New privacy rules for email tracking: what's still allowed and what isn't?

Now legislation is entering the conversation. Two European regulators have decided that the tracking pixel generating that open rate falls, legally, into the same category as a cookie. And cookies require consent.

This isn't a disaster. But it is a moment to pause and think about how you measure your email marketing.

What is a tracking pixel, exactly?

A tracking pixel is an invisible 1x1 pixel image embedded in your email's HTML. As soon as an email client loads it, it sends back who opened the email, when, on which device, and from where. Your open rate goes up.

This technology has existed for twenty years, but European regulators are now explicitly equating it with a cookie. The reason: the pixel reads information from the recipient's device without them doing anything, which falls under Article 5(3) of the ePrivacy Directive, the same article that governs cookies.

What's been decided, and does this apply to me?

The French data protection authority, the CNIL, published a recommendation on tracking pixels in email in April 2026. The Italian Garante followed three days later with a binding directive. Both say the same thing: for most marketing purposes, you need explicit consent before you can include a tracking pixel in an email. Consent to receive emails is not the same as consent to be tracked.

The French deadline has already passed: 14 July 2026. The Italian deadline is 29 October 2026.

Do you send emails to recipients in those countries? Then this is already relevant to you today, regardless of where you or your company are based. What matters is the recipient's location.

Only sending to markets that aren't (yet) regulated? Then this specific obligation doesn't apply to you today. But keep reading anyway.

We think other countries will follow

The ePrivacy Directive applies across all EU member states. Every national regulator has the same text in front of them. Belgium, the Netherlands, Germany, Spain: they can make the same decision, and we think that, eventually, they will.

That's also why we at Flexmail aren't tackling this country by country. Taking privacy legislation seriously is a core value of our platform, not something that happens to us. We're building a solution that works across Europe, so you, as a customer, won't have to adjust again each time another country follows suit.

What's not allowed, what is allowed

According to the CNIL and the Garante, the exemption is narrow. Most of the things marketers use open tracking for today fall on the wrong side of it.

What's not allowed without consent

These are exactly the things most marketers use open tracking for. The exemption is narrow.

What is allowed, even without consent

This doesn't have to be a disaster

We understand this feels like a loss. Open rates have driven your reports for years, trigger your automations, and decide who gets your re-engagement campaign. But as mentioned earlier, that metric was already largely unreliable, thanks to Apple MPP and Gmail's AI summaries.

The legislation is now pushing you in a direction that's good for your email marketing, even if there had been no law at all.


A click is a deliberate action. Someone saw your email, found something interesting, and clicked through. That's engagement that counts. An open is largely an artefact of how email clients work.

Use this moment to segment smarter

If opening behaviour disappears as a signal, why someone signed up and what interests them becomes more important. An open, after all, says nothing about interest, someone curious about a subject line doesn't necessarily have any interest in the product itself.

The real value lies in what you already know about your contacts: which interests they specified when signing up, which category they click most often, which products they've already bought, which forms they've filled in.

Custom fields and interest categories in your email platform aren't a nice-to-have. They're the infrastructure for email marketing that works without opens. And relevant emails also lead to fewer spam complaints, more clicks, and better deliverability.

What you can do right now

What Flexmail is working on

At Flexmail, we always want to be compliant with privacy legislation. Not as a box-ticking exercise, but because we believe email marketing works better when it's built on trust.

You can already turn off click tracking today through your account settings. That's a step many customers can already take.

What's coming is a full consent system that lets you track, per contact, whether someone has given consent for open tracking.

Important: this is a choice you make as a customer, not an obligation we're imposing. Only sending to markets that aren't affected yet, and see no reason to activate the consent policy today? Then nothing changes in how you use Flexmail. Do you send to markets where the regulation already applies, or do you want to be proactively compliant with what's coming? Then you can turn on the consent policy and the system will work automatically for you.

If you activate the open consent policy: contacts without consent will automatically receive a pixel-free version of your email. Your opt-in forms will get a tracking consent checkbox. Your profile page will get a separate option to manage open tracking without unsubscribing. And your reporting becomes more transparent: you'll clearly see who you're tracking and what your open rates are for that group.

We're building this Europe-wide, not as a French-Italian patch. If other countries follow, you as a customer won't have to reconfigure anything.

You can read more detail on exactly what's changing in Flexmail, and how to prepare for it, in our next article.

This article is informative in nature and does not constitute legal advice. Consult your own DPO or legal adviser for an assessment specific to your situation.