Marketers Have Until July 14 to Comply With New Email Tracking Pixels CNIL Rules - MyEmailTools

Skip to content

Menu<br>expanded

The French Data Protection Authority (CNIL) has released its final recommendations on the use of email tracking pixels, which provide guidelines on when digital marketers can monitor email activity and when they must first obtain user consent. This complements the existing GDPR and Google’s bulk senders guidelines for digital marketers.

In the recommendations, CNIL notes that companies cannot use invisible tracking pixels embedded in emails (hidden images that load when an email is opened for open rate and engagement tracking purposes) without explicit user consent.

The consent should contain the following details;

Clearly explain what tracking pixels do

Identify which email address the consent applies to

Make it as easy to refuse tracking as it is to accept it

Provide a simple link in every email to withdraw consent

Not ask users to provide their email address again when withdrawing consent

CNIL also recommends allowing users to accept or reject each tracking purpose separately instead of bundling multiple purposes into one consent option.

However, some tracking activities can continue without consent if they are strictly necessary. Examples of such tracking include:

Security measures used during user authentication,

Monitoring email deliverability to remove inactive email addresses

Transactional emails such as Order confirmations, Password reset emails, Shipping notifications, Account alerts, Appointment reminders, and Customer service responses.

Public sector organizations may also qualify for exemptions when emails support public service missions.

The authority encourages organizations to obtain consent when users first provide their email address. Where consent was not collected at that stage, businesses should send a separate email requesting permission. That consent request email should not itself contain tracking pixels.

If you are a business sending marketing emails, a public sector organization, an email marketing service provider, or a third-party analytics provider, you should ensure that you have complied with the requirements by July 14th.

The recommendations were first published on April 14, 2026, with a compliance deadline set after 3 months which will be July 14, 2026.

You can read the French version of the full recommendations.

Published by<br>Myet Editorial

MyEmailTools comprises a team of email marketing experts with years of experience in the industry. We have developed email marketing tools, plugins, and apps that deliver outstanding results, as well as learned valuable lessons from those that did not succeed. Over time, we’ve gained significant expertise and in-depth knowledge in the field of email marketing, which we share on myemailtools.com to help you achieve your marketing goals<br>View all posts by Myet Editorial