All articlesPrivacy

Email tracking pixels need consent now. Here is what changed and how SmartMailing handles it

In April 2026 France and Italy ruled that the open pixel in a marketing email needs the reader's consent. The rule, the deadlines, the two kinds of subscribers you already have, and what a compliant setup looks like.

Privacy9 min read

The rule, in one sentence

An open-tracking pixel is a tiny invisible image loaded from the sender's server when an email is opened. Loading it reads from the reader's device, so in the EU it falls under the same law as cookies (ePrivacy Directive, Article 5(3)). For marketing email, that means the reader has to agree before the pixel is used. This was always arguable. In April 2026 two regulators stopped arguing.

What changed in April 2026

14 April, France. The CNIL published its recommendation on tracking pixels in emails. Measuring opens for marketing purposes needs prior consent. Legitimate interest is not enough. Only two uses are exempt: pixels used purely for list hygiene (recording nothing but the last-open date to stop mailing dead addresses) and security or authentication emails.
17 April, Italy. The Garante's provision no. 284 classifies the pixel as access to the reader's device and applies the cookie rules to it. Consent is required for marketing measurement, with a six-month transition for addresses collected before publication.
Deadlines. France gave senders until 14 July 2026 to inform existing contacts; Italy's transition runs to the end of October 2026. New addresses collected after publication had no transition at all.

Other EU countries have not issued guidance yet. The same directive applies to them, so the safe assumption is that the same rule applies everywhere in the EU, and that enforcement in 2026 is reaching small senders, not only the big platforms.

What counts as consent

A box the person ticks themselves. Never pre-ticked, never bundled into the newsletter consent, never rewarded with a discount. A short line next to it saying what is measured and why. The person must be able to untick it later as easily as they ticked it, without having to unsubscribe. And you keep a record of the exact wording they saw and when they agreed (GDPR, Article 7).

The two kinds of subscribers you already have

This is the part most guides skip, and it decides what you can and cannot do with your existing list.

People who subscribed before 14 April 2026. They could not have been asked, so the CNIL allows a one-time information email: what the pixel does, and a link to switch it off. If they do not object, you may continue measuring. Silence counts, but only after the notice was delivered.
People who subscribed on or after 14 April 2026. The rule was already in force when they signed up, so they should have been offered a box. If your form had none, their silence cannot be turned into consent now. They are measured only once they tick a box themselves.

It feels backwards: the newer, cleaner subscribers are the ones you cannot measure. But it is the same logic as double opt-in in 2018. Old lists got one transition, everyone after had to be asked properly from the start.

Double opt-in is still the foundation

None of this replaces double opt-in, it sits on top of it. Every SmartMailing sign-up form, hosted subscribe page and API sign-up sends a confirmation email, and nobody is mailed until they click it. The consent wording, the time, the IP address and the source are stored with the subscriber. Imported lists require an attestation of where the consent came from. The measurement checkbox is an extra, separate question on the same form.

How SmartMailing handles it

A consent box where it is needed. Every sign-up form, popup and the hosted subscribe page show the measurement question automatically when the brand asks for consent, and in the Europe mode only to visitors who need to be asked. The wording is editable, the box is never pre-ticked, and every answer is stored with its wording, time and source.
The pixel obeys, per recipient. Amazon SES, our sending provider, accepts a per-message instruction to leave out the open pixel and not rewrite links. SmartMailing derives that instruction from each recipient's stored answer, for every single email. No consent means no pixel and plain links. Delivery, bounce and complaint tracking keep working.
Transactional email is never measured. Receipts, confirmations, password resets and other service messages carry no pixel and no rewritten links, whatever the brand's setting.
Existing lists handled the legal way. One click drafts up to two emails: a notice for people who subscribed before the rules, and a request for everyone who joined later. Both open the preference page with the measurement box first. Fourteen days after the notice is delivered, people who stayed silent count as informed and are measured again; the request never converts silence into anything.
Honest reports. An email sent without a pixel can never register an open, so it must not sit in the denominator. Reports show measured and unmeasured recipients side by side, with open and click rates over the people who were measured.
A way out in every measured email. Every email that carries the pixel also carries a Tracking preferences link next to Unsubscribe. It opens the preference page with the measurement box first, and unticking it stops the measurement without unsubscribing. The current state is shown in plain words: measured or not measured. Emails that are not measured carry no pixel and no such link.
European by default. Sending from Frankfurt, data stored in Zurich under the EU adequacy decision, a data processing agreement online, and an audit trail behind every consent change.

What to do this week

Check the brand's tracking setting: Consent in Europe (the default for new brands) or Only with consent. Your forms and the hosted subscribe page then ask the right visitors automatically.
Draft the measurement emails from the same screen, read the drafts, and send them.
Look at the report after the next campaign: the measured share is your real audience for open rates now. Expect it to grow slowly as people tick the box.

Four modes, so you choose

Measure everyone is what every tool did until this year and is still there for brands that need it; anyone who switches measurement off from the Tracking preferences link is no longer measured. Only with consent is the compliant mode described above. Consent in Europe, the default for new brands, asks only the people the rule covers: subscribers in the EU, EEA and UK are measured after they agree, everyone elsewhere, for example in the US, unless they switch it off. The country comes from the sign-up (the visitor's IP country), your imports, the API or the subscriber's page, and people with no known country are treated like Europe unless you choose otherwise. Off never measures for that brand. The brand sending the emails is the controller of its subscribers' data and decides; SmartMailing provides the tools the CNIL explicitly asks email providers to offer: a way to disable the tracker, and a way to manage the list by consent signal.

Sources

This article explains how the product works. It is not legal advice; check with your own counsel for your market.

Switch a brand to consent-first measurement, free.

Start free

Keep reading

Deliverability

What our deliverability score really measures

Platform

Why one platform beats a patched-together stack

Deliverability

How we keep promotional and transactional reputations apart

The rule, in one sentence

What changed in April 2026

14 April, France. The CNIL published its recommendation on tracking pixels in emails. Measuring opens for marketing purposes needs prior consent. Legitimate interest is not enough. Only two uses are exempt: pixels used purely for list hygiene (recording nothing but the last-open date to stop mailing dead addresses) and security or authentication emails.

17 April, Italy. The Garante's provision no. 284 classifies the pixel as access to the reader's device and applies the cookie rules to it. Consent is required for marketing measurement, with a six-month transition for addresses collected before publication.

Deadlines. France gave senders until 14 July 2026 to inform existing contacts; Italy's transition runs to the end of October 2026. New addresses collected after publication had no transition at all.

What counts as consent

The two kinds of subscribers you already have

This is the part most guides skip, and it decides what you can and cannot do with your existing list.

People who subscribed before 14 April 2026. They could not have been asked, so the CNIL allows a one-time information email: what the pixel does, and a link to switch it off. If they do not object, you may continue measuring. Silence counts, but only after the notice was delivered.

People who subscribed on or after 14 April 2026. The rule was already in force when they signed up, so they should have been offered a box. If your form had none, their silence cannot be turned into consent now. They are measured only once they tick a box themselves.

Double opt-in is still the foundation

How SmartMailing handles it

A consent box where it is needed. Every sign-up form, popup and the hosted subscribe page show the measurement question automatically when the brand asks for consent, and in the Europe mode only to visitors who need to be asked. The wording is editable, the box is never pre-ticked, and every answer is stored with its wording, time and source.

The pixel obeys, per recipient. Amazon SES, our sending provider, accepts a per-message instruction to leave out the open pixel and not rewrite links. SmartMailing derives that instruction from each recipient's stored answer, for every single email. No consent means no pixel and plain links. Delivery, bounce and complaint tracking keep working.

Transactional email is never measured. Receipts, confirmations, password resets and other service messages carry no pixel and no rewritten links, whatever the brand's setting.

Existing lists handled the legal way. One click drafts up to two emails: a notice for people who subscribed before the rules, and a request for everyone who joined later. Both open the preference page with the measurement box first. Fourteen days after the notice is delivered, people who stayed silent count as informed and are measured again; the request never converts silence into anything.

Honest reports. An email sent without a pixel can never register an open, so it must not sit in the denominator. Reports show measured and unmeasured recipients side by side, with open and click rates over the people who were measured.

A way out in every measured email. Every email that carries the pixel also carries a Tracking preferences link next to Unsubscribe. It opens the preference page with the measurement box first, and unticking it stops the measurement without unsubscribing. The current state is shown in plain words: measured or not measured. Emails that are not measured carry no pixel and no such link.

European by default. Sending from Frankfurt, data stored in Zurich under the EU adequacy decision, a data processing agreement online, and an audit trail behind every consent change.

What to do this week

Check the brand's tracking setting: Consent in Europe (the default for new brands) or Only with consent. Your forms and the hosted subscribe page then ask the right visitors automatically.

Draft the measurement emails from the same screen, read the drafts, and send them.

Look at the report after the next campaign: the measured share is your real audience for open rates now. Expect it to grow slowly as people tick the box.

Four modes, so you choose