Email Open Tracking Consent in France and Italy: What Marketers need to know

Email open tracking has long supported campaign reporting, engagement scoring, personalization, and journey orchestration. Guidance from France’s CNIL and Italy’s Garante now requires businesses to reassess when individual-level email tracking can be used.

The central principle is simple: using an email tracking pixel for marketing analytics, personalization, profiling, or campaign optimization generally requires prior consent unless a limited exemption applies. Permission to send an email does not automatically include permission to track whether an individual opens it.

How email tracking pixels work

An email tracking pixel is a small, usually invisible image embedded in an email. When the recipient opens the message and the image loads, the sender can record the open and use that signal in campaign analytics and engagement workflows.

What changed in France and Italy?

The two regulatory bodies, CNIL and Garante, have clarified that tracking pixels in marketing emails fall under the consent requirements applicable to website cookies, and are now being consistently enforced.

Italy’s Garante adopted its guidelines on April 17, 2026, and they were published in the Official Gazette on April 29. Organizations were given six months from publication to adapt their systems and processing practices.

The policies apply to recipients located in France or Italy, no matter where your company is based. As of 14 July 2026, France’s requirement for compliance is in full effect. Italy has a transitional window running till 28 October 2026.

When is consent generally required?

Consent is generally required when individual open data is used to:

• Measure or improve promotional campaign performance
• Personalize content or sending frequency
• Build engagement scores or audience segments
• Infer recipient interests and preferences
• Trigger journeys based on email opens
• Create profiles for targeting across channels

Recipients should also be able to withdraw tracking consent while continuing to receive emails.

Possible exemptions: Certain narrowly defined uses may qualify for an exemption. Examples include: when tracking is necessary for a user-focused security or authentication process, or limited deliverability measurement. Marketers must assess based on their own use case and purposes for using tracking pixels. This is applicable even in the case of transactional emails. Calling an email “transactional,” or sending it through a transactional API, does not qualify it as exempt. Whether the email relates to a service requested by the user and whether the pixel is used only for an eligible purpose must be assessed separately.

How CleverTap supports consent-aware email tracking

CleverTap enables customers to manage open and click tracking independently for each user.

Dedicated profile-level settings indicate whether the recipient is opted in or opted out of:

• Email open tracking
• Email click tracking

Customers can synchronize these preferences through any of the multiple data pipelines and integration methods supported by CleverTap.

CleverTap evaluates the recipient’s preferences when preparing the email:

• When open tracking is opted out, the email is sent without an open-tracking pixel.
• When click tracking is opted out, links are not rewritten for CleverTap click attribution.
• When both are opted out, the email is still delivered, but CleverTap does not track its opens or clicks.
• Open and click preferences are evaluated independently.

This separates permission to communicate from permission to measure engagement.

What should email teams do?

Organizations should:

• Define a tracking-consent policy: Work with legal and privacy teams to determine which recipients, purposes, and message types require consent.
• Implementation: CleverTap processes the tracking states you provide, but you are responsible for managing privacy notices, collecting valid consent, handling withdrawals, maintaining records, and setting data retention policies.
• Update Unset Preferences: Explicitly update any user profiles lacking a valid consent signal. Profiles with an unset tracking preference will default to CleverTap’s standard tracking behavior.
• Keep consent signals synchronized: Ensure that preferences captured through forms, CRMs, consent-management platforms, CDPs, or data warehouses are passed to the engagement platform.
• Inventory their use of open and click data: Identify where these signals feed analytics, segmentation, personalization, journeys, deliverability, and downstream models.
• Review open-dependent workflows: Journeys and reports will receive fewer open signals when tracking is disabled. Where appropriate, use stronger first-party outcomes such as purchases, app activity, form submissions, and account events.
• Note on Active Emails: Tracking settings apply to newly generated emails going forward. They will not retroactively update or remove trackers from previously delivered messages.

Building more transparent email programs

The new guidance does not eliminate email measurement. It requires businesses to be clearer about what they collect, why they collect it, and whether the recipient has agreed to it.

By separating email delivery from open and click measurement, CleverTap helps customers apply their consent policies without turning off email as a communication channel.

Disclaimer: This article is for general informational purposes and does not constitute legal advice. Organizations should consult their legal counsel or data protection officer to determine how these requirements apply to their recipients and use cases.