Who is affected by the CNIL’s recommendations, how to comply and what precautions should be taken to avoid heavy fines? Answers below.
There Cnil published its recommendations on tracking pixels in emails in mid-April. These requirements directly impact many companies using this method to, among other things, personalize their email sending strategy based on the analysis of their opening rate. Who is affected, how to comply and what precautions to take to avoid fines? Here you will find the recommendations collected by the Journal du Net from Me Etienne Drouard (Hogan Lovells), du Geste and Me Alexandra Iteanu, head of the data and GDPR department at Iteanu Avocats.
1. Who is affected?
All companies using tracking pixels for individual, segmented and personalized analysis of their email open rates are required to obtain specific consent from their recipients. The use cases concerned are the measurement and optimization of the performance of emailing campaigns (personalization of content, adaptation of frequency, etc.), the segmentation of audiences according to their opening rate, the detection of fraud and individual measurement for deliverability purposes (excluding exemptions).
“It is essential to review the contracts with your email subcontractors. Many insert pixels for their own needs (improvement of deliverability, relevance of their lists, etc.) which creates co-responsibility for processing within the meaning of Article 26 of the GDPR. A simple guarantee clause is not enough: the contract must concretely organize the reporting of proof of consent and provide for regular audits”, specifies Me Alexandra Iteanu.
Hence the importance, according to the lawyer, of carrying out a precise mapping of the pixels used, their transmitter and their purpose. “It is this mapping which makes it possible to distinguish pixels exempt from consent from those which are subject to it, to draft compliant information and, when the day comes, to document compliance in the face of an inspection by the CNIL.”
2. Is opting-in to newsletters or commercial prospecting enough?
No, because the CNIL considers that the sender must obtain specific consent from its recipients to the inclusion of tracking pixels in its emails. The latter must therefore a priori be distinct from the consent to be received for commercial prospecting. Voluntarily signing up for a company’s newsletters or communications isn’t enough either. This being said, questions arise about the notion of “related purposes”, proposed by the CNIL, such as the collection of pixels and “prospecting expressly presented as personalized”, which could simplify the collection of consent, but which remains vague. The Gesture will forward to the CNIL all questions that still remain unanswered for further clarification.
3. Are BtoB prospecting communications also affected?
Yes. Tracking pixels (for the purposes of individual, segmented and personalized analysis of the open rate) require consent even when the underlying email can legally be sent without consent, for example in the case of B2B commercial prospecting, authorized without prior consent (opt-in) of the recipient.
4. Is it obligatory?
Yes : non-compliant companies risk fines of up to 4% of consolidated global turnover. Data controllers must be able to demonstrate proof of consent, directly and for each data subject. Businesses cannot rely exclusively on the contractual commitments of service providers to collect consent on their behalf.
5. When are companies not required to obtain this consent ?
First of all, if the use of the data collected by the pixels is only statistical for the calculation of an overall deliverability ratethen the use of these is exempt from consent. Apart from aggregated and global processing, the only exemptions to the collection of consent concern situations where individual information on receipt and opening of an email is necessary for reasons ofcontractual, legal, transactional and even security obligations such as checking a connection or confirming an order. In this case, the company will not be able to do anything with the pixel other than note receipt of the message. No further inference can be drawn from this.
6. From when must we comply with this obligation?
The CNIL’s recommendations have a immediate effect for any new email address collected, since April 15 unless an exemption applies. Since this date, companies have been required to ask any new reader or customer to consent to the presence of a pixel in the messages they receive.
For email addresses collected before April 14, companies will have until July 14 to explain to people what a tracking pixel is and allow them to object. In this case, they are required to clearly inform their recipients about practices relating to pixels and to contact them explicitly by email to ask them if they wish to object to pixel tracking and withdraw their consent to any further tracking. The question of whether this information can be inserted at the foot of an editorial communication or a commercial email has not been resolved. For people that companies fail to notify before July 15, the integration of a pixel will be subject to consent for any subsequent messages unless an exemption applies.
7. What happens if the person doesn’t react before July 14 ?
For email addresses collected before April 14, 2026, the data controller has a period of three months, i.e. until July 14, 2026, to transmit clear information to the recipients and giving them the ability to object to future emails (opt-out mechanism). “The recommendation is not clear on the case where the recipient does not explicitly oppose this processing, and remains silent. The CNIL only specifies that these Recipients must be ‘enabled to object to such operations for future emails’, but do not make it explicit that consent is mandatory. When in doubt, and to avoid any search for liability, we recommend: 1. to keep the sending of this information email safe; 2. to send a dedicated email, without pixels subject to consent, inviting you to express your choices via a tracking link redirecting to a page requiring positive action”, advises Me Alexandra Iteanu.
8. Can consent be collected in the newsletter sent?
“The recommendation does not prohibit collection within a commercial communication or newsletter, although this is very precisely regulated in point 4.2 of the recommendation. The email requesting consent must not contain any tracking device subject to consent, and must provide clear and complete information, in order to allow recipients to make a ‘free and informed’ choice. Furthermore, the CNIL expressly emphasizes that solicitation must not exert disproportionate pressure or hinder the reading of emails. Refusal must be as simple as acceptance,” explains Me Alexandra Iteanu.
9. How to obtain consent?
The simplest is tointegrate the pixel consent request directly into the email address collection formeither via a dedicated box, or a short wording inspired by the examples proposed by the CNIL. For this consent to be valid, the recipient must react positively, for example by clicking on a link to validate their acceptance. This is the option favored by the CNIL. “Consent can also be obtained via an email without a tracker requiring a clear positive action or via consent management platforms (CMPs) dedicated to the specific purposes of pixels and which are not simple CMPs of cookies,” specifies the Hogan Lovells firm. User inaction may be considered a refusal.
The CNIL insists that recipients must clearly understand which email address is affected by the collection of consent to tracking pixels and that this applies to all devices used to access this inbox.
10. How can I withdraw this consent?
Data controllers must include a personalized opt-out link in the footer of each emailredirecting to a page allowing recipients to withdraw their consent immediately, without having to enter their email address or complete additional authentication steps.
“After withdrawal of consent, data controllers must ensure that tracking pixels stop functioning, including in previously sent emails that may be reopened. Given that it is physically impossible to remove pixels from emails once the message has been sent, neutralizing pixel-generated HTML streams after withdrawal of consent appears to be the only feasible (server-side) solution to be explored in the next three months or even later. In the event of withdrawal of consent, any technology provider used by the sender (to place the pixel, to calculate likeability scores, etc.) must be able to delete all the data collected up to that point,” advises the firm Hogan Lovells.
11. How long does consent to tracking pixels last?
“The recommendation does not explicitly set a retention period for this consent to the tracking pixel. It simply recommends, as a good practice, that the data controller renews the collection ‘at appropriate intervals’ taking into account the context. As an indicator, we have the “cookies and other tracers” guidelines of September 17, 2020 (deliberations no. 2020-091 and 2020-092) to which the pixel recommendation explicitly mentions, which can be of help depending on the context. What is important, whatever the fixed duration, is to be able to justify it internally by documenting this choice, and to apply it”, recommends Me Iteanu.
12. Should proof of consent be “kept” for 5 years?
The recommendation does not set any specific duration for the retention of proof of consent. Its point 6 only recalls the obligation arising from article 7.1 of the GDPR: being able to demonstrate at any time that the user has consented, in an individualized manner, with the trace of the conditions under which this consent was obtained.
“In cases like this, where no fixed duration is specified, it is customary to set the retention of proof at 5 yearssince this duration corresponds to the legal prescription in French law (article 2224 of the civil code). It is however possible to set a shorter duration; some players wish to align with the retention period of the email address itself (3 years after the last contact for prospecting). What matters is that this fixed duration is justifiable, and respected in practice,” concludes Alexandra Iteanu.
