Your cookie preferences

EDPB guidance · Art. 7 GDPR

We use technical cookies essential for the platform to work (login, security, sessions). We would also like to use analytics cookies to understand how to improve it.

You can accept all, reject all, or choose which categories to switch on.Your consent is valid for 6 months and you can withdraw it at any time from the footer.

You will find everything in our privacy notice.

All news
Regulation July 26, 2026 4 min

Email tracking pixels: France has already closed its grace period, Italy's runs to October

Two authorities, one conclusion: the pixel measuring opens is like a cookie and requires consent. But the deadlines differ, and anyone writing to French recipients is already late

TL;DR for the DPO

Consent to RECEIVE the newsletter does not cover consent to be TRACKED on opening: these are two distinct purposes requiring two separate, non pre-ticked choices. The CNIL closed its transitional period on 14 July 2026; the Italian authority adopted comparable guidelines with decision 284/2026. An Italian client emailing recipients in France is already within the scope of checks.

The three points that matter

  • What governs is the purpose of the pixel, not the type of email. A commercial pixel placed in a transactional email - order confirmation, shipping, appointment reminder - still requires consent. Changing the envelope does not help.
  • Almost every sending tool has open tracking ENABLED BY DEFAULT. This means non-compliance is the starting state: it must be switched off or backed by consent, not the other way round.
  • Analysing opens to adapt frequency, subject line or content, or to infer the recipient's tastes and preferences, is exactly the kind of use the Italian guidelines bring within the scope of consent.

What to do now, in practice

1) Ask the client which newsletter tool they use and check whether open tracking is on: in most cases it is, and nobody knows; 2) separate the tick boxes: one to receive communications, one for tracking, neither pre-ticked; 3) update the notice explaining that opens are measured, for what purpose and how long the data is kept; 4) review the existing contact base: if it has been tracked without consent, it must be informed and given the means to object; 5) if the client also sends to France, the priority is immediate because the deadline there has passed; 6) review the Art. 28 agreement with the sending platform provider.

Why it matters for your clients

It is the classic invisible obligation: nobody decided to track opens, the tool simply does it from the day it was switched on. That makes it an excellent check to propose: it takes little time, touches an activity the client performs every week, and the result is almost always a real and easily demonstrable non-compliance. It applies in B2B too.

Official source:CNIL - deliberation no. 2026-042 of 12 March 2026, recommendation on email tracking pixels (published 14 April 2026); Italian Data Protection Authority - decision no. 284 of 17 April 2026, Official Gazette no. 98 of 29 April 2026

Looking for a workspace for your DPO work?

DPO Workspace is built by a certified DPO. 30-day free trial.

Start free

Related articles

Regulation
nullathe decision on a worker taken by the algorithm alone, from 23 October

A dismissal decided by the algorithm is void: from 23 October in Italy

Published in Official Gazette no. 234 of 8 October 2026 and in force since 23 October, decree no. 179/2026 provides that final decisions on the employment relationship cannot be based solely on automated processing, that the worker may request an understandable explanation, and that decisions taken in breach are void. In parallel, AI systems affecting work organisation enter the risk assessment under Article 28 of decree 81/2008. For a DPO this is the rare case where the consequence is not economic but civil, and it changes how the check is framed.

Oct 08, 2026New 8 min
Regulation
3signals that make notification due

Poland's UODO: not every breach must be notified. Public-register data on one side, PESEL, health and financial data on the other

If an invoicing system leaks only a sole trader's name, business name, tax number and registered address, already public in the business register, risk is normally unlikely. If it also leaks the national ID number, purchase details revealing health, or financial data, notification is due. Either way, the decision goes into the internal register.

Oct 05, 2026New 5 min
Regulation
120days to charge you, not to fine you

The 120 days are not the deadline to fine you: they are the deadline to charge you

Anyone who built an appeal on the authority's delay should re-read the calendar. The Court clarifies three things: the complaint procedure and the sanctioning procedure are autonomous, so overrunning the nine-to-twelve months on the complaint does not extinguish the power to fine; the 120 days are for notifying the charge, not for imposing the fine; and they run from the «definitive finding», which is not the first notice but the moment the authority can assess every element — including the hearing of your side. After the charge, only the five-year limitation period remains.

Sep 20, 2026 7 min