Ask before you track opens

Region

European Union (EU). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds.

How to do it

The EDPB's guidelines on the ePrivacy Directive, Article 5(3), name tracking pixels and tracked links in email as access to the reader's device. That needs consent unless it is strictly needed for the service the person asked for. France's CNIL published a recommendation on pixels in email on 14 April 2026. It needs consent for open rates, profiling and fraud scoring. It exempts receipts, account and security mail, and a narrow measure of whether mail still arrives. Ask for tracking consent in the sign-up form, apart from the consent to get the mail. Store it next to the marketing consent, as Have consent before any marketing message says. Render each message with or without the pixel per recipient.

Examples

JavaScript example

function trackingPixel(contact, messageId) {
  if (!contact.consents.has('email-tracking')) return '';
  return `<img src="https://links.example.com/o/${messageId}" width="1" height="1" alt="">`;
}

Python example

def tracking_pixel(contact, message_id: str) -> str:
    if "email-tracking" not in contact.consents:
        return ""
    return f'<img src="https://links.example.com/o/{message_id}" width="1" height="1" alt="">'

How to check

Render a newsletter for a test contact in the EU without tracking consent. It holds no remote image on your tracking host and no per-person link token. Give the consent and render again, and the pixel appears.

Sources

• EDPB Guidelines 2/2023 on the technical scope of Art. 5(3) of the ePrivacy Directive
• CNIL, Recommendation on tracking pixels in email
• ePrivacy Directive 2002/58/EC, Article 5(3)

Related rules

• EML-50 Deciding on open data alone in Email
• NTF-2 Have consent before any marketing message in Notifications