Why many companies are now providing information about tracking pixels in emails

Paris – 15/07/2026: Many consumers are currently receiving emails from companies informing them about the use of tracking pixels. The reason is a recommendation by the French data protection authority CNIL, whose transitional period ended on 14 July. Companies that had already stored email addresses before the publication of the guidelines were required to inform recipients, within three months and in a comprehensible manner, about the use of this technology and allow for a simple objection.

A tracking pixel is generally an invisible image measuring one pixel by one pixel. When a message is opened and its graphic content is loaded, the sender’s server can detect that the email has been viewed. Depending on the technical configuration, an identifier, IP address, opening time and information about the device used may be processed, among other data.

Companies use this data, for example, to monitor the delivery of their messages, measure open rates or adapt content and sending frequencies. However, the CNIL emphasizes that the email inbox is a particularly personal space. The authority also responded with its recommendation to an increasing number of complaints concerning this form of tracking.

According to the CNIL, prior, freely given and informed consent is required for many purposes. This applies in particular to analysing opens to optimise campaigns, personalising advertising or creating interest profiles. Consent should be collected, where possible, when the email address is obtained. It must relate to the specific address and the intended purposes.

Exceptions may be provided for technically necessary operations. This includes, for example, individually verifying that important messages from a requested service can be delivered. The CNIL cites account notifications, order confirmations, invoices, security alerts or password reset instructions as examples. Even in these cases, the authority recommends transparency about the use of the technology.

Anyone who does not want tracking should be able to withdraw their decision as easily as they gave it. For this purpose, the CNIL recommends an easily accessible link in every affected email. Mere failure to respond to a request cannot be considered consent. In addition, senders should not pressure recipients into consenting through insistent design.

In practice, users can also restrict the automatic loading of external images in their email program. This means that many image-based pixels no longer function reliably. However, this does not replace senders’ obligations: under French data protection law, they must explain the purpose of processing, demonstrate the validity of consent and ensure effective withdrawal.