EU email open tracking consent is changing: what it means for your email marketing
TL;DR: Regulators in France and Italy now require prior opt-in consent before you can track email opens for marketing purposes.
If any of your contacts are based in these countries, review your list to identify where your recipients are located, turn off open and click tracking in your email platform for anyone who hasn't consented (or for your whole list if you're unsure), collect tracking consent separately from email consent going forward and check that none of your automations rely on open or click triggers you're no longer collecting.
Your historical data is safe, and metrics like website visits, conversions and replies can fill the reporting gap.
For years, open rates have been one of the first metrics marketers check after sending an email. But recent regulatory updates in France and Italy could significantly affect how you measure the performance of future campaigns.
In 2026, data protection regulators in both countries ruled that the tracking pixel used to measure email opens requires the recipient's prior consent, just like a marketing cookie. If you send email campaigns to recipients in the EU, these rulings may affect how you collect and report open rate data.
Here's what changed, what it means for your reporting and how to stay compliant.
How has email open tracking consent changed?
Every open rate you've ever seen comes from a tracking pixel: a tiny, invisible image embedded in the email. When someone opens the message, their email client loads that image, which reports the open back to the platform along with details like time and device.
France's data protection authority (the CNIL) and Italy's regulator (the Garante) have both concluded that loading an email tracking pixel involves accessing information stored on the recipient's device. This creates the same legal requirement as placing a marketing cookie, meaning prior consent may be required under the EU's ePrivacy rules.
This means if you use open tracking to measure marketing campaigns, build profiles or trigger automations, recipients in France and Italy need to have given clear, informed opt-in consent first.
Importantly, this isn't a new law. Both regulators say the requirement was always there under existing legislation. What's new is that they've now said so explicitly, and attached deadlines.
Key dates
- 14 July 2026: The CNIL's window for informing existing recipients and giving them a chance to object has now passed.
- 28 October 2026: The Garante's six-month compliance deadline.
Do these updates affect you?
You may be wondering if this update affects you.
Put simply, if any of your recipients are based in France or Italy, you'll need to make changes to ensure your email tracking practices remain compliant. These rules apply based on the recipient's location, not where your business is based.
So whether you're sending campaigns from Melbourne, Manchester, or anywhere else in the world, the same requirement applies: if you're emailing recipients in countries such as France or Italy, you may need to take action.
Though no other EU country has published equivalent guidance, of yet, both rulings rest on EU-wide privacy principles, so the safest assumption is that the rest of Europe will likely follow suit, and this won't be exclusive to Italy and France.
What needs consent, and what doesn't
The new regulations don't apply to all types of tracking. Here's what needs consent, and what doesn't.
Needs prior consent:
- Open tracking used to measure campaign performance
- Open data used for profiling or lead scoring
- Opens used to trigger automations, like resending to people who didn't open
Doesn't need consent (within limits):
- Open tracking used purely for list hygiene, like suppressing inactive contacts or adjusting how often you send
- Fraud detection and authentication signals
- Genuinely aggregated, anonymized statistics where no individual can be identified (Italy is more explicit on this than France)
The list hygiene exemption only applies in certain circumstances. If the same tracking data is used for reporting, analytics, or automated workflows, it falls back within the scope of the consent requirement.
One more thing worth knowing: consent to receive your emails and consent to be tracked are two separate things. Someone opting into your newsletter hasn't opted into open tracking. You need both, collected clearly and separately.
What this means for your reporting
The honest answer: open rates were already becoming less reliable. Apple's Mail Privacy Protection has been inflating them since 2021 by pre-loading images whether or not anyone reads the email.
What about clicks? Well, that's currently a gray area. The rulings focus on tracking pixels, but click tracking identifies individual recipients too, just through a different mechanism. Regulators haven't settled the question yet, so the safest approach is to treat opens and clicks the same way: cover both in a single consent option, and where you're unsure, turn off both.
That might sound like a lot to lose. It's less than you think. Some of the most useful engagement signals don't rely on individual email tracking at all:
- Website visits: Add UTM parameters to your campaign links and your website analytics can show you which campaigns are driving traffic.
- Conversions: The action your campaign was built for, whether that's a purchase, a booking or a signup.
- Replies: A real person choosing to write back is one of the strongest signals an email can earn, and plenty of marketers now see replies as the engagement metric that matters most.
- Unsubscribes: Nobody enjoys them, but they're honest feedback on whether your content is landing.
The bottom line
This change sounds bigger than it is. Nobody's banning email marketing, and nobody's banning the use of analytics. What regulators are saying is that silently tracking whether a specific person opened your email now needs their permission, at least in France and Italy.
For most small businesses, the fix is manageable: know where your audience is, get consent where you need it and lean on the metrics that are always more meaningful than opens anyway.
If you're using Transpond, the marketing platform that integrates with Capsule, we've published a step-by-step guide to staying compliant, from reviewing where your contacts are based to adjusting tracking settings, collecting consent and checking your automations.
Read the article here to learn how to use Transpond in a way that complies with the new regulations.
This article is for general information and isn't legal advice. If you're unsure how these rules apply to your business, please speak to a legal professional.
