). See the tracking pixel observatory for France

Links rewritten to count clicks

The second mechanism is less well known and yet present in almost every commercial email. Your links don't go out as you wrote them: the sending platform rewrites them to its own domain, logs the pass-through, then redirects to the actual destination.

What you wrote in your template 

<a href="https://exemple-marque.fr/nouveautes">Voir la collection</a>

What the recipient receives 

<a href="https://click.exemple-esp.com/f/a/a3f9d2e1c7/c/8412
             /l/aHR0cHM6Ly9leGVtcGxlLW1hcnF1ZS5mci9ub3V2ZWF1dGVz">Voir la collection</a>

You find the same recipient identifier there, and the original address encoded at the end of the string. The click is therefore tied to a person, exactly like the open.

What the CNIL says about tracking links

They are not directly targeted by the recommendation, but it provides the principles for assessing whether they meet the rules. Like other tracking techniques, they involve read or write operations on the device and therefore fall under Article 82, in addition to the GDPR.

One case is expressly exempted: the tracking link that allows consent to be withdrawn simply and securely, considered strictly necessary for the service requested. The recommendation places the same reasoning around the per-recipient unique link, which reserves a function to the one person targeted: this is a security measure tied to authentication. An unsubscribe link follows this logic. A link that also measures the click for other purposes falls under Article 82 like any other tracker.

Who is concerned

More people than you'd think, and not only large brands. The recommendation applies to any use of trackers in emails, whatever the context of the sending, the nature of the organization, and the status of the recipient — customer, prospect, or employee.

The sender

Whoever the tracking pixel — A tiny, transparent image placed in an email and served by a remote server. When it is displayed, the sender learns that the message was opened, when, and by whom — the image address carries an identifier specific to each recipient. is inserted on behalf of is the data controller. It is up to them to be able to demonstrate the legal basis and, when they delegate the collection of consent, to prove it was validly obtained on their behalf.

The sending platform, the sending tool

A processor when it inserts pixels solely on the sender's behalf. It is expected to design its settings to make it possible to meet the rules: easy tracking opt-out, differentiated handling of recipients, lists driven by a consent signal.

The provider that uses it for itself

As soon as a provider uses pixels for its own purposes — improving its service, refining its lists — it can become a joint controller with the sender who contractually accepts these operations. The allocation of obligations must then be put in writing.

Parties outside France

The CNIL — The Commission nationale de l'informatique et des libertés, France's data protection authority. It publishes recommendations and can carry out inspections and impose sanctions. can inspect parties established in France, in another Member State, or outside the Union, as soon as the pixels are used to track people located in France. On Article 82 — Article 82 of the French Data Protection Act (loi Informatique et Libertés). It makes any reading from or writing to someone's device subject to prior consent, unless it is strictly necessary for a service they requested. The whole reasoning on pixels follows from it., the European one-stop-shop mechanism does not apply to these inspections.

You are concerned if any of these sentences describes you

  • You send a newsletter, even a small, homemade one.
  • Your sending tool shows an open rate. If it shows one, a pixel goes out.
  • Your transactional emails go out from the same account as your campaigns.
  • You send communications to your employees from a marketing tool.
  • You are an association, a local authority, a public service: the recommendation makes no distinction based on the nature of the organization.
  • You operate a client's mailings: the agency is part of the chain of responsibility.

The rule, and the decision tree

The principle fits in one sentence. Setting or reading something on someone's device requires their prior consent, unless the operation's sole purpose is to enable the communication, or it is strictly necessary for a service they have expressly requested.

The recommendation's most structuring point lies elsewhere, and it is the one most marketing teams discover when reading it: the pixel's regime is independent of the emailing one. Having the right to write to someone does not give you the right to measure whether they opened it.

Being a customer gives you more rights to send, not more rights to measure.

Does your pixel need consent?

  1. 1

    Does the pixel serve only one of the purposes the recommendation exempts?

    The recommendation sets out an exhaustive list of them. A purpose not on it does not get in by resemblance.

    yes if

    • Taking part in authenticating the person: a code received by email, a password to reset, a link that opens only for its recipient.
    • Spacing out or stopping emails to those who no longer open them — deliverability, strictly understood.
    • Assessing the channel in order to change it, under this same condition.
    • Keeping a record of the open when a legal obligation requires you to demonstrate that information was transmitted.

    no if

    • Measuring a campaign's performance.
    • Personalizing an email or profiling its recipient.
    • Detecting fraud in general.
    • Making an audience measurement more reliable.

    Point 3.2 for what is exempt, point 3.1 for the rest.

    yes, next question
  2. 2

    Is the email carrying this pixel part of what the person asked you for?

    The question is not whether you have the right to write to them, but whether they asked for it — or whether the email relates to a service they requested.

    yes if

    • They subscribed to your newsletter.
    • They placed an order.
    • They clicked “forgot password.”
    • They consented to receive your marketing outreach.

    no if

    • You are targeting them under the similar-products rule: they bought from you once, the rule allows you to reach out to them again, but they have not asked for anything.

    Point 3.2. Emails from a public authority carrying out a public-service mission are treated the same way, even without a request — answer 14 of the FAQ.

    yes, next question
  3. 3

    When the pixel loads, does your tool record only the date of the last open?

    What matters is what the server records the moment the image is called, even if it is deleted or anonymized afterwards. The date alone is the rule — “in principle,” the CNIL writes: departing from it means demonstrating that the extra data is strictly necessary for the exempted purpose.

    yes if

    • The date, to the day, replaced at each new open.

    no if

    • An IP address or a user agent logged, even if deleted afterwards: they were indeed collected.
    • The time of the open, not just the day.

    Point 3.2, and question 7 of the FAQ. The limit applies to security just as it does to deliverability.

yes

Outcome

Exemption applies

The pixel can be set without consent, if meeting these three conditions is documented.

Outcome

Consent required

A single “no” is enough. You then need a consent specific to tracking, distinct from the one given to receive your emails.

What if my pixel does both?

Your pixel can serve two purposes at once: stopping emails to those who no longer open them, and measuring your campaign. That doesn't take it outside the decision tree. The first goes out without consent, the second waits for its own.

Where do you actually stand?

The diagnostic takes this decision tree and applies it to your answers. An immediate score, prioritised gaps, and a report you can pass on to your DPO as well as your technical team.

Start the diagnostic

The two exemptions, in plain terms

They don't resemble each other and don't follow the same conditions. Confusing them is the most common mistake.

Exemption 1

Deliverability: stopping emails to those who no longer open them

It covers one thing: spacing out or stopping your emails to recipients who no longer open them. Under the same condition, it also covers assessing the channel in order to change it, and recording the open when a legal obligation requires you to demonstrate that information was transmitted.

All these conditions, together

  • The email was requested by the person, or relates to a service they requested.
  • The pixel records only the date of the last open, to the day. Even if deleted afterwards, an IP address or a time would have been collected.
  • The absence of an open produces a real effect: you space out, you stop, or you switch to another channel.
  • You document that these conditions are met. The CNIL cites as an example the unsubscribe rate observed after emails stop.

What it does not cover

  • Measuring a campaign's open rate to judge its performance.
  • Following up, segmenting, or personalizing based on the open.

Exemption 2

Security: protecting an authentication email

It concerns the security of the person receiving it: a pixel in an authentication or password-reset email that could be intercepted. The per-recipient unique link, which reserves a function to the one person targeted, follows the same reasoning.

All these conditions, together

  • The email was requested and collection remains limited: the same two conditions as deliverability.
  • The measurement serves to protect access — limiting automated attempts against an authentication mechanism, for example.

What it does not cover

  • Fighting fraud in general.
  • Cleaning up databases: that's the first exemption, not this one.
  • Manipulating advertising inventory.

The false paradox of the three-year purge, and its answer

The question comes up with every CRM manager. The GDPR forbids keeping data indefinitely, and the CNIL sets the benchmark at three years after the last contact; purging means knowing who is inactive; knowing who is inactive means measuring opens — hence a consent that few will grant. The text would then be self-contradictory.

It isn't, and that is precisely the point of the first exemption. The minimal data you need to run the purge clock — the date of the last open — is exactly what you can collect without consent. The tension was seen, and the exemption was shaped to dissolve it.

Exempt

Spacing out then stopping emails to non-openers. You stop soliciting.

Consent required

Following up with non-openers, feeding a score, triggering a reactivation campaign. You are soliciting differently.

And for your customers, inactivity can often be read without a pixel: orders, logins, and use of the service are signals you already hold. Also worth noting: opening an email does not count as contact initiated by the prospect within the meaning of the CNIL's framework on managing commercial activities.

Each type of email, case by case

This is where the subject becomes workable. The assessment is made email by email, and the CNIL detailed several situations in its FAQ of 22 July 2026. One reading note: this table says whether the **type** of email opens the door to an exemption, never whether the exemption is secured. Relating to a requested service is only one condition out of three — collection limited to the date of the last open and a real effect on inactive recipients still need to be met, and meeting them is what gets documented.

Email type Pixel exemptible Why
Newsletter explicitly subscribed to Yes, for deliverability, under conditions The person asked for it. The email is then an explicitly requested service. The audience-measurement pixel, however, remains subject to consent.
Purchase or subscription confirmation Yes, for deliverability, under conditions A message triggered by a user action, informational and functional. It loses that character if it contains a promotional part.
Subscription renewal Yes, for deliverability, under conditions It remains tied to continuing a contractual relationship the user initiated.
Legal or contractual notice In principle yes, for deliverability, under conditions When the email's sole purpose is to inform of a legal, regulatory, or contractual change to the subscribed service — terms of service, privacy policy, pricing — it falls within managing the relationship. A record of its open can also serve to demonstrate that information owed was transmitted.
Email from a public authority, within a public-service mission Yes, for deliverability, under conditions Public or private body, as soon as the email falls within a public-service mission, carried out as a main or secondary activity — including a proactive step toward the user, such as informing them of a right.
Marketing outreach sent with prior consent Yes, for deliverability, under conditions A marketing email that the person has consented to receive can, in principle, be regarded as a requested service. A pixel that serves only deliverability there can be exempt; one that measures the campaign or personalizes it cannot.
Password reset Yes, for security, under conditions A pixel meant to detect an interception attempt can fall under the security exemption. It also requires a link to the requested service and limited collection; the conditions on managing inactive recipients, however, do not apply to it.
Cart abandonment follow-up No A promotional message aimed at getting a purchase completed. It falls under Article L. 34-5 of the French Post and Electronic Communications Code and requires prior consent; its pixel cannot be exempted.
Marketing outreach under the similar-products rule No Being able to send without consent does not make the pixel exempt. The email is not, on that basis alone, an explicitly requested service.
Newsletter sent without an explicit request It depends The criterion is the link to a requested service. The assessment is made case by case, depending on the conditions under which the newsletter is sent.

Collecting and withdrawing consent

When consent is necessary, the recommendation says how to ask for it. Here is what it requires, in the order you will encounter it.

  1. 1

    Say what the pixel is for, on the screen where you ask

    A short, visible heading, with the detail one click away: a link, a drop-down menu. Not in a privacy policy you have to go dig up. In plain language, not in legal terms.

  2. 2

    A single “Accept all” button remains possible

    Provided a second screen lets people choose use by use: yes to one, no to another. A single button with no second screen is enough only if you have stated that your marketing is personalized and that the pixel serves that personalization. An “I subscribe” button doesn't say that.

  3. 3

    No need to break it down by type of email

    You can attach consent to the address rather than to each category of message. What matters is that the person knows what they are agreeing to: a single type of email, or all of them.

  4. 4

    Withdrawing must be as simple as agreeing

    A preference center that groups the pixel, unsubscribing, and everything else together is allowed, as long as it doesn't lengthen the path: no extra step, no multiplied clicks, no button pushing you to stay.

  5. 5

    A withdrawal also applies to emails already sent

    You cannot recall a message once sent. Your server must therefore ignore pixel calls coming from someone who has withdrawn, and delete what had been measured before.

  6. 6

    Remembering the choice, refusal included

    Otherwise the question comes back with every send, and endlessly re-asking someone who said no ends up forcing their answer. The CNIL cites six months before asking again as good practice.

From the GDPR to the pixel: how we got here

The 2026 recommendation is not a new rule. It is the fourth step in a movement that first targeted cookies, then every technique for accessing a device, and finally email.

  1. 2002

    The foundation

    Directive 2002/58/EC, known as ePrivacy

    Its Article 5(3) makes any read or write operation on a user's device subject to consent, unless the sole purpose is communication or it is strictly necessary for a requested service. Under French law, Article 82 of the Data Protection Act of 6 January 1978 transposes it. All of the 2026 reasoning flows from it.

  2. 2018

    The GDPR

    Regulation 2016/679, applicable from 25 May 2018

    It governs the processing of data, independently of access to the device: legal basis, defined purpose, minimization — The principle that only what is needed should be collected. For an exempt pixel, this means in principle only the date of the last open — not the time, not the number of opens., retention period, individuals' rights. The two regimes overlap, and that is what makes the pixel subject confusing: you have to satisfy both.

  3. 2020

    Cookies

    CNIL deliberations no. 2020-091 and no. 2020-092 of 17 September 2020

    Guidelines on the application of Article 82, and a recommendation proposing practical arrangements for cookies and other trackers. It is the methodological model whose structure the pixel recommendation follows: qualifying the purposes, then describing how consent is collected.

  4. 2023 — 2024

    The broadening

    EDPB Guidelines 2/2023, version 2.0 adopted on 7 October 2024

    The European Data Protection Board clarifies the technical scope of Article 5(3): the rule does not concern only cookies, but any technique involving access to a device — pixels, digital fingerprints, embedded identifiers. The pixel in email is explicitly within scope.

  5. 2025

    The consultation

    Public consultation from 12 June to 24 July 2025

    Faced with a growing number of complaints, the CNIL submits a draft recommendation to stakeholders: user companies, associations, individuals, other authorities. A separate consultation covers the economic stakes. The summary of contributions, published in April 2026, states that the text evolved in light of them.

  6. 2026

    The recommendation

    Deliberation no. 2026-042 of 12 March 2026, published in the Official Journal on 14 April 2026

    The recommendation on tracking pixels in emails. It is neither prescriptive nor exhaustive: its purpose is to help businesses meet the requirements. An FAQ came to supplement it on 22 July 2026.

    By publishing this text, the CNIL places itself at the forefront of European authorities on the line between consent and exemption — The case where consent is not required, because the operation is strictly necessary for a service the person requested. Two families are considered for pixels: stopping writing to inactive contacts, and securing an authentication email. in email.

The dates to remember

A transitional regime was provided for addresses already in your database at the time of publication. It has now expired, which does not mean there is nothing left to do.

  1. Adoption

    12 mars 2026

    Deliberation no. 2026-042.

  2. Publication in the Official Journal

    14 avril 2026

    The three-month period starts running.

  3. End of the period

    14 juillet 2026

    Deadline for notifying people already in your database, unless a documented extension applies.

  4. Ordinary law

    Today

    Without that notice, consent is required, or the pixel must stop, for addresses already in your database on 14 April.

Extending this deadline remains possible. It requires objectively justified difficulties — volume, deliverability — that are documented.

One clarification that holds going forward: the absence of an objection only stands as long as the sending conditions remain unchanged. Add partners, change the terms of your marketing outreach, and new consent becomes necessary again, including for non-exempt pixels.

Two minutes, and you'll know where you stand

The diagnostic applies this decision tree to your situation, gives an immediate score, lists the gaps in order of priority, and prepares a two-part report — one for the DPO, one for the technical team. Free, no sign-up, with the result visible before any email is requested.

Start the diagnostic Two minutes

Frequently asked questions

The questions we are asked most often, with the answer as it emerges from the texts. When the answer depends on context, that is said.

Are tracking pixels banned?
No. No text bans them. The recommendation clarifies in which cases setting them requires the recipient's consent and in which cases it is exempt from it. It is neither prescriptive nor exhaustive: its purpose is to support businesses in meeting the requirements.

Is consent to receive my emails enough to set a pixel?
No, except for related purposes. The pixel's regime is independent of the emailing one. A single consent is allowed under two conditions: the marketing outreach is expressly presented as personalized, and the pixel directly contributes to that personalization — content, frequency. The CNIL also cites the pixel that screens out duplicate entries to a contest. A pixel that only feeds a report without changing the service delivered is not related, and requires its own consent.

Can I still know my open rate?
Yes, at the campaign level. Data collected by a pixel, whether exempt or consented to, can be used to produce an overall statistic if it has genuinely been anonymized — Transformed so that it can no longer be traced back to a person, permanently. Data that is only “pseudonymized” — an identifier in place of the name — remains personal data., by aggregation for example. The anonymization operation itself remains subject to the GDPR — The European General Data Protection Regulation, in force since May 2018. It governs the processing of personal data: legal basis, purpose, minimization, retention period, rights of individuals.. What requires consent is the open attributed to a specific person.

How do I purge inactive contacts from my database if I can no longer measure opens?
That is precisely the point of the deliverability — An email's ability to land in the inbox rather than in spam. Writing to addresses that never open degrades it, hence the value of identifying inactive contacts. exemption. Adjusting the frequency or stopping emails to inactive recipients is explicitly covered, provided you keep, in principle, only the date of the last open. So you do have the data you need for the purge, without consent. For your customers, inactivity can also be read in signals you already hold: orders, logins, use of the service.

What if I want to follow up with non-openers?
That's not the same thing anymore. Using the open to stop soliciting falls under the exemption. Using it to solicit differently — a reactivation campaign, scoring, an automated scenario — is personalization based on the open: consent is required.

Are my transactional emails affected?
They can carry an exempt pixel, if they relate to a service explicitly requested and the other conditions are met. An order confirmation loses that status, though, if it contains a promotional element: featured offers, a call to buy. The deciding factor isn't the “transactional — An email triggered by an action of the person: purchase confirmation, password reset, legal information. It is the opposite of a campaign, sent to a list at a time chosen by the brand.” label — it's the link to the requested service.

Are emails sent to my employees exempt from the rule?
No. The recommendation applies to any use of trackers in emails, regardless of the type of organisation or the recipient's status — customer, prospect, or employee. Assessing the obligations does depend on the circumstances, though, and the employment relationship raises questions of its own — best handled with your DPO — The data protection officer — the person in charge of GDPR compliance within an organization. Some organizations must appoint one, others do so by choice. rather than by applying marketing reflexes.

Does anonymising the collected data avoid the need for consent?
No. Article 82 applies whether or not the data is personal: what's at stake is access to the terminal, not the nature of what comes out of it. Anonymising the data beforehand isn't enough to exempt the collection. And deleting an IP address or a user agent quickly afterwards doesn't restore an exemption already lost, since that data was collected all the same.

Is my sending platform liable in my place?
Rarely. When it inserts the pixels solely on your behalf, it acts as a processor: it processes on instruction, secures the data, and assists you. If it also uses those pixels for its own purposes, it can become a joint controller. Either way, whoever delegates the collection of consent can't rely on a contract clause alone: they must be able to show that consent was validly collected on their behalf, through checks or audits.

Is click tracking covered?
Not directly by the recommendation, but it provides the principles to assess it. tracked link — A link rewritten by the sending platform to point to its own domain: it records the visit, then redirects to the real destination. The click is thereby tied to a person, just as the open is by the pixel. also involve reading or writing operations on the terminal and fall under Article 82 in addition to the GDPR. A tracked link used for a simple, secure withdrawal of consent is expressly cited as exempt.

Must people be informed even when the pixel is exempt?
Article 82 doesn't require it, but the CNIL (France's data protection authority) recommends it for the sake of transparency: this information can appear in the cookie policy. The GDPR also applies to this processing: people must be informed, and an easily accessible objection mechanism must exist when the processing relies on legitimate interest.

How long should the choice expressed be kept?
The CNIL recommends recording the choice, whether acceptance or refusal, so as not to ask the person again with every mailing. The duration should be assessed in light of the nature of the relationship. Not asking again for six months is presented as good practice.

My company isn't established in France — am I affected?
Possibly. The CNIL can inspect and sanction organisations established in France, in another Member State, or outside the Union, in particular when the pixels are used to track the behaviour of people located on French territory. For breaches of Article 82 involving users located in France, the European one-stop-shop mechanism doesn't apply.

Where should you start, in practice?
With an inventory. List the pixels actually present in your templates, attach each one to a written purpose, then apply the decision tree flow by flow. That's what the diagnostic does, in ten questions at most — and it's also what we check in your real emails, if you'd like.

The same question, in other countries

The pixel is the same everywhere; the texts that govern it are not. Each page is written in the language of its country, from the texts of its own regulator.

Sources

Everything above is drawn from the following texts. The links point to the original publications, so you can read them for yourself rather than take our word for it.

This page is an educational overview written from the texts cited. It is neither legal advice nor a position taken by the CNIL. For how it applies to your situation, rely on your DPO or your legal counsel.

Did this page help you?

It's freely accessible, with no paywall. Sharing it with a marketing team or a DPO is what helps us most.