Overview
- The CNIL published a recommendation on April 14, 2026, telling organisations to make the use of invisible tracking pixels in emails clear to recipients and to comply within three months.
- The three-month deadline ending July 14, 2026 produced a wave of informational emails from banks, media, administrations and companies offering opt-out links or asking for consent.
- Tracking pixels are tiny invisible images embedded in messages that report when a mail is opened and can record time, device type and an approximate location from the recipient’s IP address.
- The CNIL says prior consent is required when pixels are used for advertising, profiling or personalised marketing while pixels may be used without consent for necessary transactional messages like order confirmations or password resets.
- Practical limits already exist because many email clients block automatic image loading and users can avoid tracking by not opening messages, but major mailing platforms still enable open-tracking by default and non-compliance can trigger individual complaints and CNIL controls.