France’s CNIL Rules Push Marketers to Use Opens Even Less

New privacy rules in Europe are placing fresh limits on the use of tracking pixel data, which has already seen its usefulness decline dramatically in the wake of Apple’s Mail Privacy Protection. In the latest move, the French data protection authority CNIL has published its final recommendations on the use of email tracking pixels, which extends the consent requirements of the ePrivacy Directive of 2003 to also cover pixels in emails.

Going into effect in mid-July 2026, the rules require senders to get explicit permission from subscribers in France for some tracking pixel use cases. The same rules will apply to subscribers in Italy in October.

In general, it’s not the collection of open data that runs afoul of these rules, but rather the use of tracking pixel-derived information for particular uses without permission from the subscriber.

Track Pixel Use Cases that Require Permission

Brands need to collect separate and explicit permission to use tracking pixel data to:

• Optimize email performance. This includes using open times for send time optimization, using device information to optimize email content, and using open activity to make channel-selection decisions when a customer is opted into multiple channels.
• Augment customer profiles. This includes using open behavior as a signal of interest in the content of the email, such as using opens to trigger the next email in a series, sending segmented campaigns to openers or non-openers of a previous campaign, or using the opening of an email to change a customer’s interests in their profile.
• Detect fraud against the sender. This includes using open data to detect ad fraud and to detect subscribers using automated means to submit a massive number of entries to a competition, for instance.

Track Pixel Use Cases that Don’t Require Permission

CNIL also exempts a number of tracking pixel uses. For example, this data can be used to:

• Calculate aggregated open rates. Open rate tracking is permitted without permission only when the personal data has been previously anonymized.
• Manage deliverability. CNIL recognizes that opens have a long history of being central to managing engagement rates and inactivity for the strict purpose of managing a sender’s deliverability, such as suppressing inactive subscribers or adjusting frequency for disengaged subscribers. For this use, senders can store only the date of the last open and cannot store open times or a history of open behaviors.
• Authenticate user identity. For instance, opens can be used to confirm that an email containing a code used in the authentication process is indeed open on a terminal known to belong to the intended user.
• Prove legal compliance. Keeping track of open is permitted to demonstrate legal compliance, such as when a brand needs confirmation that a customer received and read a legally required notification.
• Determine contact method. Evaluate and adapt the communication channel to choose alternative contact methods, where appropriate.

For the sake of transparency, CNIL advises senders to update their privacy policies to include information about their uses of tracking pixels that do not require consent.

Securing Tracking Pixel Consent

Ideally at the point of email opt in, subscribers in France must separately consent to each desired purpose for pixel tracking via a positive action. For instance, if a sender wants to use pixel tracking to optimize email performance and detect fraud against the sender, they will need to have a brief and transparent description of both of those uses with an unchecked checkbox for opt in for each. Just like proof of email consent must be captured and retained, proof of tracking pixel consent must be similarly saved.

Brands will also need to provide an easy way for subscribers to withdraw permission for those uses, should they change their mind in the future. They should do this by linking a tracking link in the footer of each email that directs them to a webpage that allows them to withdraw their consent without any additional action. In particular, it shouldn’t require the subscriber to re-enter their email address.

For existing subscribers who signed up prior to April 14 2026 brands must notify them of their tracking pixel use before July 14 and provide them with the ability to opt out of the use of email pixels. After July 14, for any subscriber who has not been notified and given an opportunity to opt out, brands will have to collect their tracking pixel consent on an opt-in basis in order to collect and use this data.

For existing subscribers who signed up between April 14 2026 and when a brand’s new opt-in process for pixel consent goes live, brands must collect their tracking pixel consent on an opt-in basis as though they were a new subscriber.

Question Your Use of Tracking Pixels

This new regulation by France’s CNIL should prompt affected brands to audit their email marketing programs to understand how they’re using tracking pixel information. For any use that requires consent, brands should determine how vital that use case truly is.

That’s because it’s likely that the majority of people who subscribe won’t opt in for pixel tracking. In fact, it could be that the vast majority do not. It’s also likely that asking for opt-ins for more than one use case will decrease tracking pixel opt-ins even more. On top of that, asking for consent for even one tracking pixel use case may also depress email opt-ins by an amount that nullifies any benefits of securing those tracking pixel opt-ins.

Here are some issues to consider:

Mail Privacy Protection (MPP)

Especially if your brand has a high percentage of subscribers who receive your email campaigns via Mail Privacy Protection-enabled Apple Mail accounts, you may not be getting a lot of performance value out of open data. That said, because Apple’s auto opens are an unequivocal signal of inbox placement, the disappearance of auto opens means your emails to a subscriber are now landing in their junk folder or being blocked.

Open and non-open subscriber targeting

While it was fairly common to send a subscriber a follow-up campaign based on whether or not they opened the previous campaign, that practice suffered a major blow by MPP. Today, most B2C brands simply don’t have reliable open signals for enough of their subscribers for this tactic to be effective.

Intent signals

When it comes to augmenting a customer’s profile of interests, opens are a weak signal, even if your subject lines are highly descriptive. Email clicks, website and app activity, call center engagement, and conversions are much stronger signals that a customer or prospect is interested in a product, product category, or subject matter.

Send-time optimization

For brands sending no more than once a day, send-time optimization is still quite effective, even with the loss of many open signals in the wake of MPP. That’s in part due to most send-time optimization algorithms now incorporating the timing of higher-intent email clicks. However, relying only on email clicks would further dampen the effectiveness of send-time optimization.

Stronger profiling and performance data

While marketers never want to see their visibility into campaign engagement narrowed, the truth is that CNIL is further limiting open data that’s become of marginal use since MPP—with the key exception of use for deliverability and inactivity management, which CNIL wisely recognizes. Instead, campaign performance measurement and engagement signals have been migrating toward the bottom of the funnel and across channels at the customer level.

Email clicks, landing page activity, and conversions have always been much stronger first-party data signals for most brands. And as brands have embraced omnichannel orchestration and aggregated their customer data in customer data platforms, they’ve been able to drive personalization and activation in the email channel based on an email subscriber’s activities in other channels much more easily, as well as focus more on topline customer-centric metrics, like lifetime value.

When it comes to customer profiling, that cross-channel activity is a great way to gain visibility into all of your customer’s interactions with your brand and therefore their interests. And if you want a fuller understanding of your customers as consumers, data enrichment is an effective approach.

Of course, zero-party data collection is also a highly effective way to better understand your customers. Preference centers will become more important in the wake of these rule changes, as will all progressive profiling efforts, such as those enabled by Zeta Grow. Both long-term preferences (e.g., sports interests, favorite team) that are relevant for a few years and short-term preferences (e.g., vacation destination interests) that are relevant for only a few months are powerful tools for creating more relevant customer experiences.

While most marketers will think France’s clampdown on permission-based emails is unwarranted, it’s also true that marketers have been moving steadily away from opens as an intent and performance signal for years. CNIL’s ruling, which is likely to be adopted by other EU countries in the not-too-distant future, just accelerates that trend toward omnichannel engagement and customer-centric performance metrics.