TL;DR: Regulators in France and Italy now require prior opt-in consent before you can track email opens for marketing purposes.
If any of your contacts are based in these countries, review your list to identify where your recipients are located, turn off open and click tracking in Transpond's advanced settings for anyone who hasn't consented (or for your whole list if you're unsure), collect tracking consent separately from email consent going forward and check that none of your automations rely on open or click triggers you're no longer collecting.
Your historical data is safe, and metrics like website visits, conversions and replies can fill the reporting gap.
For years, open rates have been one of the first metrics marketers check after sending an email. But recent regulatory updates in France and Italy could significantly affect how you measure the performance of future campaigns.
In 2026, data protection regulators in both countries ruled that the tracking pixel used to measure email opens requires the recipient's prior consent, just like a marketing cookie. If you send email campaigns to recipients in the EU, these rulings may affect how you collect and report open rate data.
Here's what changed, what it means for your reporting, and how to stay compliant in Transpond.
How has email open tracking consent changed?
Every open rate you've ever seen comes from a tracking pixel: a tiny, invisible image embedded in the email. When someone opens the message, their email client loads that image, which reports the open back to the platform along with details like time and device.
France's data protection authority (the CNIL) and Italy's regulator (the Garante) have both concluded that loading an email tracking pixel involves accessing information stored on the recipient's device. This creates the same legal requirement as placing a marketing cookie, meaning prior consent may be required under the EU's ePrivacy rules.
This means if you use open tracking to measure marketing campaigns, build profiles or trigger automations, recipients in France and Italy need to have given clear, informed opt-in consent first.
Importantly, this isn't a new law. Both regulators say the requirement was always there under existing legislation. What's new is that they've now said so explicitly, and attached deadlines.
Key dates
- 14 July 2026: The CNIL's window for informing existing recipients and giving them a chance to object has now passed.
- 28 October 2026: The Garante's six-month compliance deadline.
Do these updates affect you?
You may be wondering if this update affects you.
Put simply, if any of your recipients are based in France or Italy, you’ll need to make changes to ensure your email tracking practices remain compliant. These rules apply based on the recipient’s location, not where your business is based.
So whether you’re sending campaigns from Melbourne, Manchester, or anywhere else in the world, the same requirement applies: if you’re emailing recipients in countries such as France or Italy, you may need to take action.
Though no other EU country has published equivalent guidance, of yet, both rulings rest on EU-wide privacy principles, so the safest assumption is that the rest of Europe will likely follow suit, and this won’t be exclusive to Italy and France.
What needs consent, and what doesn't
The new regulations don’t apply to all types of tracking. Here’s what needs consent, and what doesn’t.
Needs prior consent:
- Open tracking used to measure campaign performance
- Open data used for profiling or lead scoring
- Opens used to trigger automations, like resending to people who didn't open
Doesn't need consent (within limits):
- Open tracking used purely for list hygiene, like suppressing inactive contacts or adjusting how often you send
- Fraud detection and authentication signals
- Genuinely aggregated, anonymized statistics where no individual can be identified (Italy is more explicit on this than France)
The list hygiene exemption only applies in certain circumstances. If the same tracking data is used for reporting, analytics, or automated workflows, it falls back within the scope of the consent requirement.
One more thing worth knowing: consent to receive your emails and consent to be tracked are two separate things. Someone opting into your newsletter hasn't opted into open tracking. You need both, collected clearly and separately.
What this means for your reporting
The honest answer: open rates were already becoming less reliable. Apple's Mail Privacy Protection has been inflating them since 2021 by pre-loading images whether or not anyone reads the email.
What about clicks? Well, that's currently a gray area. The rulings focus on tracking pixels, but click tracking identifies individual recipients too, just through a different mechanism. Regulators haven't settled the question yet, so the safest approach is to treat opens and clicks the same way: cover both in a single consent option, and where you're unsure, turn off both.
That might sound like a lot to lose. It's less than you think. Some of the most useful engagement signals don't rely on individual email tracking at all:
- Website visits: Add UTM parameters to your campaign links and your website analytics can show you which campaigns are driving traffic. Transpond's Site Tracking can also show you when people arrive on your site from a campaign.
- Conversions: The action your campaign was built for, whether that's a purchase, a booking or a signup.
- Replies: A real person choosing to write back is one of the strongest signals an email can earn. Transpond's Reply Tracking can help you measure these, and plenty of marketers now see replies as the engagement metric that matters most.
- Unsubscribes: Nobody enjoys them, but they're honest feedback on whether your content is landing.
How to stay compliant in Transpond
If you think all your hard work has gone to waste and you’ll need to rebuild your email marketing from scratch, don’t worry, because that’s not the case.
Staying compliant comes down to understanding where your contacts are located, collecting consent where it’s required, and adjusting a few settings in Transpond.
Here’s how to work through the process, step by step.
1. Review where your contacts are
Start by checking what you already know. If your signup forms collect a country or address field, you can use that data to identify your French and Italian contacts and group them accordingly.
However, if your location data isn’t great (or you haven’t collected it, at all), you can’t afford to guess. Instead, applying the safer setting across your entire list isn’t only safer, but for many businesses, this will be the simpler option. If you attempt to segment unreliable data, you’re running the risk of tracking the people you shouldn’t.
From now on, add a country field to your sign up forms so you know where new contacts are from and relevant measures can be taken to stay compliant. If you’re already planning to contact your list about the updates, it’s also worthwhile asking them to confirm their country as part of your comms, so you’re safe in the knowledge that your existing data is up-to-date.
2. Adjust your tracking settings
In Transpond, you can control tracking on every email you send. When you’re setting up a new email, open the advanced settings below where you select your recipients; you’ll find checkboxes there that let you turn off tracking for that send.
If you’ve segmented your list by country, untick these for any emails going to recipients in France or Italy. If your list isn’t segmented and you’re not sure where your contacts are based, it’s sensible to untick them for the whole send.
3. Collect tracking consent going forward
When you ask for tracking consent, use a single option that covers both opens and clicks. It keeps things simple for your contacts, and it means you won't need to go back and ask again if regulators later confirm that click tracking falls under the same rules.
To make consent easier to collect and manage, new tools are coming to Transpond soon:
- A consent box for your forms: collect tracking consent at the point someone joins your list, which is exactly where regulators recommend it happens
- Consent options on every contact: manage each person's tracking status directly within Transpond
- Self-service consent: contacts can change their own preferences at any time through the update your profile link at the bottom of every email
We'll share more as these tools are released.
4. Check your automations
Some automation triggers in Transpond are based on opens and clicks. If you're no longer collecting that data from part or all of your audience, any automation relying on those triggers won't behave the way it used to. A contact who opened your email but isn't being tracked simply won't trigger the next step.
So take a look at your active automations and check what's triggering each one. If a sequence depends on open or click data you're no longer collecting, ask yourself whether there's a better trigger for the job. Triggers based on actions your contacts take directly, like joining a list, filling in a form or making a purchase, don't rely on tracking data and can make your sequences more reliable anyway.
5. Keep an eye on your engagement data
You’ll be pleased to know that historical data appears to be safe to use. These changes affect what you can collect moving forward, not what you’ve already gathered. The important thing to take note of is that Transpond can’t continue tracking new opens and clicks for contacts who haven’t opted in.
Therefore, you may see a slight dip in your reported open and click rates when you turn off tracking for parts of your audience. This doesn’t necessarily mean your emails are performing worse, rather, you’re measuring engagement across a smaller number of people, so it’s inevitable that the number is going to decline. Bear this in mind when you’re comparing the campaign performance before and after the change, and use the tracking metrics we suggested earlier (website visits, conversions and replies), to build a fuller understanding of what’s working and what isn’t.
The bottom line
This change sounds bigger than it is. Nobody’s banning email marketing, and nobody’s banning the use of analytics. What regulators are saying is that silently tracking whether a specific person opened your email now needs their permission, at least in France and Italy.
For most small businesses, the fix is manageable: know where your audience is, get consent where you need it and lean on the metrics that are always more meaningful than opens anyway.
If you're a Transpond customer and unsure how this applies to your setup, contact our support team for more help on how to review your tracking settings.
This article is for general information and isn't legal advice. If you're unsure how these rules apply to your business, please speak to a legal professional.
