# CNIL email tracking pixel rules: a 2026 compliance guide > Understand France’s 2026 CNIL recommendation for email tracking pixels: which purposes need consent, narrow exemptions, transition rules, withdrawal, proof, vendor roles, and an implementation checklist. - **Category:** Email compliance - **Published:** August 5, 2026 - **Reading time:** 19 min read - **Author:** Maya Chen, Email infrastructure - **Canonical page:** [https://emailbump.com/blog/cnil-email-tracking-pixels](https://emailbump.com/blog/cnil-email-tracking-pixels) France’s data protection authority, CNIL, adopted a recommendation on email tracking pixels on March 12, 2026, and it was published on April 14, 2026. The central rule is purpose-specific: using a remote pixel to measure and optimize campaign opens, build profiles, target people across channels, or perform several other non-exempt functions generally requires prior consent under Article 82 of France’s Data Protection Act. Two categories can qualify for narrow exemptions—security that participates in user authentication and limited deliverability uses—but only when the recommendation’s conditions are actually met. > **This is an implementation guide, not legal advice** > > The recommendation is detailed, purpose-dependent, and connected to French and EU rules. Have qualified privacy counsel or a data-protection professional assess your organization, audience, contracts, purposes, consent language, and technical design. Do not treat a provider toggle or this article as a compliance determination. ## CNIL email pixel rules at a glance ### Purpose-first decision map ```text PIXEL PURPOSE CNIL POSITION IN THE RECOMMENDATION Campaign open-rate analysis and optimization prior consent generally required Content, frequency, or channel personalization prior consent generally required Cross-context interest/profile targeting prior consent generally required Fraud-suspicion detection and analysis prior consent generally required Individual deliverability tracking outside limits prior consent generally required Security participating in user authentication may be exempt when strictly necessary Narrow deliverability/list-hygiene purpose may be exempt when every condition is met Effectively anonymized later reuse separate analysis; GDPR applies to anonymization The same technical pixel can have different treatment when its real purposes and data uses differ. ``` Do not classify a pixel as exempt merely because a dashboard labels it “deliverability” or “security.” Inventory the exact data written or read, message categories, recipients, downstream calculations, profile updates, exports, A/B decisions, channel changes, retention, and third parties. A consent-exempt purpose cannot quietly feed a consent-required one. ## Why Article 82 applies to a remote image An email pixel is usually a remote image with a URL tied to a recipient, message, or context. When the mail client displays it, the terminal makes a network request and communicates information such as the pixel identifier and IP address. CNIL treats this as a reading operation on the user’s terminal. Its recommendation follows the European Data Protection Board’s Guidelines 2/2023 on the technical scope of Article 5(3) of the ePrivacy Directive, transposed in France through Article 82. ### What happens when the email renders ```text 1 HTML contains a remote image URL with an identifier 2 Mail client, proxy, scanner, cache, or reader requests that URL 3 Remote server receives the identifier and request metadata 4 Server returns the image and may record an open-like event 5 Event may update analytics, frequency, profiles, channel, or list state The legal analysis covers the reading/writing operation and its purpose. Subsequent processing of personal data must also satisfy the GDPR. ``` ## Purposes for which CNIL says consent is required - Analyzing open rates to measure or optimize campaigns, including personalizing content or changing email frequency or communication channel. - Creating recipient profiles from preferences or inferred interests for targeting on websites, mobile applications, or other channels. - Detecting and analyzing suspected fraud through unusual or large-scale email openings, such as automated contest behavior or possible information exfiltration. - Measuring individual opens for deliverability when the implementation falls outside the recommendation’s narrow exempt conditions. This means ordinary marketing open-rate reporting is not transformed into an exempt deliverability function by renaming it. If individual open data chooses winning subject lines, changes content, scores leads, triggers sales outreach, alters the next channel, or enriches profiles, document each purpose and apply the relevant consent requirement. ## The authentication and security exemption CNIL says a pixel can be exempt when its exclusive purpose is a security measure participating in user authentication—for example, helping verify that an email containing an authentication code was opened on a terminal known to belong to the intended user. This is not a blanket “fraud prevention” exemption. The recommendation separately places detection and analysis of fraud suspicions among purposes requiring consent, while the FAQ rejects stretching the authentication exemption to unrelated advertising-fraud detection. > **Do not make the pixel an authentication factor by itself** > > An image request can originate from a privacy proxy, security scanner, cache, forwarded message, or background preload. Even where the legal exemption applies, the event should not independently prove mailbox possession, approve access, release funds, or mark a person as having read a notice. ## The deliverability exemption is narrow CNIL permits a possible exemption for individual open measurement used for deliverability, but the controller must demonstrate that the operations are limited to what is strictly necessary to adapt frequency or stop sending to inactive recipients. The recommendation also discusses evaluating or adapting the communication channel and contributing evidence that legally required information was transmitted, subject to the stated conditions. ### Deliverability exemption checklist ```text REQUESTED SERVICE Email was requested by the recipient or tied to a requested service EXCLUSIVE PURPOSE Pixel is used only for the qualifying deliverability objective STRICT NECESSITY Every collected field and operation is necessary for that objective LIMITED ACTION Data adapts frequency/channel or stops sends to inactive recipients MINIMIZATION No extra IP, user-agent, precise time, profile, or campaign use by default RETENTION Prefer only the date of last known open, at day granularity, overwriting prior date SEPARATION Exempt stream cannot feed campaign optimization or profiling TRANSPARENCY CNIL recommends informing people even for exempt pixels DOCUMENTATION Controller can demonstrate the facts supporting each condition ``` The FAQ adds several practical boundaries. Collecting IP address or user-agent beyond what is necessary does not become exempt merely because those values are quickly deleted or anonymized. A requested newsletter can potentially support the exemption when the other conditions are satisfied; a promotional email sent under an exception for similar products is not automatically a service expressly requested by the user. The evaluation remains case-specific. ## Sending consent and pixel consent are separate questions A message that can legally be sent without prior marketing consent can still contain a pixel purpose that requires consent. CNIL highlights order confirmations, certain similar-product promotions, charitable outreach, and some professional outreach as examples where the pixel analysis remains independent from the rule governing the send. Conversely, a requested newsletter does not authorize every form of pixel-based profiling merely because the recipient subscribed. ### ORDER CONFIRMATION **Email can be operational; campaign-optimization pixel can still require consent** Classify the pixel purpose independently from the message label. ### REQUESTED NEWSLETTER **Narrow list-hygiene pixel may qualify for exemption** Only when strict necessity, minimization, and every other condition are met. ### ABANDONED CART **CNIL treats this as promotional in its FAQ** The FAQ says a pixel in this type of message cannot use the deliverability exemption. ### PASSWORD RESET **Authentication security may qualify** Do not reuse the event for engagement scoring or sales profiling. ## What changed on April 14 and July 14, 2026 ### Transition timeline ```text MARCH 12, 2026 CNIL adopts the final recommendation APRIL 14, 2026 Recommendation is published; three-month transition begins JULY 14, 2026 General three-month point for previously collected addresses AFTER TRANSITION Required consent or a valid legacy information/objection path must exist, unless the pixel qualifies for an exemption The FAQ allows a reasonably extended information period when objective, documented volume or deliverability difficulties make three months insufficient. ``` For addresses collected before publication, the recommendation allowed pixel operations to continue if recipients received clear, accessible information within a period generally no longer than three months and could object to future use. The FAQ says that where this information and choice were properly provided, the controller can continue relying on the absence of objection while the sending conditions remain unchanged and no new email consent is required. If the required legacy information was not sent by the end of the applicable period, the recommendation’s ordinary rules apply: obtain consent where required or stop using those non-exempt pixels. For addresses collected after publication, design consent around the new collection rather than treating the transition as permission to keep an undocumented default. ## How CNIL recommends collecting consent - Present each pixel purpose with a short intelligible heading and a sufficiently clear description before the choice. - Identify the email address concerned and explain that the choice applies across devices where that mailbox is viewed. - Prefer collecting the choice when the email address is collected, with layered access to fuller information. - When later collection is necessary, send a pixel-free email linking to a choice page that requires a genuine positive action. - Make refusal as straightforward as acceptance; inactivity means no consent. - Avoid disproportionate pressure and do not obstruct access to ordinary email for refusing tracking. - Remember a refusal so the person is not asked repeatedly; CNIL identifies six months without re-solicitation as good practice. - Request distinct choices for materially distinct purposes, while applying CNIL’s limited guidance on connected purposes and layered controls. ### Consent evidence record ```text email_address_id internal mailbox identity, not raw address in tracking URL purpose_id stable purpose code purpose_version exact notice and interface version decision accepted / refused / withdrawn decided_at timestamp and timezone collection_context signup form / preference center / pixel-free email controller_parties sender and relevant joint controllers evidence_reference immutable form or policy snapshot scope message categories or all stated email withdrawn_at effective withdrawal time source_system application that collected and synchronized choice ``` ## Withdrawal must stop future and residual tracking CNIL recommends a simple withdrawal link in each email footer. If it leads to a web page, the withdrawal should take effect without making the person re-enter the email address or navigate unnecessary steps. Removing consent must stop the affected reading and writing operations in future messages. Because a sender cannot retrieve email already delivered, the system may also need to ignore later image requests associated with withdrawn consent from previously sent messages. ### Withdrawal propagation ```text preference action -> authenticate the scoped preference link safely -> record withdrawal and purpose version -> disable pixel injection in all future render paths -> synchronize campaign, transactional, ESP, and warehouse state -> block or discard events from identifiers in already-sent messages -> stop downstream profiles, triggers, exports, and experiments -> preserve only the evidence necessary to honor and demonstrate the choice ``` ## Sender and vendor responsibilities The organization deciding to send the email and use pixels will generally be a controller for that operation. An email service provider usually acts as a processor when it follows the sender’s instructions. A provider or tracking vendor can become a controller or joint controller for operations tied to its own purposes, depending on the facts and contractual acceptance. Mailbox providers are not part of the pixel processing merely because they render, proxy, cache, or block the remote image when they do not use the resulting pixel data. - Map which party chooses every purpose and means of processing. - Document processor instructions and prohibit undisclosed provider reuse. - For joint control, allocate information, rights, consent, security, and evidence duties transparently. - Do not treat a contract promise as proof that a third party collected valid consent; obtain evidence and audit the mechanism. - Inventory CDNs, image hosts, logging platforms, analytics warehouses, experimentation tools, and profile destinations—not only the ESP. ## A practical migration plan ### CNIL pixel migration ```text 1 DISCOVER render every template and locate remote images, redirects, and vendor defaults 2 TRACE map identifiers, request metadata, logs, events, profiles, exports, and retention 3 CLASSIFY write one real purpose and legal analysis for each operation 4 DISABLE default nonessential pixels off where consent or evidence is missing 5 SEPARATE isolate exempt telemetry from campaign analytics and profiling 6 COLLECT build informed accept/refuse controls tied to the email address 7 PROVE version notices and preserve individualized evidence 8 WITHDRAW synchronize choice and ignore identifiers from already-sent email 9 MINIMIZE reduce fields, precision, access, retention, and downstream reuse 10 VERIFY test every campaign, automation, transactional path, and vendor change ``` Do not infer French applicability solely from a .fr address. A person in France can use Gmail, Outlook, a corporate domain, or another mailbox. Determine scope from the organization’s actual processing, establishment, targeting, services, and legal advice—not the top-level domain alone. ## What to measure without nonessential opens Removing campaign pixels does not eliminate useful measurement. Preserve provider acceptance, bounces, deferrals, complaints, unsubscribes, replies, and first-party product or purchase outcomes under the appropriate policies. Clicks and redirects can also trigger ePrivacy analysis and automated scanners, so they require their own review rather than serving as a universal tracking workaround. ### DELIVERY **Receiver accepted or rejected the message** Useful operational evidence, but not proof of inbox placement or reading. ### REPLY **Recipient started an expected conversation** Strong for human workflows with monitored reply handling. ### PRODUCT EVENT **Customer completed the intended first-party action** Often closer to the campaign goal than an image request. ### PURCHASE **Eligible customer completed an order** Use incrementality and contribution rather than last-click revenue alone. ### COMPLAINT **Recipient reported unwanted mail** Suppress promptly and investigate source, purpose, and expectations. ### UNSUBSCRIBE **Recipient withdrew from a message purpose** Honor separately from pixel-consent withdrawal where the controls differ. ## Keep delivery and customer outcomes distinguishable Email Bump connects message delivery activity, campaigns, contacts, consent, events, replies, and suppressions so teams can reduce dependence on noisy open pixels. - Message-level delivery activity - First-party event context - Consent and suppression state [Learn more](https://emailbump.com/features/analytics) ## Frequently asked questions ## Does CNIL require consent for every email tracking pixel? No. The recommendation identifies narrow possible exemptions for security participating in authentication and limited deliverability uses. Most campaign measurement, personalization, profiling, cross-channel targeting, fraud-suspicion analysis, and broader individual open tracking require consent. Every exemption depends on its conditions and actual data use. ## Can legitimate interests replace pixel consent in France? The Article 82 reading or writing operation has its own consent-or-exemption analysis. A GDPR lawful basis for later personal-data processing does not itself eliminate the prior consent required for a non-exempt tracker. Analyze both layers. ## Can I use a deliverability pixel to report campaign open rates? Not by default. The exemption is tied to strict necessity and a narrow deliverability purpose. Reusing individual open data for campaign reporting or optimization can introduce a consent-required purpose. CNIL’s FAQ discusses effectively anonymized aggregation separately, but the anonymization process and the underlying collection still need careful analysis. ## Does withdrawing newsletter consent also withdraw tracking consent? Do not assume the controls are interchangeable. The scopes can differ. Make each choice understandable, synchronize both where the user requests both, and ensure tracking withdrawal stops affected future operations and residual requests from previously sent messages. ## Build privacy-aware email measurement - [Email link tracking and privacy](https://emailbump.com/blog/email-link-tracking-privacy) — Compare shared UTMs, individual redirects, action links, scanners, and lower-data attribution design. - [Email analytics without tracking pixels](https://emailbump.com/blog/email-analytics-without-tracking-pixels) — Measure transport, feedback, replies, outcomes, and incremental lift without individualized opens. - [UK PECR email pixel rules](https://emailbump.com/blog/email-tracking-pixels-uk-pecr) — Understand Regulation 6, B2B tracking, consent, Schedule A1 exceptions, and the UK GDPR overlay. - [Italy email pixel rules](https://emailbump.com/blog/italy-email-tracking-pixel-rules) — Apply Italy’s 2026 consent, anonymous-statistics, granular-withdrawal, provider, and transition guidance. - [Email tracking pixels](https://emailbump.com/blog/email-tracking-pixel) — Understand pixel mechanics, proxies, caching, accuracy, minimization, and safer implementation. - [Transactional vs marketing](https://emailbump.com/blog/transactional-vs-marketing-email) — Classify message purpose independently from tracking purpose. - [Email webhooks](https://emailbump.com/blog/email-webhooks) — Verify, deduplicate, store, and reconcile delivery events safely. - [Email sent vs delivered](https://emailbump.com/blog/email-sent-vs-delivered) — Separate submission, acceptance, delivery, placement, and engagement milestones. ## Sources - [CNIL recommendation: email tracking pixels (PDF, adopted March 12, 2026)](https://www.cnil.fr/sites/default/files/2026-04/recommandation-pixels_de_suivi.pdf) - [CNIL recommendation overview](https://www.cnil.fr/fr/recommandation-pixel-suivi-courriels) - [CNIL FAQ on the email-pixel recommendation](https://www.cnil.fr/fr/faq-recommandation-pixels-courriers-electroniques) - [CNIL consumer explanation of email pixels](https://www.cnil.fr/fr/pixels-de-suivi-dans-les-courriers-electroniques-vous-devez-etre-mieux-informes) - [EDPB Guidelines 2/2023 on Article 5(3) ePrivacy scope](https://www.edpb.europa.eu/documents/guideline/guidelines-22023-on-technical-scope-of-art-53-of-eprivacy-directive_en) - [Bento: Most email tracking pixels now need consent in France](https://bentonow.com/posts/cnil-email-tracking-pixels)