France’s data protection authority (CNIL) and Italy’s (Garante) have both issued new rules on the use of tracking pixels in emails.
The focus is on individual-level tracking, for example, recording whether a specific person opened or clicked an email and using that information to profile them, tailor future campaigns or optimise marketing activity.
Both authorities now treat this kind of individual tracking like cookie tracking. In practice, this means you’ll generally need separate, explicit consent before using tracking pixels for marketing purposes.
KEY DATES AT A GLANCE
France (CNIL)
- 14 April 2026: New guidance takes effect. From this date, new contacts must give consent before individual email tracking is used.
- 14 July 2026: Existing contacts must have been informed about tracking and given a clear opportunity to opt out. After this date, individual tracking without valid consent is no longer compliant.
Italy (Garante)
- 29 April 2026: New rules published. From this date, new contacts require prior consent for individual tracking.
- 28 October 2026: End of the six-month transition period for existing contacts. After this, individual tracking without valid consent is not compliant.
LegalEdge’s Data Protection Consultant, Jo Brianti, gives her take on what this means in reality and what needs to be on your radar.
WHAT COUNTS AS ‘INDIVIDUAL-LEVEL TRACKING’?
The rules apply where tracking pixels are used to:
- Identify a specific recipient (for example, using a unique pixel linked to an email address).
- Monitor opens or clicks for that individual.
- Build profiles, segment audiences or personalise future marketing based on that behaviour.
WHEN IS CONSENT NOT USUALLY NEEDED?
Limited tracking may still be permitted where it is strictly necessary, such as for:
- Email deliverability and authentication.
- Spam or fraud prevention.
- Password reset or account activation emails.
It should also be carried out in a minimal, non-profiling way, using anonymised or aggregated data wherever possible.
WHAT YOU NEED TO DO
Introduce separate consent for tracking
Don’t bundle tracking consent with marketing consent.
Instead, add a clear, standalone option allowing people to agree to email open and click tracking through your sign-up forms and preference centre.
Update privacy notices
Your privacy information should explain:
- what tracking pixels you use;
- why you use them;
- that consent is the legal basis (where applicable);
- how long you keep the data; and
- how people can withdraw consent or request deletion.
Check your email platform
Make sure your email service provider can:
- switch off individual tracking by default for French and Italian contacts; and
- only enable it where valid consent has been recorded.
Many providers have already introduced controls to support these requirements.
Review your existing contacts
For existing French and Italian subscribers, you’ll need to communicate the changes and give people a straightforward way to opt out before the relevant deadline.
If valid consent isn’t in place by the deadline, individual tracking should be disabled.
IMPACT ON UK BUSINESSES
These rules don’t just affect organisations based in France or Italy.
If you’re a UK business sending marketing emails to individuals located in either country, the requirements still apply.
That means you should:
- identify French and Italian contacts within your database;
- collect and record the appropriate consent;
- update your privacy information; and
- switch off individual tracking where consent hasn’t been obtained.
If you think this affects your business, Jo and our data protection team are here to help and are happy to speak to your marketing team. To discuss any of the above or how we can help get in touch on info@legaledge.co.uk.
