If you send marketing emails to contacts in France or Italy, there’s something you need to act on.
Privacy regulators in both countries have published guidance about how email open tracking must be handled. It’s not new legislation, but it does have real implications for how you run your campaigns.
Here’s what’s happening, who it affects and what to do about it.
What has changed and why it matters
France’s data protection authority, the CNIL, and Italy’s equivalent, the Garante, have both clarified that email tracking pixels must be treated in the same way as cookies under the ePrivacy Directive.
That matters because tracking pixels do more than simply record whether an email was opened. They can capture the date and time of an open, IP address, device and browser information, approximate location and whether the email was opened more than once.
Regulators now say that collecting this data requires specific consent, separate from the consent someone gives to receive your marketing emails.
In other words, “I agree to receive marketing emails” is no longer enough. Consent must explicitly cover email engagement monitoring, and it must be freely given, specific, informed and unambiguous.
The key dates to be aware of are:
- France (CNIL): April 14, 2026 for new recipients; July 14, 2026 transition deadline
- Italy (Garante): April 29, 2026 guidance published; October 28, 2026 transition deadline
Who is affected
This applies to any organisation sending emails to recipients based in France or Italy, regardless of where you are based, which platform you use or whether you send the emails yourself or through an agency.
It covers both marketing emails and one-to-one sales emails. If your CRM or email platform is tracking opens for contacts in these countries, this guidance applies to you.
What you need to review
Start by auditing how you currently use open tracking data. The areas to look at include:
- Open tracking and open-rate reporting
- Lead scoring models that use open data
- Automated workflows triggered by email opens
- Resend-to-non-openers functionality
- Smart lists or segments built on open behaviour
- Sales notifications triggered by opens
- Send-time optimisation tools
It’s also worth reviewing your click tracking setup. Regulators treat tracked link redirects in the same way as open pixels, so removing the open pixel while keeping tracked links may not be sufficient for contacts who haven’t given the right consent.
What to do next
There are a few practical steps worth taking now:
- Review your consent wording. Check whether your sign-up forms and preference centres explicitly mention email engagement tracking. If they don’t, they may need updating.
- Check your privacy notice. It should clearly explain what open and click tracking data is collected, how it’s used and whether it feeds into profiling or automation.
- Speak to your legal or data protection team. This is a privacy compliance matter. The right approach for your organisation depends on your specific setup, audience and legal position.
- Audit your platform. Identify which features rely on open data and assess what changes are needed once your compliance approach is agreed.
- Rethink your reporting metrics. If you do need to disable tracking for some contacts, shift your focus to clicks, website visits, form submissions, enquiries and pipeline rather than open rates.
Ultimately, this is a legal and privacy compliance matter. If you send emails to recipients in France or Italy, your next step should be to speak to your legal or data protection team. They can advise on how the guidance applies to your organisation and whether any changes are needed to your consent, tracking or reporting practices.
Not sure where to start?
We’ve put together a handy checklist to help you work through the key steps, from auditing your platform to reviewing your consent wording. Download it here to help keep your team on track.
FAQs
Yes. The guidance applies based on where your recipients are located, not where you are. If you’re sending emails to contacts in France or Italy, this is relevant to you regardless of where your business is headquartered or which platform you use.
Absolutely. This guidance doesn’t stop you from sending marketing emails. It’s about how you track engagement with those emails and whether you have the right consent in place to collect and use that tracking data.
Open tracking uses a tiny invisible pixel embedded in the email to record when someone opens it. Click tracking works by routing links through a redirect so each click can be logged. Regulators in France and Italy treat both in the same way, so you need to consider both, not just one or the other.
That depends on what your existing consent wording covers and the advice you receive from your legal or data protection team. If your current sign-up process didn’t explicitly mention email engagement tracking, your consent may need updating. This is a question for your legal team.
Click-through rates, website visits, form submissions, enquiries, conversions and pipeline activity all give you a clearer picture of genuine engagement. These metrics are more reliable anyway, since open rates have become increasingly unreliable due to email client pre-loading and privacy features.
Most email platforms track opens by default. Check your platform settings or ask your account manager. If you’re using HubSpot, Campaign Monitor, Zymplify or similar tools, open tracking is almost certainly active unless you’ve specifically turned it off.
Not exactly. GDPR governs how personal data is collected and processed. This guidance comes from the ePrivacy Directive, which covers accessing information stored on a device, including the kind of data that tracking pixels collect. The two frameworks overlap, but this is a separate compliance consideration that sits alongside your existing GDPR obligations.
