Email privacy

Email sits in inboxes for years and gets forwarded, so treat every message as something many people may read. In the EU, the GDPR and the ePrivacy rules also cover tracking pixels and links.

Required

• Keep personal data out of links

  Required

  Never put email addresses, names or other personal data in link addresses or tracking parameters. Use a random reference instead.

• Send only what the message needs

  Required

  Put only the data each message needs into it, and keep sensitive data out of subject lines and previews.

• Keep proof of consent

  Required

  Send marketing email only to people who agreed to it, and keep a record of when, where and to what they agreed.

• Keep email logs lean

  Required

  Log what you need to run and debug email, without full message bodies, and delete it on a set schedule.

• Never email customers from test systems

  Required

  Outside production, send all mail to a capture server or to an allow list of test domains. Never deliver it to customer addresses.

Recommended

• Don't rely on tracking pixels

  Recommended

  Avoid tracking pixels, and never make a decision on open data alone. Where you do track opens, say so and get consent where the law asks for it.