Email Click Tracking & Consent: The Part Everyone Forgets
Every guide covers open tracking. Almost none covers clicks. But email click tracking consent is a real question — the link rewriting that records which links you clicked raises its own consent obligations, and it's one most senders have never thought about. Here's what's actually happening when you click a link in an email, and when it needs consent — the overlooked half of email tracking consent.
What this covers
How email click tracking works
When your email platform sends a campaign, it usually doesn't leave your links alone. It rewrites them. A link that reads example.com/product gets silently swapped for something like track.youresp.com/click?id=abc123&url=example.com/product. When the recipient clicks, they first hit the ESP's tracking server — which records who clicked, which link, and when — and are then instantly redirected to the real destination. This is link rewriting (also called link decoration or URL wrapping), and it's how every "click-through rate" in your reports gets measured. The recipient sees a normal link and a normal destination; the tracking redirect in between is invisible.
Link rewriting routes every click through a tracking redirect that logs it, then forwards to the real URL.
Why clicks aren't the same as opens
This is the crux of why click tracking gets its own article. Open tracking works via a pixel — an invisible image that loads without any action from the recipient. That passive loading is what makes it "access to the device" under ePrivacy Article 5(3). Click tracking is different: it's a URL redirect triggered by a deliberate action (the recipient clicking). Because the mechanics differ, the legal analysis isn't automatically identical — and that's precisely why senders can't just assume "I turned off open tracking, so I'm fine." The click side is a separate question that survives disabling the open pixel.
Do the links in your emails need consent?
The honest answer is that it's more nuanced than open tracking, and less settled. The core issue: click tracking still involves URL-based tracking identifiers that tie a click to an individual recipient, and it still processes personal data (who clicked what). Two things pull in different directions. On one hand, the click is a voluntary action by the recipient, which some argue changes the picture versus a passive pixel. On the other hand, the recipient didn't consent to being profiled by their clicks, and the identifiers embedded in the rewritten links are exactly the kind of tracking the ePrivacy framework scrutinizes. The safest reading: identifying click tracking used to build profiles or measure individuals is likely to attract the same consent expectations as open tracking, even if the analysis is less clear-cut.
Your website links get tracked too
The same URL-parameter tracking rides on your website. ConsentPixel's free scanner shows what fires before consent in ~10 seconds.
Scan your site free →Where regulators stand on link tracking
Regulatory attention has focused mostly on the open pixel, but the reasoning reaches links too. The EDPB's Guidelines 2/2023 address the technical scope of ePrivacy Article 5(3) broadly, and the CNIL's own materials on tracking have noted that tracking links fall within the same Article 5(3) framework — the use of a tracking link is subject to the consent rule just as pixels are. The UK's ICO applies PECR to similar tracking technologies. So while clicks are less discussed than opens, the direction of regulatory logic doesn't carve them out — it treats identifying link tracking as part of the same tracking-consent picture. Treating clicks as automatically exempt because they're "just links" is optimistic.
The "voluntary action" argument — and its limit
The strongest point in favor of lighter treatment for clicks is that the recipient chose to click. A voluntary click is not the same as a pixel silently loading on open. That distinction is real and worth understanding. But it has a clear limit: the recipient clicked to reach the destination, not to be tracked and profiled on the way. Consenting to follow a link is not consenting to have that click logged against your identity and fed into a behavioural profile. So the voluntary-action argument may soften the analysis, but it doesn't dissolve the consent question — especially where clicks build individual profiles.
What to do about click tracking
Don't forget it exists
When you disable open tracking, consciously decide about clicks too — don't leave link rewriting on by default and assume you're covered.
Include it in your consent scope
If you seek tracking consent, cover click tracking in what you describe — not just opens — so consent matches reality.
Minimise identifying identifiers
Where possible, avoid per-recipient click identifiers you don't need; aggregate click measurement is lower-risk than individual profiling.
Offer plain links to non-consenters
For recipients who haven't consented, send un-rewritten links alongside pixel-free emails.
For how clicks and opens fit the overall consent architecture, see the ePrivacy two-layer problem, and to disable tracking at the platform level, how to disable email open tracking.
Key takeaways
Click tracking works by link rewriting — your links are swapped for tracking redirects that log each click before forwarding to the real page.
Clicks aren't the same as opens. Opens are a passive pixel; clicks are a URL redirect on a voluntary action — so the analysis differs and survives disabling the open pixel.
Identifying click tracking still raises consent questions. Per-recipient click identifiers and profiling fall within the same ePrivacy scrutiny; regulators haven't carved clicks out.
Don't forget clicks when you handle opens. Include click tracking in your consent scope, minimise identifiers, and offer plain links to non-consenters.
See every tracker — opens, clicks, and web
ConsentPixel — Privacy · Verified blocks trackers before consent and logs every decision. Scan your site free, then start a 14-day trial.
Start 14-day free trial → Scan a site freeNo credit card required · from $8.99/domain/mo
Frequently asked questions
Do links in marketing emails need consent?
It's more nuanced than open tracking, but identifying click tracking likely attracts similar consent expectations. Email platforms rewrite your links so each click routes through a tracking server that logs who clicked what before redirecting to the real page. That involves per-recipient tracking identifiers and processes personal data. While a click is a voluntary action — which some argue softens the analysis versus a passive open pixel — the recipient clicked to reach the destination, not to be profiled. Regulators haven't carved clicks out of the ePrivacy framework, so identifying click tracking used for profiling is best treated as needing consent.
How does email click tracking actually work?
Through link rewriting, also called link decoration or URL wrapping. Before sending, your platform replaces each link in the email with a link to its own tracking server that carries an identifier. When the recipient clicks, they briefly hit the tracking server — which records who clicked, which link, and when — and are instantly redirected to the real destination. The recipient sees a normal link and a normal landing page; the tracking redirect in between is invisible. This is how every click-through rate in your email reports is measured.
If I disable open tracking, is click tracking off too?
Not necessarily — they're separate settings. Open tracking uses an invisible pixel; click tracking uses link rewriting. Turning off the open pixel doesn't stop your platform from rewriting links to track clicks, so click tracking often stays on by default even after you disable opens. This is exactly why click tracking is the part senders forget: they switch off the open pixel, assume they're covered, and leave identifying click tracking running. When you address open tracking, consciously decide about click tracking as a distinct question.
What's the difference between open tracking and click tracking for consent?
Open tracking works via a pixel that loads passively when the email is opened, with no action from the recipient — that passive device access is squarely within ePrivacy Article 5(3), which is why open tracking clearly needs consent. Click tracking works via a URL redirect triggered by the recipient's deliberate click, so the mechanics and analysis differ. The voluntary action gives click tracking a somewhat different footing, but because it still uses identifying tracking identifiers and can build individual profiles, it isn't automatically exempt. Opens are the clearer consent case; clicks are the less-settled but still-real one.
How should I handle click tracking compliantly?
Treat it as part of your tracking-consent scope rather than an afterthought. When you seek consent for tracking, describe click tracking alongside opens so the consent matches what you actually do. Minimise per-recipient click identifiers you don't need — aggregate click measurement is lower-risk than individual profiling. For recipients who haven't consented, consider sending un-rewritten plain links alongside a pixel-free email. And whenever you disable open tracking at the platform level, check the click-tracking setting in the same pass so link rewriting doesn't quietly continue.