The short version
- Most marketing emails measure opens with a tiny invisible image. Under EU rules, that generally needs the subscriber's prior consent.
- Agreeing to receive your emails does not automatically mean agreeing to have your opens tracked. People must be told about the tracking and be able to refuse it.
- France: guidance published 14 April 2026. Existing subscribers had to be informed, with a way to say no, in principle by 14 July 2026. After that, consent is needed.
- Italy: guidelines published 29 April 2026, with six months to comply, until 29 October 2026.
- The consent rule applies across the whole EU. EU regulators confirmed in 2024 that it covers tracking in emails. France and Italy are the first to publish detailed guidance with deadlines.
Almost every email marketing report shows an open rate: how many people opened your campaign, and often exactly who. Most senders never think about where that number comes from.
European regulators have. Measuring who opens your emails is a form of tracking, and under EU rules it generally needs the subscriber's consent, just like cookies on a website. In April 2026, France's CNIL and Italy's Garante became the first to publish detailed guidance on what that means, with deadlines.
Here's what changed, what the deadlines are, and what it means for your list. It's a practical overview for business owners, not legal advice.
How emails know they've been opened
Most marketing emails contain a tiny image, usually one pixel in size and completely invisible. It's often called a tracking pixel. Each copy of the email carries its own version of that image, tied to the person it was sent to.
When the subscriber opens the email, their email app loads the image, and the sender learns that this specific person opened this specific email, when, and often on what kind of device.
It's the same principle as a cookie on a website. And that's exactly how regulators treat it.
What changed in 2026
Nothing about this is a new EU law. The EU's ePrivacy rules have long said that reading or storing information on someone's device needs their consent, with narrow exceptions. That's the rule behind every cookie banner, and every EU country has it in its own law.
In October 2024, the European Data Protection Board, where all EU data protection regulators sit together, confirmed in official guidelines that this rule covers tracking pixels in emails. Since then, regulators have treated email open tracking like cookies.
What happened in 2026 is that two national regulators set out, in detail, how to apply it, with deadlines:
- France: the CNIL adopted a recommendation on tracking pixels in emails on 12 March 2026 and published it on 14 April 2026.
- Italy: the Garante adopted official guidelines (Provision no. 284) on 17 April 2026, published in the Official Gazette on 29 April 2026.
Both start from the same point: signing up for your emails does not by itself cover tracking. Subscribers must be clearly told about it before they agree, and must be able to refuse it.
France: the timeline
| Date | What happened |
|---|---|
| June 2025 | CNIL publishes a draft recommendation and opens a public consultation |
| 12 March 2026 | CNIL adopts the final recommendation |
| 14 April 2026 | Recommendation published. It applies to new subscribers from this date |
| 14 July 2026 | End of the three-month window, in principle, to inform subscribers collected before 14 April and give them an easy way to say no |
| Coming months | CNIL supports businesses, then says it will check compliance in future inspections |
For subscribers collected before 14 April 2026, tracking could continue if they received clear information about it and an easy way to object within three months. The CNIL allows a longer period only where the delay can be justified.
That window closed on 14 July 2026. For subscribers in France who were not told in time, informing them now is no longer enough: you need their consent before tracking their opens, or you should stop tracking them. The CNIL allows you to ask for that consent by email, as long as that email contains no tracking itself.
Italy: the timeline
| Date | What happened |
|---|---|
| 17 April 2026 | Garante adopts guidelines on tracking pixels in emails (Provision no. 284) |
| 29 April 2026 | Guidelines published in Italy's Official Gazette (no. 98). The six-month period to comply begins |
| 29 October 2026 | End of the six-month period |
For marketing emails to existing subscribers, tracking already in place can continue during the transition, as long as subscribers are informed with your next suitable email and given an easy way to refuse tracking. Everything has to be in line by 29 October 2026.
Italy is also specific about how people can say no: every email should give an easy way to stop tracking while still receiving emails. The Garante's example is a standard icon or link in the footer that leads to a page where the subscriber can choose either to stop receiving emails altogether or to keep receiving them without being tracked.
What's still allowed without consent
Both regulators allow some uses without consent, but they don't draw the lines in the same place:
- Anonymous, combined statistics. In Italy, an overall open rate for a campaign, measured so that no individual subscriber can be identified. In France, only overall figures made anonymous from tracking that was already consented to or already allowed.
- Security. Tracking used only to protect logins, for example making sure a login code or password reset email is opened on the person's own device. General fraud prevention doesn't count.
- Limited list care. In France only, keeping just the date someone last opened an email they signed up for, so you can send less or stop mailing inactive people. Italy treats this as needing consent.
- Essential service messages. In Italy, service messages you are legally required to send, such as security alerts or changes to contract terms.
Everything beyond that, such as individual open tracking for marketing campaigns, measuring engagement per person, or building profiles, needs consent.
Does this affect you?
If you email people anywhere in the EU, yes. The requirement to get consent before tracking opens applies in every EU country, including Austria and Germany. It isn't a French or Italian rule. Regulators in Spain and Germany, for example, had already said that tracking pixels in emails need consent. And because the rule itself isn't new, there's no official transition period outside France and Italy.
What differs by country is the level of detail and the deadlines. France and Italy are the first to publish detailed guidance with transition periods and deadlines. The CNIL has also said its view covers business emails as well as consumer ones, and that it can act against senders based anywhere, including outside the EU, when they email people in France.
Other countries may publish their own detailed guidance. Until then, the safest approach is to follow the most detailed guidance published so far for your whole list. Getting ahead of it now is far easier than rushing later.
There's also a practical point: open rates were already becoming less reliable, because several popular email apps load images automatically or privately. Clicks, replies and sales are better measures of whether a campaign worked.
What to do now
- Find out who's on your list. When and how did people sign up, and what did they agree to? Start with subscribers in France and Italy, where the deadlines apply.
- Deal with existing subscribers. In Italy, inform them with your next email and give them an easy way to refuse tracking before 29 October. In France, anyone not informed by 14 July needs to give consent first, so ask them in an email that contains no tracking.
- Update your sign-up forms. New subscribers must be clearly told about open tracking when they sign up. A separate choice is the safest way to do it.
- Add a footer link to every email. Next to your unsubscribe link, a clearly labelled link where people can stop tracking but keep getting your emails.
- Update your privacy notice. Describe open tracking and what you use it for.
- Respect the choice. Subscribers who say no keep getting your emails, without individual tracking.
How we can help
For your existing subscribers: an information or consent campaign. We write, design and send a short, plain-language email to your current list explaining that your emails measure opens, what that's used for, and how to switch it off with one click. For Italy, it should go out before 29 October. For subscribers in France who were not informed by 14 July, the email asks for their consent instead, and we don't track their opens unless they agree. Elsewhere in the EU, the same consent rule already applies, so there's no reason to wait.
For new subscribers: forms with consent checks built in. When you build your list with us, every sign-up form we create includes the consent checks these rules expect. There's a clear choice about receiving your emails, a separate clear choice about open tracking, and double opt-in to confirm both. The rules don't always require a separate choice, but it's the safest approach. We record every choice with the date and the form it came from, so you can show exactly what each subscriber agreed to.
For every email: a Tracking preferences link. Every campaign we send has two links in the footer: Unsubscribe and Tracking preferences. Tracking preferences lets subscribers turn off open tracking and keep receiving your emails. We include it for every client, whatever country their subscribers are in, so your emails already include the footer choice Italy's guidelines describe. Every choice is honoured straight away.
Reporting that respects the choice. You still get clear results after every campaign. Subscribers who said no to tracking simply aren't tracked individually.
If you're not sure whether your list is affected, book a free call. We'll look at where your subscribers are, how they signed up, and what needs to happen next.
Sources
- European Data Protection Board: Guidelines 2/2023 on the technical scope of Art. 5(3) of the ePrivacy Directive, version 2.0 adopted 7 October 2024, see paragraphs 47 to 51 on tracking pixels (English, PDF)
- CNIL: Pixels de suivi dans les courriers électroniques: la CNIL publie ses recommandations (French)
- CNIL: Recommendation on tracking pixels in emails, full text (PDF) (French)
- CNIL: Questions and answers on the recommendation (French)
- Garante per la protezione dei dati personali: Press release on the tracking pixel guidelines (Italian)
- Garante per la protezione dei dati personali: Guidelines on tracking pixels in emails, Provision no. 284 of 17 April 2026 (Italian)
- Spain, AEPD: Report 0011/2014 on tracking pixels in marketing emails (Spanish, PDF)
- Germany, Federal Data Protection Commissioner (BfDI): Zählpixel (German)
This article is a practical overview as of September 2026, not legal advice. For decisions about your specific situation, speak to a lawyer or your data protection authority.
Frequently asked questions
Do I need consent to track email opens?
Across the EU, generally yes. EU regulators confirmed in 2024 that tracking pixels in emails fall under the same consent rule as cookies, and France and Italy set out the details in 2026. Tracking which individual subscriber opened a marketing email needs prior consent unless one of the narrow exemptions applies.
Is there a new EU law on email tracking?
No. The rule comes from the existing EU ePrivacy rules, which every EU country has adopted into its own law. In October 2024, the European Data Protection Board, where all EU data protection regulators sit together, confirmed in official guidelines that this rule covers tracking pixels in emails. In 2026, France and Italy became the first to publish detailed guidance with deadlines.
What was the 14 April 2026 date?
It's the day France's CNIL published its recommendation on tracking in emails. For subscribers collected before that date, senders had three months, so in principle until 14 July 2026, to inform them and give them an easy way to say no. For anyone not informed by then, consent is now needed before tracking their opens.
What is the deadline in Italy?
The Garante's guidelines were published in Italy's Official Gazette on 29 April 2026, with six months to comply, so until 29 October 2026. By then, existing subscribers must be informed with your next suitable email and given an easy way to refuse tracking.
Does this only apply in France and Italy?
No. The requirement to get consent before tracking applies across the whole EU, including Austria and Germany. Regulators in Spain and Germany, for example, had already said that tracking pixels in emails need consent. What's specific to France and Italy is the detailed guidance and the deadlines.
Do I need a separate checkbox for open tracking?
Not always. Both regulators accept a single consent in some cases, as long as people are clearly told about the tracking before they agree and can later refuse the tracking on its own. A separate, clear choice is the safest way to do it, and it's what we use.
Can I still see my open rate?
In limited ways. In Italy, an overall open rate measured anonymously, with no way to tell who opened, is allowed without consent. In France, overall figures are only allowed if they come from tracking that was already consented to or already allowed, and are then made anonymous. For individual open tracking you need consent from each subscriber.