The rules have changed for tracking email open rates, but we’ve got you covered.
This article is for general informational purposes and isn’t legal advice. As the sender, you remain responsible for your own compliance. We advise you to work with your legal or privacy team to confirm how these requirements apply to your marketing communications.
If you send marketing emails to contacts in France or Italy, the rules on tracking pixels have changed. According to regulators CNIL (in France) and Garante (in Italy), the tracking pixel behind your email open rate now needs its own consent. This tracking consent is separate to the opt-in consent your audience gave to receive emails initially.
We’ve collated information on what each regulator is asking for, go-live timings, and how the Dotdigital platform supports these changes – to help you stay ahead.
TLDR
You can no longer combine email tracking consent with your general marketing consent. You need to provide an easy way for people to opt-out of email tracking, and be able to switch this tracking pixel off for those contacts in France and Italy who choose to opt-out.
So, what’s actually changing…
First, the basics. A tracking pixel is a tiny, invisible image that loads when someone opens your email. It’s how open rates get measured, and it’s been sitting quietly in the background of email marketing for years. The CNIL and the Garante now treat it the same way they treat a cookie: as something that can be used to identify a person, which requires their permission.
Consent to send a marketing email and consent to track if the email has been opened are now two separate considerations that need to be treated differently. Contacts also need an easy way to opt-out of open rate tracking without unsubscribing from your emails altogether.
Both regulators use the same underlying structure, but the go-live dates differ by country. Your contacts fall into one of three groups, with each group requiring a slightly different course of action.
- Existing contacts, collected before the new consent requirements were published. This group falls within a transition period, so tracking can continue for now, but contacts need to be notified of the changes and given a way to opt-out by a set deadline
- Contacts collected during the gap between the new consent requirements being published and the compliance deadline. There is no transition period for this group. You need to provide an affirmative opt-in before you can track the email opens for this segment, with tracking staying off until consent is received
- New contacts, collected after the compliance deadline: consent needs to be captured at sign-up, before any tracked email goes out
Here’s how those three groups map to publication dates in each country.
France: the CNIL’s timeline
The CNIL’s recommendation took effect in stages between April and July 2026, and the last of those dates, 14 July, has already passed. In practice, that now leaves two groups:
- Contacts you notified and gave a chance to opt-out before 14 July 2026, who didn’t object: you can keep tracking their opens
- Everyone else, meaning contacts who weren’t notified before July 14th, contacts you collected after 14 April 2026, or anyone new: turn off open rate tracking for this group until they opt-in
If you haven’t already removed tracking pixels on email open rates, you are now required to take that step for contacts in France (the rule came into force on July 14th 2026).
Italy: the Garante’s timeline
The Garante published its own guidelines (Provvedimento n. 284) in April 2026, with a six-month runway. Contacts within this region are grouped as follows:
- Contacts collected before April 29th 2026: Transition group
You can keep the open rate tracking pixel on for now, but notify them and give them a way to opt-out of tracking (separate from unsubscribing entirely) by 28 October 2026
- Contacts collected from April 29th 2026 and onwards: No transition
This applies immediately, not just after 28 October. Turn off tracking for these contacts until you’ve got their affirmative opt-in
- Contacts collected from October 28th 2026 onward: New sign-ups
Consent needs to be captured at sign-up, before any tracked email is sent
What we’ve changed in Dotdigital
The Dotdigital Marketing platform has been updated to help you meet these new requirements.
- You can now turn on a setting that allows contacts to opt-out of tracking, via a link in your campaigns
- Open rate tracking consent can be updated in bulk for each audience segment, so once you’ve identified your France and/or Italy contacts, you can opt them all out with one action
- Every consent change is logged against the contact, providing a record of what changed and when
This broadly covers off the requirements set by CNIL and the Garante, tracking consent that’s kept separate from marketing consent, and an easy way to manage it. Whether that’s a contact setting their own preference, or a marketing team updating entire segments at once.
However, you will still need to check the compliance of your own marketing programs with your legal and/or privacy teams to check the individual considerations for your organization.
What to do now
- Read our help centre article on managing open tracking consent. It gives step-by-step guidance on activating the new settings, adding the opt-out link, and updating consent in bulk
- Talk to your privacy team about which of your contacts are in scope, and how you will inform your audience of any necessary changes
- Build a segment of the contacts that require permission updates (such as contacts based in France and Italy) and update their open tracking consent in bulk
- Add the open tracking opt-out link to your campaign footers, next to your unsubscribe link
If you have any questions about the new guidance (we know, it’s a tricky one), reach out to us through Live Chat within the platform, or on the Dotdigital website, or talk to your Account Manager. We’re happy to help you work through it.
