Email tracking pixels: the CNIL treats them like cookies

Almost every newsletter contains an invisible image the size of a single pixel. Its loading signals that the message was opened, when, and often from which device. This mechanism, universal in email marketing, has just moved into the prior consent regime. An important deadline passed on July 14, 2026.

A useful clarification: this topic does not directly concern the cookies on your website, and therefore not Consenteer. We cover it because it relies on exactly the same legal mechanism, and because many teams discover the rule after the fact.

What the CNIL decided

On March 12, 2026, the CNIL (the French data protection authority) adopted a recommendation on tracking pixels in electronic mail (deliberation no. 2026-042), published on April 14, 2026.

Its guiding principle: tracking pixels fall under the same framework as cookies, namely Article 82 of the French Data Protection Act (Loi Informatique et Libertés), which transposes the ePrivacy Directive. That text does not talk about "cookies" but about accessing or storing information in a user's terminal, which is what a pixel does by triggering a request to a server. For most uses, the recipient's prior consent is therefore required.

The surprising point: two separate consents

This is the most misunderstood consequence of the recommendation. Consent to receive an email and consent to be tracked in that email are two different things.

A subscriber who signs up for your newsletter has consented to receive it. By that gesture alone, they have not consented to you measuring their opens and clicks. If the purpose of the pixel does not fall under an exemption, a specific and separate consent is required, collected at sign-up with a dedicated checkbox, and not inferred from the first.

This changes the design of sign-up forms, which until now featured a single checkbox.

The exemptions

The final version recognizes an exemption for measuring deliverability tied to a service requested by the recipient. It makes it possible, in particular, to identify recipients who no longer open their messages, in order to remove inactive ones from lists, a practice that benefits sending quality as much as sender reputation.

This exemption is narrow. It does not cover tracking for profiling, engagement scoring, targeted follow-ups or advertising personalization, which remain subject to consent. The general rule applies: it is the purpose that determines the regime, not the technology.

The July 14, 2026 deadline

For addresses collected before the recommendation was published, the CNIL did not require immediate retroactive consent collection. It asked organizations, within three months, to clearly inform recipients about the use of tracking pixels and to let them object easily.

That deadline expired on July 14, 2026. If you have not dealt with it, the delay is real but can be made up: the expected approach remains the same, and starting it in good faith is better than carrying on without changing anything.

What remains to be done

The third point is often a blocker: not all email platforms can yet manage the pixel contact by contact. The main ones have published updates in that direction since spring, and this is the first thing to check with your provider.

One logic, two fields

There is a common thread between this recommendation, the rules on cookies and those on session replay: the CNIL reasons by purpose, not by technology. It does not matter whether we are talking about a cookie, a pixel, local storage or a digital fingerprint. As soon as access to the terminal serves a purpose that is not strictly necessary, consent is required, and you must be able to prove it.

This is good news for anyone who has already structured their compliance on the website side: the reasoning is in place, and all that remains is to apply it to another channel.