CNIL's Email Tracking Pixel Rules: What Senders Must Do
The CNIL email tracking pixels recommendation, published in April 2026, made France the first country with dedicated rules on the invisible pixel that tracks email opens — and set a 14 July 2026 deadline for informing existing contacts. Here's exactly what Délibération n° 2026-042 requires, who it reaches, and what to do now the transition date has passed.
What this covers
What the CNIL actually decided
On 12 March 2026 the CNIL adopted, and on 14 April 2026 published, Délibération n° 2026-042 — its first recommendation dedicated specifically to tracking pixels in emails. The core decision: a tracking pixel that reports when a recipient opens an email is functionally equivalent to a cookie, and using it generally requires the recipient's prior consent. The CNIL frames the mailbox as an extension of a person's private life, so quietly measuring what happens inside it needs permission — exactly as a cookie on a website does.
Importantly, this is a recommendation, not a new regulation — but that distinction offers little comfort. It clarifies how existing law applies, which means it's the standard the CNIL will judge senders against, and it removes any "the rules were unclear" defense.
Consent is required when a pixel measures opens to gauge campaign performance, builds a profile of a recipient's interests, or is used to investigate suspected fraud. In other words, the ordinary marketing uses of open tracking all need consent. The pixel isn't outlawed — its identifying, performance-measuring use is what needs permission.
The legal basis: Article 82 of the French Data Protection Act
The CNIL grounds the rule in Article 82 of the French Data Protection Act, France's transposition of ePrivacy Article 5(3) — the same provision behind cookie consent. Under Article 82, reading or writing information on a user's device (which now expressly includes loading an email tracking pixel) requires prior consent unless a narrow exemption applies. The CNIL explicitly ties its reasoning to the EDPB's Guidelines 2/2023, which confirmed that pixel loading is device access under ePrivacy. This is the same legal architecture we explain in the email tracking consent pillar.
When consent is required — and the two exemptions
Under the recommendation, a pixel may be used without consent only where it is strictly necessary to (i) provide or facilitate the email communication itself, or (ii) deliver a service the recipient specifically requested. Everything else — performance measurement, profiling, engagement scoring — needs prior consent.
The same consent logic applies to your website
ConsentPixel's free scanner shows exactly which trackers fire before consent on your site — in about 10 seconds. Prevention-first is the CNIL's expectation on the web, too.
Scan your site free →The 14 July 2026 deadline
The recommendation set two timelines. For contacts collected from 14 April 2026 onward, compliant consent was required immediately — no grace period. For contacts already on your list before that date, the CNIL gave a three-month transition: by 14 July 2026, senders had to inform those existing recipients about pixel tracking and give them a genuine opportunity to object. A single bulk email treating silence as acceptance did not satisfy this — the objection mechanism had to be clear and honored immediately.
The deadline has passed — what now?
As of this writing, the 14 July 2026 transition date has passed, and the CNIL said it would begin checking compliance once it did. If you send tracked email to recipients in France and haven't acted, the priority now is straightforward: switch off non-exempt pixel tracking first, then notify and collect consent properly. Being late but documented is a far better position than continuing to track silently. The "we didn't know" window is closed, but a sender who moves promptly to a compliant footing is in a very different posture from one who ignores the rule entirely.
Don't keep firing identifying pixels at French recipients while you sort it out. The lowest-risk immediate step is the "pixel-off-first" approach — stop non-exempt open tracking now, send pixel-free, and re-enable only for recipients who have given valid consent. Then run your information/objection process and log everything. Late-but-fixed beats on-notice-and-ignoring.
What senders must do
Inventory your tracking
Confirm whether open tracking is on, which pixels fire, and which contacts are French/EU. You can't comply with what you haven't mapped.
Get consent for new contacts
Anyone collected from 14 April 2026 needs a compliant, specific opt-in for tracking at the point of collection — no grace period applies to them.
Handle existing contacts
Inform them and give a real, immediate way to object (the 14 July step). Where you can, move to active opt-in via a re-permission campaign.
Send pixel-free otherwise
For non-consenting recipients, strip the pixel. Log consent and honor objections immediately.
Italy's Garante set a parallel rule with a later deadline and some different nuances — if you also send to Italian recipients, read our Garante pixel rules guide. And for the plain-language "do I actually need consent?" decision path, see do you need consent to track email opens?
Key takeaways
CNIL Délibération n° 2026-042 treats email pixels like cookies. Prior consent required for performance measurement, profiling, and most marketing uses.
The basis is Article 82 — France's transposition of ePrivacy Article 5(3), tied to EDPB Guidelines 2/2023.
The 14 July 2026 deadline has passed. New contacts (from 14 April) needed consent immediately; existing contacts had to be informed and allowed to object by 14 July.
If you're behind, go pixel-off-first. Stop non-exempt tracking, notify, collect consent, log it. Late-but-fixed beats on-notice-and-ignoring.
Prevention-first consent — website and beyond
ConsentPixel — Privacy · Verified blocks trackers before consent and logs every decision. Scan your site free, then start a 14-day trial.
Start 14-day free trial → Scan a site freeNo credit card required · from $8.99/domain/mo
Frequently asked questions
What did the CNIL decide about email tracking pixels?
In Délibération n° 2026-042 (adopted 12 March 2026, published 14 April 2026), France's CNIL decided that an email tracking pixel measuring opens is functionally equivalent to a cookie and generally requires the recipient's prior consent. Consent is needed when the pixel measures campaign performance, profiles a recipient's interests, or investigates fraud. The pixel is exempt from consent only where strictly necessary to provide the email communication or a service the recipient requested. It's a recommendation clarifying existing law, not a new regulation — but it's the standard the CNIL will enforce against.
What was the CNIL's 14 July 2026 deadline?
The CNIL gave a three-month transition for contacts already on a sender's list before the recommendation was published. By 14 July 2026, senders had to inform those existing recipients about pixel tracking and give them a genuine, immediate way to object. Contacts collected from 14 April 2026 onward got no grace period — compliant consent was required from day one. A single bulk email treating silence as acceptance did not satisfy the requirement; the objection mechanism had to be clear and acted on promptly.
The 14 July deadline has passed — what should I do now?
Act promptly rather than continue tracking silently. The lowest-risk immediate step is "pixel-off-first": stop non-exempt open tracking for French recipients now, send pixel-free emails, and re-enable tracking only for recipients who have given valid consent. Then run a proper information-and-objection process (or an active re-permission campaign) and log everything. The CNIL said it would check compliance after 14 July, so late-but-documented is a materially better position than remaining on notice and doing nothing.
Does the CNIL rule apply if my company isn't in France?
Yes, if you send tracked email to recipients located in France — the rule turns on where the recipient is, not where the sender is based. Beyond that, the CNIL's reasoning rests on ePrivacy Article 5(3), which every EU member state has transposed, so the same principle applies across the EU even where other regulators haven't yet published their own dedicated guidance. Italy's Garante issued a parallel rule with a 28 October 2026 deadline. Treat the CNIL recommendation as the leading edge of an EU-wide position.
Is measuring open rates still allowed at all?
Yes, with consent, or in anonymised aggregate form. You can track opens for recipients who have consented, and you send a pixel-free version to those who haven't. The two narrow exemptions — where the pixel is strictly necessary to provide the email communication or a service the recipient requested — cover only a small set of cases, not ordinary marketing analytics. If you want engagement signals without managing pixel consent, many senders switch to aggregate measurement or click-based signals, which carry less risk than identifying open pixels.