New EU rules on email open tracking pixels

What marketers need to know about new laws in France (CNIL) and Italy (Garante)

What’s changing?

France’s data protection authority (CNIL) and Italy’s data protection authority (Garante) each recently issued new guidance on tracking pixels in email. These pixels are the invisible 1×1 images that reveal things like opens, timestamps, device, and approximate location. They should now be treated the same way regulators already treat cookies: prior, informed, freely-given consent is required unless a narrow exemption applies. Both authorities root this change in Article 5(3) of the ePrivacy Directive and the GDPR.

This update affects any sender that emails recipients in France or Italy, including B2B sends to a named work address.

What do you need to do?

Don’t panic. Here are some quick steps you can take to start complying with these new rules:

Map every pixel in your email program. Include your own as well as those of any vendors you use (like MessageGears), and document the purpose of each.
Classify each use. Does your use of the pixel fall within a recognized exemption? Or does it now require prior opt-in consent?
For consent-required uses, collect it before the pixel fires. This means you’ve documented clear, specific consent that’s unbundled from other consents – and it should be as easy to withdraw as to give. Add this consent process to all of your list collection sources.
Update your privacy notice. Name the pixel, the controller, each purpose, and any third-party recipients within your public privacy policy.
Identify recipients based in France and Italy. Figure out how much of your list(s) is impacted to the best of your ability using existing data.
Send a clear notice and an easy opt-out. For addresses already on your list, Italy’s notification window closes October 28, 2026. France’s already closed on July 14, 2026.
Keep timestamped proof of consent. In case of a regulatory audit, always maintain accurate records of consent (and of withdrawal). CNIL has flagged upcoming audits on this topic.

FAQs

France: CNIL originally made the announcement on April 14, 2026 and has since published an official English-translation.

Italy: Garante then made a similar announcement shortly afterward on April 29, 2026 in the Gazzetta Ufficiale.
France: The law is already in effect as of July 14, 2026 for French email recipients on existing address lists. CNIL says it will now monitor compliance and audit.

Italy: There is still a little time before the law is officially in place for Italian email recipients. Starting on October 28, 2026 – six months from Italy’s original publication – the new ruling will be enforced for existing address lists.
France: Pixels are “trackers” under Art. 82 of the French Data Protection Act. Prior consent is now required unless exempt.

Italy: Similarly, this falls within “general prohibition” under Art. 122 of the Italian Privacy Code unless an exception applies, including explicit consent.
France: Any sender using pixels, including third-parties in the pixel chain, is impacted by this announcement. The intent is to further protect the privacy of French consumers, but even B2B communication is affected when an individual’s address is used. (E.g., An email to firstname.lastname@company should not contain tracking pixels, but an email to marketing-team@company could.)

Italy: Going even broader, all entities using pixels in email are held accountable by the Garante ruling – senders, ISPs, ESPs, mass-mailing platforms.
France: The primary exemptions to CNIL’s updated email tracking laws include:

Transactional emails, like order confirmations and password resets

Deliverability clean-up limited to last-open date only

Italy: Primary exemptions to Garante’s updated email tracking laws include:

Transmission of the communication itself

A requested service

A Garante-specific anonymized/aggregate pixel exemption
Unfortunately, we can’t tackle this without customer involvement. As the sender, you (the customer) are the data controller for pixel-based tracking in your campaigns and are responsible for the consent decisions above. MessageGears, as your email service provider, generally acts as a processor on your instructions. If you’d like to discuss how your MessageGears sending setup can support these obligations, we’re always ready and willing to help you though. Reach out to your account team at any time.

Disclaimer:

This article is intended to be informational only and is not legal advice. This summary is based on public regulatory sources as of July 2026 and may not reflect the final or most current guidance. Regulations, deadlines, and interpretations can change. Verify against primary sources like those listed below, and consult qualified legal counsel before making compliance decisions.

Sources:

CNIL, “Pixels de suivi dans les courriers électroniques: vous devez être mieux informés” (April 14, 2026)

Iubenda, “Garante email tracking pixel rules: what to do before 28 October 2026″ (June 3, 2026)

Lewis Silkin, “Tracking Pixels in Emails: A Comparative Analysis of the CNIL and Garante Guidance” (June 23, 2026)

New EU rules on email open tracking pixels

What marketers need to know about new laws in France (CNIL) and Italy (Garante)

What’s changing?

What do you need to do?

FAQs

When were these new EU email open tracking rules published?

What’s the deadline for a brand to comply with EU email open tracking rules?

What’s the legal basis for France and Italy making this change?

Who’s impacted by these new email pixel laws?

What are the main exemptions to the EU’s new email open tracking rules?

Can MessageGears handle compliance for me?

Disclaimer:

Sources: