In France, tracking email opens needs its own consent
Consent to receive your email is not consent to be measured. If you drop an open-tracking pixel for a French recipient in order to optimise campaigns, you need separate, specific permission for that. If they never gave it, you are expected to send the same email without the pixel.
Who this applies to
Anyone emailing recipients in France, wherever the company sits. The obligation attaches to the recipient's terminal equipment, not to your registered office, so using an American ESP changes nothing.
What to do
- Ask for tracking consent separately from email consent, ideally in the signup form at the moment you capture the address.
- Make refusal one click, and honour it by sending the same email with no pixel, not by unsubscribing them.
- Treat silence as refusal. A recipient who never answered has not consented.
- Never put a consent-requiring pixel in the email that asks for consent. Mail clients pre-fetch images and will answer on the recipient's behalf.
What is exempt
One narrow carve-out for list hygiene: you may measure opens strictly to stop emailing inactive recipients. If you rely on it you may store only the date, day with no time, of the last known open, overwritten each time. Security and authentication flows are also exempt. Everything else, including optimising send frequency, needs consent.
What happens if you do not
No regulator has yet fined anyone specifically for an email tracking pixel. The obligation is real and the deadline has passed, and CNIL announced audits, but the enforcement record is currently empty. Treat this as a gap to close and evidence, not as an imminent fine. Note separately that the same discipline tracks with deliverability: Validity's 2025 benchmark found markets requiring double opt-in show inbox placement about six percentage points higher than the US.
Sources
Related
History of this page
- Transition period ended. Status moved from Upcoming to In force.
- Added after CNIL published the recommendation.