What's new in tracking technology?

A tracking pixel is typically a small image hosted remotely and loaded when an email is opened. Depending on its configuration, it may reveal whether and when the email was opened and collect technical information such as an IP address, device type or email client. The guidance applies to any organisation using email tools to monitor opens, clicks, delivery, engagement or device information, or to adapt the content, timing or frequency of communications. Although email tracking has often been treated as an operational feature of marketing and CRM platforms, the regulators' position is now clear: from a legal standpoint, these technologies must be approached in the same way as cookies and other online trackers. Organisations should therefore review how pixels are deployed across newsletters, marketing emails, account-related communications and other automated email journeys.

The common legal anchor is Article 5(3) of the ePrivacy Directive. In France, the CNIL applies the French implementation; in Italy, the Garante's Guidelines treat the loading of a pixel as an operation within Article 122 of the Italian Privacy Code. In both jurisdictions, the GDPR applies alongside that rule to the personal data generated or collected through the pixel, including transparency, fairness, purpose limitation, data minimisation, retention and privacy-by-design requirements. The practical consequence is important: the legal basis used to send an email and the permission needed to track its opening are separate questions. An organisation may be entitled to send a message under marketing consent, legitimate interests, a customer soft opt-in rule (in Italy, Article 130 of the Privacy Code) or because the message is transactional, but that does not automatically permit the placing of a non-exempt tracking pixel in the message.

The key point: email tracking will usually require prior consent

As a general rule, both the CNIL and the Garante consider that tracking pixels embedded in emails require the recipient's prior consent, free, specific, informed and unambiguous. The Italian guidance is explicit on that standard, and the French recommendation is aligned. That consent should not be bundled into other consents already obtained from the individual: a general marketing opt-in or a cookie consent collected on a website will not necessarily be sufficient to cover tracking within emails. Prior consent will generally be required where a pixel is used to:

• measure an individual recipient’s engagement in order to optimise a campaign;
• personalise content, adjust sending frequency or select another communications channel;
• build or enrich a profile based on email-opening behaviour;
• support cross-channel targeting;
• measure individual deliverability beyond a narrowly framed exemption; or
• identify suspected fraud or automated interactions where the operation primarily serves the sender’s analytics or fraud-management purposes.

To be valid, consent must be specific to email tracking, clearly explained, and capable of being evidenced for each recipient. Organisations will need to be able to show not only that consent was obtained, but also the information presented to the individual at the time. The two regulators converge on the further point that pixel consent is distinct from the basis used to send the email: a valid basis to send the communication does not, in itself, make the pixel lawful.

Exemptions exist, but they are narrow

Both authorities recognise that certain pixels may be used without consent where they are genuinely necessary to enable or facilitate the communication, or where they are strictly necessary for a service expressly requested by the user.
The potentially exempt scenarios include:

• aggregated and anonymised measurement using a single non-individualised pixel (with anonymisation of associated technical data), typically for deliverability or open-rate statistics;
• security measures linked to authenticating the user, such as account activation or password reset; and
• mandatory service or regulatory communications where the operation is genuinely necessary in the perimeter of what is required.

The decisive factors are what the pixel actually does, what data it collects, whether it identifies a recipient, and how the resulting data is used. A label such as “security”, “anti-fraud” or “deliverability” is not enough. The CNIL warns against applying exemptions broadly to all “service” or “relationship” emails, and the Garante is particularly firm that individualised bot-filter or sender-side anti-fraud measurement does not automatically benefit from an exemption. Mixed-purpose pixels are especially difficult: where the same operation supports an exempt purpose and campaign analytics or profiling, the safer approach is to treat the pixel as consent-based or to redesign it so that the exempt operation is technically separate. Data collected under an exemption should also not then be reused for personalisation, profiling or individual analytics without a separate valid basis.

In France, for email addresses collected before 14 April 2026, the CNIL provided for a transitional period from 14 April 2026 to 14 July 2026 to allow organisations to adapt their systems, consent flows and internal processes. As that transitional period has now expired, organisations using email tracking pixels should check whether their current practices are aligned with the CNIL's expectations; where remediation work is still ongoing, the steps already taken, the remaining actions and the expected timeline for completion should be properly documented.

In Italy, for processing already in place, the Garante has set a six-month transitional period running from publication in the Official Gazette on 29 April 2026 and expiring on 29 October 2026. From that date, Italian practices should be aligned with the guidelines, or remediation plans should be clearly documented.

In the United Kingdom, the ICO published its final Storage and Access Technologies guidance on 29 April 2026. The guidance does not set out a specific transitional period for email tracking pixels. Organisations should therefore assess their current use of pixels against the applicable PECR and UK GDPR requirements.

On 29 April 2026, the ICO published final guidance on Storage and Access Technologies. The guidance explains how PECR and, where relevant, UK GDPR apply to cookies, tracking pixels, device fingerprinting and similar technologies that store information on, or access information from, a user’s device. It is intended to provide organisations with greater clarity on when consent is required, how the available exemptions operate and how PECR interacts with UK GDPR requirements.

The main UK-specific points to flag are:

• The guidance extends beyond cookies. It covers tracking pixels, device fingerprinting, scripts, tags, web storage technologies and other tools that store information on, or access information from, a user’s device. The ICO confirms that regulation 6 of PECR applies where a tracking pixel stores information on a user’s device or accesses information stored on a user’s device, and includes examples involving pixels used in marketing emails and affiliate-marketing arrangements.
• Consent remains central. Regulation 6 of PECR prohibits storing information, or gaining access to information stored, in a subscriber’s or user’s terminal equipment unless an exception in Schedule A1 applies. Where no exception applies, organisations must tell users what the relevant technologies are, explain what they do, and obtain prior consent before using them.
• The exemptions are narrowly framed. The guidance addresses new exceptions for technologies used solely for statistical purposes and for adapting or enhancing the appearance or functionality of a service or website. These may apply without consent only where the statutory conditions are met, including clear and comprehensive information and a simple, free means to object. Technologies used to monitor individual users, undertake profiling, support online advertising or pursue an additional purpose will not fall within these exceptions.
• Mixed-purpose technologies require particular care. The ICO states that the exemptions only apply where the storage or access is carried out for the relevant exempt purpose, rather than for another purpose at the same time. Organisations should therefore assess each pixel by reference to its actual purposes and configuration.
• Organisations should include email pixels within technical audits and consent assessments, ensure notices and consent mechanisms accurately describe the tracking in practice, review any reliance on PECR exemptions, and confirm that third-party providers use information only for purposes consistent with the relevant exception.

A compliant programme goes beyond changing the wording of the privacy or cookie notice. Across France, Italy and the United Kingdom, organisations should prioritise the following workstreams:

1. Map the technology

Identify every category of email containing a pixel, including marketing, newsletters, account notifications, transactional messages and automated journeys. Record the technology provider, data collected, identifier design and retention.

2. Identify each purpose

Separate deliverability, campaign optimisation, personalisation, profiling, cross-channel targeting, security and bot detection. Do not assume that a vendor’s product label reflects the legal purpose.

3. Classify consent-based and exempt use cases

Document why each operation requires consent or falls within a specific exemption. Where an exemption depends on aggregation or anonymisation, confirm that the technical configuration delivers that result.

4. Review vendor arrangements

Confirm with email service providers, tracking technology providers and mailing list providers whether they act as processors, joint controllers or independent controllers, and align contractual terms accordingly.

5. Build a forward-looking opt-in flow

Capture pixel consent when the email address is collected through sign-up forms, gated content, webinar registration or similar channels. If consent cannot be collected at that stage, do not activate a consent-based pixel until a valid opt-in has been obtained.

6. Address existing contacts

Where no valid pixel consent is available, use a one-off re-permissioning message before further consent-based tracking. The message itself should not carry the pixel for which consent is requested, and silence should be treated as refusal. The recipient should be able to continue receiving emails where there is an independent basis to send them.

7. Create a granular preference centre

Recipients should be able to stop tracking while continuing to receive communications where there is an independent basis to send them. Withdrawing consent should be as easy as giving it, and should be propagated promptly to the CRM, marketing platform and email service provider.

8. Provide a consolidated transparency layer

Explain in a single accessible place what the pixels are, the data collected, each purpose, any third-party technology providers, exempt processing, retention and how choices can be changed. Cross-reference it from forms and email footers.

9. Keep evidence

Maintain an audit trail showing the wording presented, the version of the notice, the timestamp, the choice made (or absence of response) and any later withdrawal. Record refusals as well as consents.

10. Review historic data

A prospective remediation model may be defensible, but historic pixel-derived data remains subject to the GDPR and should not be repurposed for new profiling or analytics without a valid basis. It should be subject to proportionate retention periods.

Treating a policy update as the solution. Transparency is necessary, but it does not replace consent, preference management or technical enforcement.

Making tracking opt-out equivalent to email unsubscribe. The recipient should be able to reject or withdraw non-exempt tracking while continuing to receive the underlying email where it can lawfully be sent.

Assuming a “bot filter” is automatically essential. A tool used to improve the sender’s analytics is not necessarily a security exemption. The operation must be assessed on its facts and may need consent unless redesigned on an aggregate and anonymised basis.

France and Italy are the clearest recent examples of regulators applying the ePrivacy rules specifically to pixels in emails, while the United Kingdom has now addressed tracking pixels within its broader guidance on storage and access technologies. The underlying legal concept is not unique to those countries: Article 5(3) of the ePrivacy Directive concerns access to, or storage of, information on terminal equipment, and the EDPB’s Guidelines 2/2023 address the technical scope of that rule. Organisations using centralised marketing platforms should therefore design a model that can be extended to additional European markets, while confirming local requirements before rollout.

The immediate priority is operational. For Italy, organisations with existing processing should use the period before 29 October 2026 to move from policy analysis to tested implementation. For organisations active across France, Italy and the United Kingdom, a joint compliance programme can provide a strong and scalable baseline: granular consent, narrow exemptions, meaningful transparency, privacy-preserving design, and genuine control for the recipient.

Italian Garante, Decision No. 284 of 17 April 2026 and Guidelines
Italian Garante press release of 21 April 2026
CNIL recommendation on tracking pixels in emails (English translation)
CNIL publication page
CNIL questions and answers of 22 July 2026
ICO, final guidance on the use of storage and access technologies
ICO announcement of 29 April 2026