On 14 April 2026, following a public consultation held from 12 June to 24 July 2025, the CNIL published a recommendation it had adopted on 12 March 2026, setting out for the first time a dedicated framework for tracking pixels in emails (the Recommendation). Just over three months later, on 22 July 2026, the CNIL followed up with a set of Questions and Answers (Q&A) addressing the practical implementation of the Recommendation. The Q&A draws in particular on the two webinars organized by the CNIL on this topic on 15 June and 22 July 2026, reflecting the questions raised by stakeholders during those sessions. 

Taken together, these two documents mark a significant development in the regulation of email tracking pixels, providing a detailed compliance framework and introducing an implementation timeline. The practical consequence of this regulatory clarification is that email tracking pixels are now subject to a consent regime that mirrors the one applicable to cookies. As a first practical consequence of this, users and customers have been receiving dozens of pixel information emails over the past months, relying on a favorable regime of consent-by-default permitted during the interim period following the recommendation (see below).

The underlying legal position, however, is far from new. As early as 2013, in a deliberation adopting a recommendation on cookies and other tracking technologies, the CNIL expressly confirmed that “invisible pixels” fall within the scope of Article 32-II of the French Data Protection Act, now Article 82, which transposes Article 5(3) of the ePrivacy Directive into French law. This approach is also firmly anchored in EU law: in its Guidelines 2/2023, the European Data Protection Board had already confirmed that pixels embedded in emails fall within Article 5(3) of the ePrivacy Directive. Against this backdrop, the CNIL highlighted that its decision to issue detailed recommendations has been driven by the growing number of complaints it has received in relation to these practices.

This blog post, part of our France – Tech Law Insights series, summarizes what the Recommendation and the Q&A require in practice. It is relevant to any organization, public or private, that inserts pixels into emails sent to clients, prospects or employees, whether in a B2C or a B2B context. One boundary is worth noting: the recommendation covers emails only. “Captive” messaging systems, such as the secure messaging offered by banks, rely on different protocols and should fall outside its scope, even where they formally resemble email.

Background

Article 82 of the French Data Protection act is commonly associated with the cookie regime, but it is not confined to it: it captures any read or write operation on the user’s terminal, whatever the technique – including access by software or applications, and, as the Recommendation confirms, by pixels. The pixel is an invisible image, usually of very small size, hosted on a remote host server and referenced by a URL inserted in the body of the message. Its automatic display (occurring when the email is read) requires the recipient’s email software or browser to send a network request to the host server URL (usually controlled by the sender). In response to such request, the image is downloaded and written into the memory of the recipient's terminal so that it can be “displayed” (though remaining invisible in practice). This constitutes a write operation on the recipient’s terminal.

The display process implies transmitting to the host server individualized parameters contained in the image URL (pixel identifier, IP address, information concerning the consultation of an email etc.) that are automatically read on the recipient’s device. The reception and collection of those parameters by the host server constitutes a read operation on the recipient’s terminal. 

It reveals to the sender of an email if and when the email has been opened by the recipient, on which device, and provides an approximate location. It should be noted that an invisible one-pixel image, a personalized web resource, or an equivalent mechanism, all qualify as a pixel – provided that loading it when the email is read allows information to be read from the recipient's device.

In practical terms, pixels cause native information to be read and written on the user’s device, falling within the “write or read” scope of Article 82.

GDPR roles along the value chain

Article 82 of the French Data Protection Act refers to the notion of data controller. On that basis, the CNIL regularly applies the notions of data controller and joint data controller in its case law on cookies to determine who is accountable for the read/write operation – not merely to the subsequent processing of the data collected. The qualification holds even where the information read from or written to the terminal is not necessarily personal data.

The CNIL considers that the sender, meaning the organisation that decided to send the emails - whether or not it is the technical sender - determines the purposes and means of the tracking and would typically be considered as the data controller. This would apply including where it outsources tracker management to a third party.

The emailing platform, the service provider for sending emails, the service provider for the rental of mailing lists and the supplier of tracking technology would in principle on their side typically act as data processors. However, where such a provider reuses the data collected for its own purposes, for example to improve its own tool or the relevance and deliverability of its lists, joint-controllership may be retained for those operations.

The mailbox provider, i.e. the email service provider that receives and displays the message, is in a different position: because it does not itself use the data generated by the pixel, it is neither a processor nor a controller, even though it may technically play an important role by allowing or neutralizing the pixel (through accepting or blocking the automatic loading of images).

Organizations should therefore carefully review their arrangements with other actors of the value chain to ensure that the allocation of roles and liabilities accurately reflects how they wish tracking technologies to be implemented and used in practice. The CNIL's analysis makes clear that responsibility does not necessarily (and usually not) lie with the entity that technically deploys or accesses the tracker. In particular, senders should be mindful that their contractual acceptance of third-party read and write operations for the third-party's own purposes may give rise to joint controllership.

When is consent required?

The Recommendation requires prior consent when pixels are used for the following purposes:

• Analyzing email opening rates in order to measure and optimize campaign performance by personalizing content, or adapting sending frequency or channel (e.g. emails, SMS, push notifications).
• Creating profiles of recipients based on their expressed preferences and interests, in order to target them in contexts other than emails (e.g. on websites, mobile applications, or other communication channels).
• Detecting and analyzing suspected fraud, such as identifying unusual or massive email openings that may indicate automated behavior (e.g. mass entries into a competition, attempts to exfiltrate information).
• Individually measuring the email opening rate for deliverability purposes, where this is done outside the exempted cases described below (i.e. going beyond what is strictly necessary for adjusting sending frequency or cleaning the database of inactive recipients).

Consequently, most marketing and performance-measurement uses of pixels are subject to the consent of the user. The Q&A confirms that this applies whatever the quality of the recipient (client, prospect or employee) and whatever the context (B2C or B2B).

Finally, it should be noted that the rules on tracking pixels are separate from the rules on direct marketing by email. In other words, being permitted to send a marketing email without consent, under Article L. 34-5 of the French Postal and Electronic Communications Code (CPCE), does not mean that a pixel inserted in that same email is exempt from consent.

Although it is clear that consent is the rule, the CNIL was obviously conscious that it had not been widely applied and that massive regularisation would be needed. Therefore it opened an interim period where consent by default can be obtained further to a mere information and the absence of user’s opt-out (see below). Once such consent by default has not been obtained during the interim period, regular consent will need to be obtained. 

Two narrow exemptions

The CNIL accepts two exemptions from consent, both narrowly framed. As a preliminary point, it should be noted that both exemptions only cover (i) emails expressly requested by the recipient (e.g. newsletters sent following the subscription of a user, marketing emails sent with the authorization of a user), or (ii) emails relating to a service they have expressly requested (transactional emails such as emails including order confirmations, invoices, shipping notices, appointment reminders, renewal of subscription, legal and regulatory information such as changes in GTU). In particular, the CNIL highlights that when the email is sent without the consent of the recipient on the basis of the exception of Article L. 34-5 CPCE (applicable when the outreach concerns analogous products or services), then the email is not considered as explicitly requested by the recipient or relating to a service expressly requested and does not fall within those exemptions.

• The first exemption covers pixels used for security purposes participating to user authentication, for example when verifying that an email containing a security code has been opened on a device known to belong to the intended recipient. This exemption does not extend to general fraud prevention or advertising fraud detection, unless in certain cases where the security measures are focused on the user (e.g. pixels in authentication emails).

• The second exemption covers the individual measure of opening rate of emails for deliverability purposes. 

  The controller must demonstrate that the operations are limited to what is strictly necessary to either:

  • adapt the sending frequency.
  • stop sending emails to “inactive” recipients (database cleaning). 

  In case those conditions are fulfilled, the pixel may also be used to (i) assess and choose the best suited communication channel as well as to (ii) help demonstrate compliance with a legal obligation to transmit information to the recipient, such as showing that information was delivered before, during or after the conclusion of a contract. 

For both exemptions, the temporal data collected must, in principle, be limited to the date (not the time) of the last known opening, unless the sender can document and justify that other data must be retained (such as the exact time of the email).

The Q&A adds two clarifications worth noting. First, a single pixel may pursue one exempted purpose and one purpose requiring consent at the same time. In this case, the exempted purpose can run immediately, while the other can only be activated once valid consent has been obtained. In practice, senders will need to be able to evidence that separation. Second, messages that are clearly commercial, such as cart-reminder emails, cannot rely on the deliverability exemption, since their purpose is essentially promotional.

Informing users and organizing consent

Where consent is required, recipients must be informed as a condition of valid consent; where the pixel is exempt, Article 82 imposes no such duty, but the CNIL recommends, as a matter of good practice, that recipients be informed of its existence. In particular, where personal data is collected (which will very often be the case), the GDPR's general transparency and legal basis obligations fully apply for subsequent processing activities. 

The CNIL provides detailed guidance on how consent should be obtained and managed. In particular, it recommends that:

• Consent be collected at the same time as the email address, notably at newsletter sign-up or account creation. Where concurrent collection is not possible, the CNIL then recommends sending a subsequent request via an email that itself carries no pixel requiring consent, providing a link to a page that calls for a clear positive action. 
• Recipients be clearly informed of the email address concerned and of the fact that the tracking pixel will be deployed across all devices associated with that address.
• A separate consent be obtained for each distinct purpose, except where purposes are closely related. Similarly to the cookie regime, it is possible to collect a single consent for several purposes via an accept button on the first level of information, provided the second level enables an independent choice for each purpose.
• Refusing consent be as easy as granting it, with silence treated as refusal.
• Consent be capable of being withdrawn at any time, typically via a tracked link in the email footer, which must stop the pixel operating on future emails. Where the link leads to a web page, that page should allow withdrawal without any additional step – in particular without requiring the recipient to re-enter their email address.
• Appropriate records of consent be maintained. In particular, the CNIL notes that (i) the choice of the user (acceptance or refusal) should be recorded for a certain period in order to avoid too frequent solicitations, considering that a six month timeframe constitutes a good practice and (ii) when the email address is collected through a third party, a clause in a supplier contract is not, on its own, sufficient evidence: the sender must be able to verify, for example through audits, that consent was validly collected.

It should be noted that a single, combined consent can cover both direct marketing by electronic means and the use of tracking pixels in commercial prospecting emails, provided the two purposes are sufficiently related. This covers for example, where marketing is expressly presented as personalized (e.g. a personalized newsletter) and the pixel directly contributes to that personalization.

A final practical point concerns consent management platforms (CMPs). CMPs are publicly understood as tools for web and mobile app trackers, and pixel consent will often be collected at a moment that is decoupled from the collection of the email address. The CNIL considers that using a CMP to collect consent to email pixels calls for particular care: for consent to be “informed”, the recipient must readily understand that their choice extends to operations carried out in a different environment (email) from the one in which the choice is expressed (a website or app), and which email address is affected.

The interim period enabling a “consent by default” following mere information

For addresses collected before the publication of the Recommendation (i.e. 14 April 2026), the CNIL allowed senders to continue using pixels, including ones that would ordinarily require consent, provided (1.) they sent recipients clear and accessible information within three months (thus meaning by 14 July 2026) (2.) together with a simple means of objecting to future tracking. 

The CNIL later clarified that this interim period could be extended by a reasonable timeframe where objective and documented operational difficulties exist, such as a particularly large database or deliverability issues. For instance, a sender may need to stagger communications considering the volume of messages being sent and the resulting deliverability constraints. However, the sender will need to demonstrate that such staggering was necessary to benefit from this tolerance. This is to be self-assessed, although the CNIL is likely to make its own assessment in case of litigation. Most importantly, consent by default is allowed during this interim period:

• Where the information email was sent during the interim period (i.e. by 14 July 2026 or reasonably later in case of an extension), and:

1. no objection was raised: the sender may continue to rely on that absence of objection for future emails. This remains true as long as the sending conditions remain unchanged and no new consent is otherwise triggered, for instance by sharing the addresses with new partners or because the conditions of the marketing change. In that case, the data controller will have to collect a new consent compliant with the Recommendation requirements (see above). Again, such “consent by default” is pretty unusual in the GDPR framework, and it appears that the CNIL used it here as an incentive tool for senders to act by 14 July and also in view of the need for massive regularization that could be foreseen;
2. an objection was raised: in such circumstances, tracking pixels may no longer be included in emails. However, there is no obligation to delete data previously collected through tracking pixels embedded in emails sent before the publication of the Recommendation, provided that the storage limitation principle is complied with.

• Where the information email was not communicated during the interim period, the ordinary rules shall apply in full. A sender wishing to keep using consent-requiring pixels on those addresses shall obtain consent in a way that meets the Recommendation's standard (in particular, not a consent by default); failing that, it must stop using those pixels. 

Conclusion and next steps

The Recommendation and the Q&A confirm that the CNIL now expects the same rigour for pixels in emails as it has long demanded for cookies on websites. While neither document is legally binding, with the Recommendation itself stating that it is “neither regulatory nor exhaustive” and is merely intended to facilitate compliance, the CNIL has demonstrated in the cookie context that it closely adheres to its own guidance when enforcing Article 82, regularly relying on and citing its recommendations in sanction decisions. In practice, organizations should therefore either implement the safeguards set out in the CNIL's guidance, which provides the strongest compliance position, or, at a minimum, adopt measures offering an “equivalent level of protection”, as expressly recognized in the CNIL's decisional practice with respect to cookies.

Tracking technologies have remained a key area of focus for the CNIL in recent years, reflected notably in many enforcement actions relating to cookie compliance, a recommendation on cross-device consent published earlier this year, and a forthcoming recommendation addressing cross-domain consent. Coupled with the significant efforts it has made to explain its methodology for pixels, including the publication of a dedicated Q&A and two webinars, this suggests that enforcement activity in this area may be on the horizon. As in the cookie context, the CNIL's investigation service is likely to rely on a combination of online inspections (for example, subscribing to newsletters or creating user accounts while testing different consent scenarios and analyzing the source code of the emails subsequently received) and documentary inspections to assess compliance.

Businesses should therefore ensure that they have a robust compliance framework for tracking pixels and cookies in place. For organizations that already operate mature cookie compliance programs, many of the same governance principles may be extended to email tracking technologies like pixels, including comprehensive mapping, clearly defined purposes, granular consent mechanisms and the ability to maintain auditable records of consent.

In particular, from an operational perspective, managing the compliance of pixels with the Recommendation entails:

1. Conducting a comprehensive mapping exercise to identify all categories of emails sent to individuals and determine whether they contain tracking pixels. For each pixel identified, its actual purpose should then be identified, rather than relying on the purpose attributed by the relevant tool provider. 
2. Carrying out a legal assessment of tracking pixels to determine whether consent is required under the CNIL’s Recommendation based on their purpose and, where it is, whether any of the exemptions provided for by the Recommendation may nevertheless apply.
3. Properly documenting the legal analysis by maintaining records of the rationale for classifying a pixel as exempt, including any alternative measures adopted to achieve an equivalent level of protection where the CNIL's recommendations are not followed. They should also ensure that reliable evidence of consent is collected and retained, as contractual commitments from service providers alone are not sufficient to demonstrate compliance.
4. Adapting existing systems and processes to ensure that their email platforms can manage tracking preferences at an individual level, as compliance may require enabling or disabling tracking based on each recipient’s consent status. They should also review how consent is collected (collection should ideally occur at the point the email address is obtained) and verify that consent preferences, including withdrawals of consent, are effectively transmitted to email delivery tools so that tracking settings are correctly applied in practice.

France is one of only two EU Member states to have developed a truly dedicated body of guidance on tracking pixels: France and Italy, with the Garante’s guidelines issued on 26 April 2026. In Germany, the Conference of Independent Data Protection Authorities (DSK) announced in a press release December 2025 its intention to develop its own guidance on tracking pixels in 2026 following numerous complaints received. However, no such guidance has been published to date.