Privacy & Cybersecurity Law Blog

On July 22, 2026, the French Data Protection Authority (“CNIL”) published frequently asked questions (“FAQs”) on its recommendation regarding the use of tracking pixels in emails (the “Recommendation”). The Recommendation explains how Article 82 of the French Data Protection Act applies to tracking pixels in emails and aims to help organizations that use tracking pixels in emails to analyze and understand their role and obligations.

Key Takeaways from the Recommendation

The Recommendation was adopted on March 12, 2026, and became applicable once published in the French Official Journal on April 14, 2026.

In the Recommendation, the CNIL clarifies that tracking pixels in emails generally require the recipient’s prior consent unless they fall within a limited exemption, including where they are used exclusively for security measures linked to user authentication or, in certain cases, for deliverability purposes. The CNIL states that consent is required for uses such as measuring and optimizing campaign performance through personalization or frequency adjustment, creating recipient profiles for targeting in other contexts, detecting suspected fraud and deliverability measurement that does not satisfy the conditions of the exemption.

The Recommendation also makes clear that the consent regime for tracking pixels is separate from the rules governing the sending of the email itself. As a result, a tracking pixel may require consent even where the underlying email does not.

In practical terms, the CNIL recommends collecting consent when the relevant email address is collected, with clear information about the purposes of the pixels and the scope of the choice. The CNIL also recommends that refusal be as easy as acceptance and that users be able to withdraw consent at any time, including through a link in the footer of each email. If consent cannot be collected when the email address is collected, the Recommendation contemplates requesting it later through an email that does not itself contain a consent-requiring tracking device.

Key Takeaways from the FAQs

The FAQs provide additional guidance on how the Recommendation applies in practice. Among other points, the CNIL explains that deliverability-only pixels are exempt only if they are limited to what is strictly necessary and, in principle, the only data needed for that purpose is the date of the last opening (unless the sender can document a need for more). The FAQs also state that collecting additional data, such as an Internet Protocol address or user-agent, beyond what is strictly necessary for deliverability prevents reliance on the exemption, even if that data is later anonymized or deleted.

The FAQs further clarify that a single pixel may pursue both exempt and non-exempt purposes, but the non-exempt purposes may be pursued only after valid consent has been obtained. They also emphasize that pixels cannot be placed without a defined purpose and cannot be deployed merely in anticipation of possible future consent.

In addition, the FAQs confirm that the Recommendation applies broadly to the use of trackers in emails regardless of the type of sender or recipient, although whether consent is required depends on the circumstances, including the purposes pursued and the category of email involved. The FAQs also note that for deliverability purposes, whether an email can benefit from the exemption depends in part on whether it was expressly requested by the user or is tied to a requested service.

Timing

The FAQs are particularly notable because they address timing for email addresses collected before the Recommendation was published. For those email addresses, the Recommendation allowed organizations to continue using pixels during a transition period provided they sent clear and accessible information to recipients within a period that should not, in principle, exceed three months from publication and gave recipients the ability to object for future emails. That period expired on July 14, 2026.

The FAQs indicate, however, that a reasonable extension may be possible where the volume of the database or deliverability issues made compliance within that period impracticable, provided those difficulties are objectively justified and documented. The FAQs also state that if the required notice was not sent by July 14, 2026, and no justified extension applies, organizations must apply the Recommendation in full, including obtaining consent where required, or stop using pixels that require consent.

The FAQs further clarify that where users whose email addresses were collected before April 14, 2026, were informed of their right to object in accordance with the Recommendation, organizations may continue to rely on the absence of an objection for later emails, so long as the conditions under which those emails are sent remain unchanged and no new consent is otherwise required.

Review the Recommendation in French and in English and the CNIL’s Press Release here. Read the FAQs.