Companies have been very focused on tracking and cookie litigation in the US over the past several months, as we have previously written. But for multinationals, online tracking compliance should be a global focus. Several years ago, the European Data Protection Board issued its guidance on tracking pixels. The French CNIL joined the choir in late April, with its own guidance, addressing use of tracking tools in emails. The guidance provided a transition period for existing mailing lists, which ended July 14, 2026.
As the CNIL noted, tracking tools may be used in emails for various reasons. These include understanding open rates to optimize marketing campaigns, detecting and protecting against fraud, and understanding user preferences. For all of these, the CNIL stated that to comply with French law the sender must first have gotten user consent. This, it noted, is required to comply with Article 82 of the French Data Protection Act, which implements Article 5(3) of the EU ePrivacy Directive.
To get consent, the user needs to be told why the pixel will be used either when the email address is collected or before emails with trackers are sent. Along with this disclosure, the recipient needs to be given the opportunity to agree. That consent can be either for specific reasons or for related purposes. The recipient also needs a simple way to opt out after giving consent. For emails collected before April 14, 2026, companies had until July 14, 2026 to give recipients notice and the ability to opt out.
There are some uses of tracking tools in emails that would not require consent. Namely, for security-related user authentication, or tracking that is strictly necessary to identify inactive users and for related (narrow) list management purposes. These uses, though, must comply with data minimization principles. That includes not using the pixels for personalization or profiling.
Putting It Into Practice: Companies that send global email marketing campaigns should keep in mind the CNIL’s interpretation of trackers under European law. This includes individual consent when not using the tools for security-related authentication or limited list management purposes.