Why many companies are now informing users about tracking pixels in emails

Paris – July 15, 2026: Many consumers are currently receiving emails from companies informing them about the use of tracking pixels. The trigger is a recommendation by the French data protection authority CNIL, whose transition period ended on July 14. Companies that had stored email addresses before the publication of the guidelines were expected to clearly inform recipients within three months about the use of such technologies and provide an easy way to object.

Tracking pixels are usually invisible 1×1-pixel images. When a message is opened and the image content is loaded, the sender’s server can recognize that the email has been retrieved. Depending on the technical setup, identifiers, IP addresses, opening times, and information about the device used may be processed.

Companies use this data to monitor message delivery, measure open rates, and adjust content or sending frequency. However, CNIL points out that email inboxes are a particularly private area. The authority also issued the recommendation in response to an increasing number of complaints about this form of tracking.

In CNIL’s view, prior freely given and adequately informed consent is required for many purposes. This applies in particular to open analysis for campaign optimization, advertising personalization, and the creation of interest profiles. Consent should, where possible, be obtained when the email address is collected. It must relate to the specific address concerned and the intended purposes.

Exceptions may be permitted for technically necessary processing. This includes, for example, individually checking whether important messages relating to a requested service can be delivered. CNIL cites account notifications, order confirmations, invoices, security alerts, and password reset information as examples. Even in such cases, the authority recommends ensuring transparency about the use of the technology.

People who do not want tracking should be able to withdraw their decision as easily as they gave consent. CNIL recommends providing an easily accessible link for this purpose in all relevant emails. Failure to respond to an inquiry must not be regarded as consent. Senders must also not use intrusive design to steer recipients toward consent.

In practice, users can also restrict the automatic loading of external images in their email software. This reliably prevents many image-based pixels from functioning. However, this does not replace the sender’s obligations. Under French data protection law, senders must explain the purpose of processing, demonstrate valid consent, and ensure effective means of withdrawal.