{"id":10575,"date":"2026-09-26T07:20:00","date_gmt":"2026-09-26T05:20:00","guid":{"rendered":"https:\/\/www.lukaswojcik.com\/blog\/?p=10575"},"modified":"2026-09-25T09:45:51","modified_gmt":"2026-09-25T07:45:51","slug":"cnil-recommendation-on-email-tracking-pixels-article-53-eprivacy-exemptions","status":"publish","type":"post","link":"https:\/\/www.lukaswojcik.com\/blog\/en\/data-privacy\/cnil-recommendation-on-email-tracking-pixels-article-53-eprivacy-exemptions\/","title":{"rendered":"CNIL Recommendation on Email Tracking Pixels: Article 5(3) ePrivacy, Exemptions and the Deadline"},"content":{"rendered":"

A tracking pixel in an email is an image one pixel across, usually transparent, fetched from a server the moment the message is opened. That fetch is the legal heart of the matter: it happens on the reader’s terminal equipment and is therefore access to that equipment.<\/p>\n

The French supervisory authority published the final version of its recommendation on 14 April 2026 and followed it with a set of questions and answers on 22 July 2026 that settles the practical doubts. For sites outside France this is not an applicable rule – the reasoning behind it very much is.<\/p>\n

\n\"A
Three questions, four exits. The only practically interesting branch is the one at the bottom right, and it hangs on a decision about the server log.<\/figcaption><\/figure>\n

Why an image is access<\/h2>\n

The rule at issue is the same one behind the cookie banner: Article 5(3) of the ePrivacy Directive, transposed in France as Article 82 of the data protection act and in Germany as Section 25 TDDDG. It covers not only storing information on terminal equipment but also gaining access to information already there – and a mail client fetching a remote resource counts.<\/p>\n

This reading is not new. The European Data Protection Board already stated in its Guidelines 2\/2023 on the technical scope of Article 5(3) that the provision is technology-neutral and does not hang on the word cookie. The CNIL applies that line to one concrete and very widespread case; it does not invent it.<\/p>\n

From this follows the consequence many find surprising: legitimate interest does not carry here. Article 5(3) knows consent or one of its narrowly drawn exemptions, and a balancing test is not among the options that provision offers.<\/p>\n

The two exemptions, and why one of them is nearly empty<\/h2>\n

Two cases remain free of consent. The first is a security purpose, for instance in connection with authentication. The second is individual deliverability measurement on a message the reader asked for – intended for removing dead addresses from a list and protecting the sender’s reputation.<\/p>\n

The questions and answers of 22 July narrow that second exemption decisively: if additional data are collected, such as the IP address or the user agent, the benefit of the exemption is forfeited, and later anonymisation does not change that. Anyone familiar with the shape of an HTTP request sees immediately what this means.<\/p>\n

What the image server unavoidably sees on an open\n\n  GET \/p\/9f3c2a1e.gif HTTP\/1.1\n  Host: mail.example.com\n  User-Agent: Mozilla\/5.0 (\u2026) AppleWebKit\/\u2026\n  Accept: image\/avif,image\/webp,*/*\n  X-Forwarded-For: 203.0.113.47\n\n  The server receives the IP address and the user agent whether\n  it wants them or not - they are in every request. The exemption\n  therefore does not hang on what arrives but on what is written\n  down: writing only \"identifier 9f3c2a1e was fetched\" into a\n  table and discarding the connection data stays inside the line.\n  An ordinary access log does the opposite.<\/code><\/pre>\n
The exemption is thus not a question of intent but a question of storage. It survives only in a setup built expressly for it – and the usual sending tools log both, because they need them for deliverability reports and fraud detection anyway.<\/p>\n
The deadline that has passed<\/h2>\n
For addresses collected before publication the CNIL allowed three months: inform recipients by 14 July 2026 and give them an easy way to object. The questions and answers make clear what applies afterwards – if the notification was not sent within those three months, the general rules apply in full, including to the older addresses. The transition is over, and so is the leniency.<\/p>\n
Business contacts are not exempt<\/h2>\n
A widespread assumption in business-to-business outreach is that professional addresses are held to a different standard. The questions and answers contradict this explicitly: the recommendation applies regardless of whether the recipient is a customer, a prospect or an employee, and regardless of whether the context is consumer or business outreach. The reason is the one given above – Article 5(3) protects the terminal equipment, and a work phone is terminal equipment.<\/p>\n
A choice per purpose is required as well. Marketing communication and individual open measurement are two different things, and a consent bundling both into one checkbox does not meet that requirement.<\/p>\n
What this means outside France<\/h2>\n
A CNIL recommendation binds in France. For a site in Germany or Poland it is not applicable law, but it is a very clear indication of how the underlying European provision is being read. That holds all the more as Guidelines 2\/2023 point the same way and the provision is the same in all three countries.<\/p>\n
In practice two steps are worth taking regardless of where a company sits. The first is establishing which sending paths set pixels at all and whether the open rate is used as a metric anywhere – it often appears in reports without anyone basing a decision on it. The second is separating consent by purpose in the sign-up form. Both cost little and are right under any reading. What stands here is a description of the texts and not legal advice.<\/p>\n
\n
Questions and answers<\/h2>\n
Why is legitimate interest not available here, even though the GDPR recognises it?<\/h3>\n
Because two sets of rules apply one after the other. Article 5(3) of the ePrivacy Directive governs access to the terminal equipment itself, that is, fetching the pixel. The GDPR governs the processing of the personal data that results, such as linking an open to an address. For the first step the ePrivacy provision is the more specific rule and displaces the legal bases of the GDPR; the balancing test of Article 6(1)(f) is simply not available there.<\/p>\n
Conversely, consent under Article 5(3) does not replace the assessment of the second step. Whatever happens to the open data afterwards needs a basis of its own under Article 6 GDPR, and consent covers only the purposes for which it was given. It is the same idea as the choice per purpose: agreeing to open measurement is not agreeing to the use of the data for other purposes.<\/p>\n
Is it enough to delete the image server’s access logs after a few days?<\/h3>\n
According to the questions and answers, no. The benefit of the exemption is lost as soon as the IP address or user agent is collected, and later anonymisation does not cure that; later deletion does not either, because the data were collected all the same. This applies to every stage the request passes through: the X-Forwarded-For header in the example reveals a proxy or CDN in front, and a log is created there as well.<\/p>\n
What is lost if the tracking pixel is dropped altogether?<\/h3>\n
Less than the open rate suggests. It has been an unreliable figure for years: since Mail Privacy Protection arrived in 2021, Apple Mail preloads images through Apple’s servers, often without the message being opened, and Gmail fetches images through a proxy of its own. Part of the counted opens are therefore fetches with nobody looking at the message, and the IP address then does not belong to the recipient.<\/p>\n
The task the deliverability exemption is meant for can largely be done without a pixel. Dead addresses announce themselves during sending: the receiving mail server rejects them with a permanent error, and that response arrives at the sender’s server, not on the terminal equipment. Unsubscribes and spam complaints are metrics without a pixel as well. What is really lost is the individual statement that a particular person opened a particular message, and under the line described here that very statement requires consent.<\/p>\n<\/div>\n
\n
Sources<\/h2>\n