CNIL Recommendation on Email Tracking Pixels: Article 5(3) ePrivacy, Exemptions and the Deadline

An email tracking pixel is usually a small remote image with an associated identifier in its address. A request can reveal information about message use, but it does not prove a human opening: image blocking, preloading and intermediary servers change the signal.

The CNIL, France’s data protection authority, published its recommendation on 14 April 2026 and added a detailed FAQ on 22 July. The recommendation explains the applicable rules; its introduction expressly says that it is neither regulatory nor exhaustive. Relevant law includes Article 82 of the French Data Protection Act, national implementation of Article 5(3) ePrivacy, and the GDPR for personal data.

Why pixels can fall under terminal-equipment protection

EDPB Guidelines 2/2023 describe the mechanism: a supplied identifier is stored on the device and returned when the resource is requested. Temporary memory can matter too. The relevant issue is the specific storage or access to information, not simply image dimensions or the existence of a network connection.

Legitimate interest cannot replace consent required for terminal access. Where an exemption applies, subsequent processing of personal data still needs a separate GDPR assessment. Germany implements the relevant requirements in Section 25 TDDDG; French case-specific interpretations are not automatic exemptions throughout Europe.

Exemptions have several conditions

The recommendation addresses security connected with user authentication and narrowly defined deliverability measurement. A general fraud-prevention interest is insufficient. The latter exemption requires requested messages or an expressly requested service, and necessary action concerning inactive recipients, such as reducing frequency or stopping delivery.

The recommendation normally limits retained information to the date of the last known opening, without its time; a new date replaces the previous one. That differs from a complete history of individual requests. Additional necessary data require documented justification. Permission to send under an existing-customer marketing exception does not automatically exempt a pixel.

Disabling an access log is not a compliance guarantee

The FAQ rejects collecting unnecessary extra information, such as an IP address or user agent, and then deleting or anonymizing it as a basis for exemption. This does not establish an official guarantee that switching off one log file is sufficient. Purpose, collection and processing across the delivery provider, proxy, CDN and application require examination.

RFC 9110 does not require a User-Agent field in every request. X-Forwarded-For is not mandatory either; its presence alone proves neither trustworthy origin nor an actual proxy log. An image server may see an intermediary’s address rather than the recipient’s.

14 July was not an unconditional end to every transition case

For addresses collected before 14 April 2026, the CNIL generally allowed three months for clear information and an easy objection mechanism. The FAQ permits a reasonable extension for objectively justified and documented difficulties, including delivery problems associated with large lists.

Following proper information and no objection, transitional treatment can continue for later messages while the relevant conditions remain unchanged and no new consent is required. Without timely information or a justified extension, the general requirements apply; pixels requiring consent cannot then continue without it. This is not a blanket exemption for every old address.

Separate purposes and genuinely related purposes differ

Independent purposes require an appropriately free choice. The FAQ permits an overall acceptance button if a further layer offers separate decisions. Sufficiently related purposes can even share one consent, for example an explicitly personalized newsletter and pixels directly used for that personalization. An ordinary newsletter subscription is not unrestricted tracking permission.

Withdrawal must also work for messages already sent. The provider must handle affected identifiers accordingly and must not continue using later requests for the withdrawn purpose. Merely removing pixels from future mailings does not solve this.

Cross-border jurisdiction and measurement limits

Establishment outside France does not automatically exclude CNIL jurisdiction. The FAQ expressly covers, under relevant conditions, organizations in other EU states or outside the EU. Business addresses and employee messages are not generally excluded either.

With Protect Mail Activity enabled, Apple downloads remote content in the background regardless of deliberate opening. Gmail normally uses an image proxy, an intermediary server that retrieves images on behalf of the recipient; that does not establish identical preloading behaviour. A pixel request is therefore a technical signal, not reliable evidence of reading. Bounces, unsubscribes and complaints provide complementary information, but do not reliably distinguish a valid inactive address from an actively read mailbox.