Email Tracking Pixel Consent: Measure Without Open Rates

Your open rate just turned into a sample. Since the French data protection authority (CNIL) published its recommendation on April 14, 2026, email tracking pixel consent works like cookie consent: opt-in first, refusing as easy as accepting, and proof on file. Italy followed, with guidelines from its authority, the Garante, applicable since October 29, 2026. If your email reporting, your “inactive” segments and your subject line A/B tests still run on opens, part of what feeds them is no longer allowed to exist without an explicit yes.

I am not going to redo your DPO’s job. This guide takes the measurement side of the problem: what the texts still allow without consent, what concretely breaks in your dashboards, and how to keep steering campaigns with metrics that hold up (clicks, UTMs, sessions and revenue in GA4 and BigQuery). With a checklist at the end so you can act on it.

One caveat before we start: none of this is legal advice. I link to the official texts every time; read them with whoever owns compliance on your side.

Email tracking pixel consent: what the CNIL and the Garante say

A tracking pixel is an invisible one-by-one image, hosted by your email platform, with an identifier unique to each recipient. When the mail client loads the image, the server logs “this recipient opened this email, at this time.” That is exactly how a third-party cookie works: a read on the user’s device, without them noticing. Both authorities reached the same conclusion, with differences that matter.

France: the 2026 CNIL recommendation

The CNIL adopted its recommendation in deliberation no. 2026-042 of March 12, 2026, and published it on April 14, 2026, after a public consultation in 2025 (CNIL announcement, in French; English version of the recommendation). The principle: the pixel falls under article 82 of the French Data Protection Act, so prior consent applies unless an exemption does.

For addresses collected before April 14, 2026, the CNIL gave three months to inform recipients and let them object, which ran until July 14, 2026. That window has closed. Addresses collected since April 14 never had a grace period. The CNIL FAQ, published in July, covers the practical points, and the CNIL says it will check compliance in its upcoming audits.

Only two exemptions:

• deliverability, for emails tied to a service the recipient asked for: the pixel may then collect only the date of the last open, to send less often or stop emailing inactive people. Not the time, not the device, not the open count;
• security, for authentication or password reset emails, for example. General fraud prevention is not included.

Italy: guidelines applicable from October 29, 2026

The Garante adopted its guidelines on April 17, 2026, published them in the Italian Official Gazette on April 29, and gave six months to comply (Garante text, in Italian). Most law firms give October 29, 2026 as the deadline, some say October 28 depending on how the months are counted (Hunton summary). Either way, it has passed.

Same logic, different exemptions. The Garante notably accepts aggregate, anonymized open counting, using the same pixel for every recipient of a campaign. It also recommends a non-sequential pixel identifier stored separately from the email address, and granular consent withdrawal that does not force people to unsubscribe from everything.

Comparison table: consent required or exempt

The trickiest difference sits on the “aggregate” row. The CNIL says data from an exempt pixel can feed an overall statistic once anonymized, but that anonymizing on the device is not enough to exempt the collection itself. In other words, in France, “we only keep aggregates” is not a free pass. If you send to both countries, align each use on the stricter rule; otherwise you will be maintaining two platform configurations for a marginal gain.

What about links? The CNIL FAQ says tracked links are not directly covered by the recommendation, but they remain subject to article 82 whenever they involve a read or write on the device. So do not jump to “clicks are free”: have your platform’s redirect setup reviewed.

What breaks in your email reporting

The open rate becomes a sample (it already was)

Let us be honest: the open rate was already sick. Since Apple introduced Mail Privacy Protection in 2021, Apple Mail preloads email images, pixels included, for users who turn it on. The result: “opens” logged without a human reading anything, and an inflated rate no tool corrects cleanly.

So the 2026 change is not technical, it is legal. You lose the signal for everyone who did not consent, and you keep it, noisy, for those who said yes. That is a self-selected sample: people who accept tracking are rarely representative of your list. Comparing your October 2026 open rate with October 2025 means comparing two different populations.

Inactive segments, subject line A/B tests and scoring

Three common uses become fragile:

• the “inactive for 90 days” segment: a recipient who did not consent technically never opens. If your automation flags them as inactive, you may purge customers who read and buy;
• subject line A/B tests that pick a winner on open rate: on a smaller, biased sample, the winner becomes random;
• B2B lead scoring that awards points per open: the CNIL recommendation also applies to work addresses.

My take: stop steering on opens, full stop. Consent is just the final blow to a metric that was not measuring much anymore.

Measuring email campaigns without open rates

Clicks, UTMs and a naming convention for GA4

Clicks remain your best intent signal inside the email platform (with the legal caveat above). But the real referee is what happens after the click, on your site: sessions, conversions, revenue. For that, you need clean UTMs.

A simple convention that holds up:

Lowercase utm_medium=email is not a detail: it is what puts the traffic in the Email channel of GA4’s default channel group. Write “Email” or “e-mail” and your sessions land somewhere else. And utm_content beats your platform’s click heatmap, because you see which block drives purchases, not just clicks.

Email sessions, conversions and revenue in GA4 and BigQuery

In GA4, the traffic acquisition report filtered on the Email channel already gives you sessions, conversions and revenue per campaign. To go further, the BigQuery export lets you tie each purchase to the email session that preceded it. A starting query:

WITH email_sessions AS (
  SELECT DISTINCT
    user_pseudo_id,
    (SELECT value.int_value FROM UNNEST(event_params) WHERE key = 'ga_session_id') AS session_id,
    collected_traffic_source.manual_campaign_name AS campaign
  FROM `project.analytics_123456789.events_*`
  WHERE _TABLE_SUFFIX BETWEEN '20261001' AND '20261031'
    AND collected_traffic_source.manual_medium = 'email'
),
purchases AS (
  SELECT
    user_pseudo_id,
    (SELECT value.int_value FROM UNNEST(event_params) WHERE key = 'ga_session_id') AS session_id,
    ecommerce.purchase_revenue AS revenue
  FROM `project.analytics_123456789.events_*`
  WHERE _TABLE_SUFFIX BETWEEN '20261001' AND '20261031'
    AND event_name = 'purchase'
)
SELECT
  s.campaign,
  COUNT(*) AS sessions,
  COUNT(p.revenue) AS purchases,
  ROUND(SUM(p.revenue), 2) AS revenue
FROM email_sessions s
LEFT JOIN purchases p USING (user_pseudo_id, session_id)
GROUP BY s.campaign
ORDER BY revenue DESC

It is deliberately simple: session-level attribution, no multi-session window. For a first dashboard, that is plenty, and it already says more than an open rate. Keep in mind that GA4 itself depends on cookie consent: your email sessions are undercounted in the same proportion as the rest of your traffic. If you want to know by how much, I walk through how to measure your real consent rate in BigQuery, and how GA4 behaves when users refuse in my Consent Mode v2 in GA4 guide.

Reading the open rate on consenting recipients only

The open rate does not vanish, it changes denominator. Compute it only on recipients who consented to the pixel, and do not extrapolate it to your whole list. Use it as an internal trend metric (are my subject lines doing better this month on this panel?), not as a KPI you report to leadership. And watch the panel size: below a few thousand recipients per send, the gap between two campaigns is mostly noise.

Setting up pixel consent in your email platform

Collect at signup, withdraw from the footer

The CNIL recommends collecting consent when you collect the address, with a short label and a clear description of the purpose. A single consent is acceptable for related purposes, for instance a newsletter personalized through the pixel, as long as you say so. Silence or inactivity counts as a refusal.

For withdrawal: a link in every email, leading to a preference center, as easy as accepting. And withdrawal has a precise technical effect: your platform must ignore pixel requests for that recipient and delete data already collected, unless another legal basis applies. If your platform cannot turn off open tracking contact by contact, that is the first question for the vendor. I am not naming specific menus here: labels change from one tool and one version to the next, so check their documentation.

One point people forget: a recipient who refuses the pixel must keep receiving your emails. Refusing tracking is not unsubscribing.

Syncing consent status between your CRM and email platform

Treat pixel consent as data in its own right, with its date, its source and the version of the text shown. In practice: a dedicated field in the CRM, synced to the email platform, and never inferred from another consent (site cookies, marketing opt-in). The CNIL points out that a contract clause with your vendor does not prove consent: you, the sender, must be able to demonstrate it.

While you are at it, keep an eye on what comes next in EU regulation: the Digital Omnibus is already reshuffling consent rules on the website side, and email pixels are part of the same movement.

Compliance checklist for your tracking

FAQ

Does an email tracking pixel always require consent?

In France, yes, with two exemptions: deliverability (last open date only, for emails tied to a requested service) and security (authentication, password reset). In Italy, aggregate anonymized counting is also exempt.

Are emails sent to work addresses covered?

Yes. The CNIL FAQ states that the recommendation applies to every email containing trackers, including those sent to work addresses.

Is click tracking free of consent?

Not necessarily. The CNIL says tracked links are not directly covered by the recommendation, but remain subject to article 82 if they read or write on the device. Have your platform’s setup reviewed.

Can I still report an open rate?

Yes, computed on consenting recipients only and labeled as such. Do not extrapolate it to your whole list, and do not compare it with periods before the recommendation.

Which metric should replace it?

Sessions, conversions and revenue attributed to the Email channel in GA4, with standardized UTMs. That measures what email earns, not just what it displays.

The takeaway

The email tracking pixel is no longer a default setting; it is a tracker that needs consent in France and Italy. Rather than fighting to save an open rate that was not worth much anyway, use this to move your steering to what matters: the click, the session and the revenue, measured properly in GA4. Start this week with two things: an inventory of your pixels and a cleanup of your UTMs. The rest of the checklist will follow.