The use of tracking pixels—tools that allow companies to track emails sent to their customers and prospects, among others—has been the subject of a recommendation by the CNIL. Their use is strictly regulated: companies must update their processes and documentation in accordance with the recommendation.
Tracking pixels are small, invisible images embedded in emails. Including these tracking pixels in emails instructs the user’s device to send specific information (pixel ID, IP address, etc.) back to the parties that placed them there.
These widely used technical tools make it possible to determine whether a message has been opened, when it was opened, and from what type of device. They serve a variety of purposes: measuring the open rate of a marketing campaign, identifying inactive recipients, adjusting the frequency of mailings, or personalizing the content of a communication. They can also contribute to the creation of a profile based on the preferences and interests expressed by the recipient of the pixel.
In its recommendation adopted on March 12, 2026, the CNIL notes that the use of these pixels falls under Article 82 of the Data Protection Act—and operates in the same way as cookies.
The recipient’s prior consent is, in principle, required. It must be freely given, specific, informed, and result from a clear affirmative action. Merely providing information is not sufficient.
Consent is required, in particular, when pixels are used to measure campaign performance, personalize messages, adjust the frequency of mailings, create profiles, or detect suspicious behavior (fraud prevention).
Consent should be obtained at the time the email address is collected or, failing that, through an email that does not itself contain a pixel requiring consent.
Consent must result from a positive act. Silence, a lack of response, or simply opening the email cannot be interpreted as acceptance.
Certain exemptions are, however, permitted. These include, for example, the exclusive use of pixels to secure user authentication or to measure email deliverability, in order to identify inactive recipients and limit mailings (database cleansing). This last exemption is, however, strictly regulated by the CNIL.
The CNIL also recommends—regardless of whether consent is required for the use of the pixel—transparent information regarding the purposes pursued and the data involved. It is recommended to present each purpose in the form of a short heading accompanied by a brief explanation, with a link to a more detailed privacy policy, for example.
It must be possible to withdraw consent at any time, and the process must be as simple as giving consent. In particular, the CNIL recommends including a link in every email that allows recipients to withdraw their consent.
The choices made by data subjects must also be retained, and proof of those choices must be provided on an individual basis.
To ensure compliance, the company must also identify the pixels used, the data collected, and the service providers involved, and update all of its documentation (privacy policy, data processing register, data processing agreement annex, etc.).
LINKEA assists its clients in achieving GDPR compliance. Feel free to contact us!