CNIL Recommendation on Email Tracking Pixels: Article 5(3) ePrivacy, Exemptions and the Deadline

A tracking pixel in an email is an image one pixel across, usually transparent, fetched from a server the moment the message is opened. That fetch is the legal heart of the matter: it happens on the reader’s terminal equipment and is therefore access to that equipment.

The French supervisory authority published the final version of its recommendation on 14 April 2026 and followed it with a set of questions and answers on 22 July 2026 that settles the practical doubts. For sites outside France this is not an applicable rule – the reasoning behind it very much is.

Why an image is access

The rule at issue is the same one behind the cookie banner: Article 5(3) of the ePrivacy Directive, transposed in France as Article 82 of the data protection act and in Germany as Section 25 TDDDG. It covers not only storing information on terminal equipment but also gaining access to information already there – and a mail client fetching a remote resource counts.

This reading is not new. The European Data Protection Board already stated in its Guidelines 2/2023 on the technical scope of Article 5(3) that the provision is technology-neutral and does not hang on the word cookie. The CNIL applies that line to one concrete and very widespread case; it does not invent it.

From this follows the consequence many find surprising: legitimate interest does not carry here. Article 5(3) knows consent or one of its narrowly drawn exemptions, and a balancing test is not among the options that provision offers.

The two exemptions, and why one of them is nearly empty

Two cases remain free of consent. The first is a security purpose, for instance in connection with authentication. The second is individual deliverability measurement on a message the reader asked for – intended for removing dead addresses from a list and protecting the sender’s reputation.

The questions and answers of 22 July narrow that second exemption decisively: if additional data are collected, such as the IP address or the user agent, the benefit of the exemption is forfeited, and later anonymisation does not change that. Anyone familiar with the shape of an HTTP request sees immediately what this means.

What the image server unavoidably sees on an open

  GET /p/9f3c2a1e.gif HTTP/1.1
  Host: mail.example.com
  User-Agent: Mozilla/5.0 (…) AppleWebKit/…
  Accept: image/avif,image/webp,*/*
  X-Forwarded-For: 203.0.113.47

  The server receives the IP address and the user agent whether
  it wants them or not - they are in every request. The exemption
  therefore does not hang on what arrives but on what is written
  down: writing only "identifier 9f3c2a1e was fetched" into a
  table and discarding the connection data stays inside the line.
  An ordinary access log does the opposite.

The exemption is thus not a question of intent but a question of storage. It survives only in a setup built expressly for it – and the usual sending tools log both, because they need them for deliverability reports and fraud detection anyway.

The deadline that has passed

For addresses collected before publication the CNIL allowed three months: inform recipients by 14 July 2026 and give them an easy way to object. The questions and answers make clear what applies afterwards – if the notification was not sent within those three months, the general rules apply in full, including to the older addresses. The transition is over, and so is the leniency.

Business contacts are not exempt

A widespread assumption in business-to-business outreach is that professional addresses are held to a different standard. The questions and answers contradict this explicitly: the recommendation applies regardless of whether the recipient is a customer, a prospect or an employee, and regardless of whether the context is consumer or business outreach. The reason is the one given above – Article 5(3) protects the terminal equipment, and a work phone is terminal equipment.

A choice per purpose is required as well. Marketing communication and individual open measurement are two different things, and a consent bundling both into one checkbox does not meet that requirement.

What this means outside France

A CNIL recommendation binds in France. For a site in Germany or Poland it is not applicable law, but it is a very clear indication of how the underlying European provision is being read. That holds all the more as Guidelines 2/2023 point the same way and the provision is the same in all three countries.

In practice two steps are worth taking regardless of where a company sits. The first is establishing which sending paths set pixels at all and whether the open rate is used as a metric anywhere – it often appears in reports without anyone basing a decision on it. The second is separating consent by purpose in the sign-up form. Both cost little and are right under any reading. What stands here is a description of the texts and not legal advice.