Corporate newsletters, press releases, media alerts, event invitations...
Communication teams regularly use email to distribute their content and measure audience interest.
On 14 April 2026, the CNIL published a recommendation on the use of tracking pixels in emails. This is not a new law. The document clarifies how existing rules should be applied.
This recommendation falls within the framework of the General Data Protection Regulation (GDPR), which has applied since 25 May 2018. It also complements French regulations relating to tracking technologies.
For organisations, the key issue is to understand when recipients' consent may be required and to adapt their practices accordingly.
What is a tracking pixel in an email?
A tracking pixel is an invisible image embedded in an email. When it loads as the message is opened, it may transmit certain information, such as the opening date or technical data relating to the recipient.
This technology can be used to measure open rates, analyse engagement, personalise communications, identify inactive contacts or improve email deliverability.
Because they make it possible to collect information about a recipient's behaviour, tracking pixels fall within the scope of personal data protection and tracking technology rules.
What does the CNIL recommendation published in April 2026 clarify?
The recommendation aims to give recipients greater information and control over how their data is used.
Prior consent may be required when tracking pixels are used to:
- analyse individual email opens;
- measure or optimise campaign performance;
- personalise content or sending frequency;
- identify a contact's preferences or create a profile of them.
It is therefore essential to distinguish between consent to receive a communication and consent to individual tracking.
A contact may agree to receive a newsletter, press release or invitation without agreeing to have their email opens analysed.
Can tracking pixels be used without consent?
Certain limited uses may qualify for an exemption. This is particularly the case when tracking is used solely to manage email deliverability.
It may then be used to identify contacts who have become inactive, adjust sending frequency or clean a mailing list.
In this case, the information collected must be limited to what is strictly necessary. It must not be reused to personalise communications, profile recipients or analyse their individual behaviour.
What are the implications for communication teams?
The CNIL recommendation may apply to corporate newsletters, press releases, media alerts, event invitations and campaigns sent to journalists or influencers.
Communication teams should therefore review why email-opening data is collected and how it is used.
They may need to review their forms and privacy notices, verify existing consent, allow recipients to manage their preferences and limit data retention periods.
This development may also provide an opportunity to complement open rates with more meaningful indicators, such as clicks, downloads, event registrations or replies received.
What epresspack users need to know
The CNIL's recommendations do not mean that all tracking pixels must be removed.
Above all, they encourage organisations to define their purposes more clearly, limit collection to data that is genuinely necessary and obtain valid consent where required.
epresspack clients can contact their usual representative to review their campaigns, contact databases and email tool settings.
This article is provided for information purposes only and does not constitute legal advice. Each organisation should consult its DPO or legal adviser to assess the obligations applicable to its particular circumstances.
