Is Email Open Tracking Legal? What the Law Actually Says in 2026

The short answer

Is email open tracking legal? Yes — the technology itself is legal everywhere. But whether a specific use is lawful depends on jurisdiction and, increasingly, on consent. In the EU as of 2026, tracking that identifies an individual recipient generally requires their prior consent; doing it without consent is what crosses the line. In the US, there's no direct federal equivalent yet, though state privacy laws are moving in the same direction. So the honest answer isn't "yes" or "no" — it's "legal if you have consent where consent is required."

Is email open tracking legal in the EU?

In the EU, open tracking is lawful only with a valid legal basis — and in 2026 regulators clarified that the basis must be consent. The reason is ePrivacy Article 5(3), the same rule behind cookie consent: it requires prior consent before accessing information on a person's device. The European Data Protection Board confirmed in its Guidelines 2/2023 that loading a tracking pixel counts as that kind of device access. So an open-tracking pixel that identifies a recipient sits under the same consent requirement as a cookie.

Many senders assume they can rely on "legitimate interest" instead of consent. Under the ePrivacy layer, they generally can't — consent is the required basis for device access, and legitimate interest doesn't substitute for it. That misunderstanding is common enough that we dedicated a whole piece to it: the legitimate interest myth.

France and Italy: the 2026 rulings that set the standard

Two regulators turned the general EU principle into concrete, dated requirements in 2026:

These are the clearest statements of the law's direction, and because EU authorities cite one another, they signal where the rest of the bloc is heading. For the country-specific detail, see our guides to CNIL's rules and the Garante's rules.

The UK position

The UK mirrors the EU approach through UK GDPR and PECR (the Privacy and Electronic Communications Regulations), which implement the same ePrivacy Article 5(3) device-access rule. The ICO's guidance treats tracking technologies that access a user's device as requiring consent on the same basis. So the UK answer tracks the EU answer closely: open tracking that identifies a recipient generally needs consent.

The US position

The US is more permissive — for now. There's no federal law that directly requires consent for email open tracking the way ePrivacy does in the EU. CAN-SPAM governs commercial email but focuses on deception, sender identification, and unsubscribe mechanics, not tracking pixels. However, the direction of travel is unmistakable: state comprehensive privacy laws are expanding, and the same "tracking without consent" theories driving website litigation (including California's wiretapping-based CIPA claims) show how quickly a permissive gap can close. US senders emailing EU recipients are, of course, bound by the EU rules for those recipients.

So when is tracking email opens illegal?

Pulling it together — tracking email opens becomes unlawful when:

For the practical "what do I actually do" version of this — the yes/no/it-depends decision path — see our companion piece, do you need consent to track email opens?. This article covers what the law says; that one covers what to do about it.

Where enforcement actually stands

Enforcement is early but real. France's CNIL committed to checking compliance once its 14 July 2026 transition period ended, and the Garante's window runs to 28 October 2026. Neither regulator invented new law — they clarified existing rules and set dates, which removes the "we didn't know" defense going forward. Both authorities have strong track records on cookie enforcement (the CNIL has issued nine-figure cookie fines), and the same machinery applies here. The realistic read for 2026: the risk is no longer hypothetical, but the immediate priority is getting compliant, not bracing for an overnight wave of fines.

Frequently asked questions