Tracking pixels still need consent. One lane just opened up.

As a default, yes. The EDPB has confirmed that an open pixel is a read/write operation on the recipient's terminal under Article 5(3) of the ePrivacy Directive, which makes consent the starting position rather than something you need only for certain data. The exceptions are narrow: security measures contributing to authentication, and individual open measurement strictly limited to managing deliverability. Everything to do with measuring or optimizing campaign performance needs consent.

A tracking pixel is a hyperlink to a remote image with no informational value to the reader, in practice a 1x1 transparent GIF. When the mail client renders the message it fetches that image, and the fetch sends back the pixel ID, the IP address, and often device and timing data. That is how an open is recorded. Nothing is visible to the recipient, which is precisely why regulators treat it as access to the terminal rather than as displaying a picture.

No. Nothing bans them. The rules govern when you need permission before one loads and what you may do with what it tells you. The relevant provision is Article 5(3) of the ePrivacy Directive rather than the GDPR itself, though the GDPR supplies the standard the consent has to meet and the rules on who is responsible for it.

Only for a short list of purposes. Individual open measurement is permitted without consent where it is strictly limited to adjusting sending frequency, stopping sending to inactive recipients, or picking an alternative channel when email is not landing. Two conditions clamp it: in principle you store only the date of the last known open, day only and overwritten each time rather than kept as a log, and it applies only to emails the recipient explicitly requested. The moment the same data informs campaign performance, personalization or profiling, consent is required.

Yes, where the link carries a per-recipient identifier. The EDPB's reasoning is about the identifier, not the image: adding an identifier to a URL is an instruction to the terminal to send that identifier back, which is gaining access to information stored on it. A click URL unique to one recipient does that just as much as an image URL does. If you are auditing your sends, audit the links too.

No. It applies Article 82 of the French Data Protection Act and binds nobody outside France. It is nonetheless the most detailed application of Article 5(3) to email that any data protection authority has published, so expect other regulators and plenty of counsel to reach for it as a reference point. They may still draw the deliverability line differently. The EDPB guidelines are the EU-wide baseline, and they deliberately leave the exemptions to national law, which is the gap CNIL filled.

Not necessarily, and this is the most common mistake in this area. The consent regime for pixels is independent of the consent regime for sending. Order confirmations, soft opt-in prospecting for similar products to existing customers, charitable prospecting and B2B prospecting to professionals in the relevant field are all messages you may lawfully send without consent. None of them comes with permission to measure whether they were opened, unless the purpose sits in the exempt lane.

It depends on the purpose, not on the type of email. Transactional emails qualify as explicitly requested by the recipient, which is one of the two conditions the exemptions rest on, so open measurement for deliverability is available on them without consent. That does not make them a free-tracking zone: analyzing opens on a transactional message to optimize campaign performance or to build a profile still requires consent, exactly as it would on a newsletter.

In principle the date of the last known open, day only and no time, updated on each new open with the previous value deleted. That is a last-open date, not an open log, and the difference is the whole point: the exemption exists to let you manage a distribution list, not to accumulate an engagement history under a deliverability label. If your stack cannot hold that field separately from campaign analytics, the exempt lane is not genuinely narrow and the exemption is doing no work for you.

The sender is the controller, even when tracker management is outsourced. An email service platform is a processor acting on the sender's instructions, and becomes a joint controller only where it also uses the pixel data for its own purposes, such as improving its own list quality, and the client has agreed to that contractually. A mailbox provider like Gmail or Outlook is neither controller nor processor: it displays the message and can block image loading, but does not use the data. The practical answer is that the obligation sits with the sender; a platform can make compliance easy but cannot absorb the liability.

Sometimes. One consent can cover direct electronic marketing plus pixels serving a directly related purpose, such as marketing expressly presented as personalized where the pixel drives that personalization, or anti-fraud pixels in a competition email where they exist to keep entry fair. Unrelated purposes need their own consent, and display advertising and marketing are explicitly two different purposes. The default remains consent per purpose.

Best practice is to put the information and the consent in the signup form itself, at the point where the address is collected, with a link to the trackers policy. Each purpose gets a short title and a brief description the recipient can act on. If you have to ask later, send an email containing no consent-requiring tracker with a link to a choice page, and make the choice page require a positive action such as clicking a button, because mail clients pre-fetch links. Use a unique link per recipient so only the mailbox owner can answer. Silence is a refusal, and refusing must be as easy as accepting.

Using a web consent management platform for email pixels is possible but risky. People read those tools as web and app controls, so the consent has to make clear that it concerns a different environment and a specific mailbox. The recipient must be able to tell which email address the choice applies to, and understand that the trackers will load on every device where they read that mailbox. A generic web banner that says nothing about email is unlikely to carry that meaning.

Existing tracking on those addresses could continue provided clear, accessible information about the trackers reached those recipients within, in principle, three months of publication, so anyone whose consent was not obtained as described could object to future emails. The recommendation was published on 14 April 2026, so that window closed on 14 July 2026. If the information has not gone out, this is remediation rather than planning. And if you return to those recipients for fresh consent anyway, obtain valid consent for the non-exempt tracking at the same time.