CookieGate
Start free trial

CNIL brings email tracking pixels under the cookie rule

4 min read By Comply Ark

Regulation: GDPR

In this post

What the CNIL decided

France’s data protection authority now expects marketing email pixels to be handled like any other tracker: prior consent for most uses. The CNIL adopted a recommendation on tracking pixels in email by Délibération n° 2026-042 of 12 March 2026, published in the Journal officiel and on cnil.fr on 14 April 2026.

The recommendation applies Article 82 of the loi Informatique et Libertés, the French transposition of Article 5(3) of the ePrivacy Directive. That is the same provision that already governs cookies and similar trackers on websites. A 1x1 image in a newsletter that reports back when, and on what device, a message was opened is reading from and writing to the recipient’s terminal, so it needs the same free, specific, informed and unambiguous consent a non-essential cookie needs.

The legal rule is not new. The EDPB’s Guidelines 2/2023 on the technical scope of Article 5(3), adopted in final form on 7 October 2024, already list URL and pixel tracking among the techniques the provision covers. What the CNIL has added is dedicated, email-specific guidance with dates attached.

The two exemptions

Consent is not required in two narrow cases, and the CNIL’s FAQ makes both conditional on the nature of the email: it must be one the recipient explicitly asked for, or tied to a service they requested.

Deliverability. A pixel may measure, per recipient, whether an address is still engaging, so the sender can reduce frequency or stop sending to inactive recipients. The data collected is limited in principle to the date of last opening, and it may be used only for that purpose.

Security. A pixel may be used to secure an authentication mechanism, for example in login or password-reset emails. The FAQ is explicit that this does not extend to anti-fraud measures in general, such as bot detection.

Engagement scoring, campaign analytics and personalisation based on opens fall outside both exemptions and need consent.

The transition has ended

For addresses collected before publication, the CNIL gave senders three months, to 14 July 2026, to tell existing recipients clearly that pixels are used and to let them object easily, rather than re-collecting consent for every address. The FAQ, published on 22 July 2026, adds that this period may be extended reasonably where the difficulty is objectively justified and documented. A sender that let the period run out without informing existing recipients must stop using pixels that require consent.

The CNIL has said it will check compliance through its future inspections. As of publication, we have not found a sanction that cites the recommendation. The CNIL’s recent cookie record suggests it will not stay theoretical: on 1 September 2025 it fined Google €325 million and SHEIN €150 million over cookies, and in November 2025 it fined American Express Carte France €1.5 million for placing trackers without consent and ignoring refusals.

What to check

If you send email with open-tracking to recipients in France, three questions are worth answering in writing.

First, is open-tracking consent collected as its own purpose, or folded into a general marketing opt-in? The second does not meet the specificity requirement.

Second, where you rely on an exemption, does the pixel meet both conditions: the permitted purpose and an email the recipient asked for? A deliverability pixel that also feeds engagement dashboards is no longer a deliverability pixel.

Third, for your pre-April 2026 database, can you show that recipients were informed and offered an opt-out by 14 July 2026, or a documented reason for any extension?

The underlying rule was never about cookies as such. Article 5(3) governs access to and storage on the user’s device, and pixels, fingerprinting and local storage sit under it alongside cookies.

Sources

enforcementemail-trackingconsentcookies

Comply Ark Regulatory infrastructure company. Builds CookieGate.

If this applies to your site.

CookieGate holds non-essential tags until the visitor decides, resolves the right law by location, and prints a receipt per decision.

Start free trial

15 days. Card required. Nothing is charged before day 15.

How CookieGate handles the GDPR