Can you still track an email?
What France and Italy's new rules mean for the future of CRM
For something most people never see, the email tracking pixel has had a surprisingly big career.
For years, marketers have used that tiny invisible pixel to tell them who opened, who didn't, who should receive a follow-up, who looks engaged, and who might be drifting away.
But what happens when customers have to say ‘yes’ before you can see any of that?
New guidance from France's CNIL and Italy's Garante is forcing brands to rethink something that has become almost invisible in the marketing stack: email tracking.
And that raises some much bigger questions...
What you need to know
- Yes, email tracking is becoming a consent issue. France and Italy have both clarified that tracking pixels can fall under ePrivacy rules.
- Marketing consent isn't necessarily tracking consent. Being allowed to send someone an email doesn't automatically mean you're allowed to track their engagement with it.
- Open rates are about to become an even shakier KPI. And they were already under pressure from technologies such as Apple Mail Privacy Protection.
- CRM journeys built around opens may need a rethink. “Opened but didn't click” is no longer necessarily a dependable signal.
- This isn't just a legal team's problem. It affects CRM strategy, data models, ESP configuration, reporting, segmentation, and automation.
- France and Italy may be the beginning. The underlying rules come from the wider European ePrivacy framework.
The data
The tracking pixel may be tiny. The implications aren't.
France: CNIL adopted its recommendation on tracking pixels in emails on 12 March 2026 and published it in April.
Italy: The Garante adopted dedicated guidance on email tracking pixels on 17 April 2026, with a six-month compliance period following publication.
What can a tracking pixel reveal? Depending on the technology and setup, it can provide information including whether an email was opened, when it was opened, the recipient's IP address, device type, email client, and repeated openings.
And the really important bit: regulators are increasingly looking at the pixel itself, rather than only what brands eventually do with the data it generates.
That distinction matters.
1. The tiny pixel that knows a lot
It looks harmless: a tiny, invisible image sitting inside an email. But when that image loads, it can tell a brand that an email has been opened and, depending on how the technology is configured, provide information such as the time of the interaction, IP address, device, and email client. The EDPB has confirmed that tracking pixels in emails fall within the technical scope of Article 5(3) of the ePrivacy Directive, meaning this isn't simply an analytics question. It's about access to information on a user's device.
That distinction is at the heart of the recent regulatory attention. For years, open tracking has been treated as a standard feature of email marketing: useful for reporting, segmentation, personalisation and automated journeys, but largely invisible to the person being tracked. France's CNIL and Italy's Garante are now making that invisible layer much harder to ignore.
2. Permission to email isn't necessarily permission to track
This is probably the most important change for marketers to understand.
Being allowed to send someone an email doesn't automatically mean you can track what happens when they receive it. CNIL's recommendation makes this distinction explicitly: consent for tracking pixels is separate from the consent applicable to sending the email.
In France, tracking generally requires prior consent unless a limited exemption applies. Italy's Garante has taken a similar approach, stating that consent is generally required for tracking pixels, with limited exceptions for activities that are genuinely necessary, such as certain security or service-related functions.
For CRM teams, that makes consent much more than a legal checkbox. It becomes something that needs to travel through the customer data ecosystem: from the preference centre to the customer profile, from the profile into the ESP or CDP, and ultimately into the logic deciding what happens next.
3. What happens when the open disappears?
The immediate casualty may be the humble open rate.
It was never a perfect measure of attention, but marketers have relied on it for years because it was easy to collect and easy to understand. Now, privacy changes and technical limitations are making it increasingly difficult to treat an open as a reliable indication that a human actually engaged with an email. The attached research also highlights Apple Mail Privacy Protection and image proxying as existing challenges, with consent potentially making the data even more partial and harder to compare.
And it's not just the dashboard that is affected. Think about every journey that starts with an open: resend to non-openers, follow-up after an open-but-no-click, engagement scoring, send-time optimisation, or behavioural segmentation. If the open is no longer available for everyone, those journeys need alternative signals.
The good news is that marketers already have better ones. Clicks, purchases, conversions, loyalty activity, app engagement, preference choices, and declared interests can tell us considerably more about intent than an email simply loading an image.
4. France and Italy may be the beginning, not the end
It would be easy to treat this as a France-and-Italy problem and wait for the rest of Europe to catch up. That may not be the smartest strategy.
Both countries are applying principles rooted in the wider ePrivacy framework, and the EDPB's guidance provides a European-level basis for treating tracking pixels as falling within Article 5(3).
For brands operating across Europe, that makes a market-by-market fix increasingly unattractive. The more scalable approach is to assume that privacy expectations around email tracking will continue to tighten and build a consent-aware model that can work across markets.
The technology ecosystem is already moving in that direction. Major customer engagement platforms are introducing guidance and capabilities around tracking consent, dynamic pixel controls, and alternative journey logic.
The question is no longer whether the technology can track an open. It's whether the technology can still deliver an intelligent customer experience when it can't.
In context
So, what should brands do now?
This is where the story moves from compliance to opportunity.
1. Find out where the pixel is hiding
Audit the emails, templates, journeys, and platforms that use pixels and identify exactly what data is collected and what decisions depend on it.
Then, separate communication from tracking. Make sure your consent architecture reflects what customers have actually agreed to, and that your platforms can respect that choice dynamically.
2. Stop treating open rate as the star of the show
It can remain a useful signal, but it shouldn't be the foundation of your understanding of engagement. Build measurements around actions that demonstrate real intent.
3. Give customers a reason to share information with you
If brands want better first-party signals, the answer isn't simply to find another way to track people. It's to create a better value exchange: more relevant content, better experiences, useful preferences, and clearer reasons for customers to tell you what they want.
The most interesting thing about the tracking-pixel debate may therefore be what comes after the pixel. A less invisible, more intentional approach to customer engagement could ultimately make CRM better, not just more compliant.
Key takeaways
- The tracking pixel is small. The strategic shift isn't.
- Permission to email someone and permission to track their behaviour are increasingly different things.
- Open rate is becoming a weaker foundation for understanding customer engagement.
- CRM journeys built around opens need to be reviewed and redesigned where necessary.
- Consent needs to become part of CRM and martech architecture, not just the privacy policy.
- France and Italy should be treated as potential signals of a wider European direction.
- The strongest customer signals may be the ones customers actively choose to give you.
- The brands that adapt best will not simply track less. They'll create better reasons for customers to engage.
Summary
The future of email engagement may be less about quietly tracking what customers do and more about earning the signals that tell us what they actually want. As privacy expectations and regulations evolve, brands have an opportunity to rethink their reliance on open rates, build more meaningful value exchanges, and create customer journeys based on intentional engagement rather than invisible tracking.
The future of CRM isn't about tracking more; it's about understanding better.
Simplify your marketing execution and increase your performance
As a customer engagement technology agency, adm Indicia helps brands turn changing consumer expectations, data and technology into smarter customer experiences and marketing execution. Contact us to find out how we can help your brand prepare for what's next.
