CNIL on tracking pixels: how an email team can preserve analytics and not fall into the risk zone
For a long time, email teams treated tracking pixels as something almost neutral: well, yes, we look at the open rate, segment them, launch catch-up chains. In 2026, this view no longer works. CNIL directly issued recommendations by tracking pixels in letters and showed that for the regulator this is not a harmless technical detail, but full-fledged tracking with clear responsibilities for the sender.
This changes not only the legal part. For marketing, this means that the old habit of living according to open rates will have to be rebuilt both from the point of view of compliance and from the point of view of normal analytics.
What exactly did the CNIL say?
April 14, 2026 CNIL publishes final recommendation after a public consultation. The regulator specifically emphasizes: tracking pixel in a letter is an alternative to cookie-like tracking, which allows you to understand whether a person opened the letter, when it happened, from what device and sometimes in what approximate context it happened.
That is, the problem is not in the 1x1 pixel image itself. The problem is that it is a hidden mechanism for collecting behavioral information. That's why CNIL is looking at it not as a design or deliverability tool, but as a tracking technology.
B recommendations PDF The regulator describes in what cases consent is required, what information should look like for the user, and why companies cannot hide such practices behind general language in privacy policies.
Why open rate is no longer a good main KPI
The problem is not only one of law. Even from a marketing point of view, open rate has long become too fragile a metric. It is affected by email clients, content preloading, image blocking, and technical features that are not directly related to actual human attention.
Now another layer is added to this: if you use tracking pixels in scenarios where consent is needed, and it is collected poorly or formally, the segmentation logic itself becomes vulnerable. In other words, the team can optimize the funnel on data that is already problematic from a compliance point of view.
What the email team needs to change
The first is to stop considering the pixel a “background” tool. It must be described in the tracking map as explicitly as a cookie, analytics SDK or retargeting tag.
The second is to separate operational letters from marketing ones. In transactional scenarios, some of the logic may be different, but promotional mailings, nurture chains and re-engagement can no longer be described by one general rule for all cases.
Third, rewrite the KPI model. If all email performance is based on open rate and derived segments from open rate, you are depending on a metric that is both noisy and legally sensitive.
A normal replacement looks like this:
- clicks and CTR by semantic segments;
- post-click events: registration, lead, order, demo request;
- engagement on the site after the transition;
- income per letter sent or per active recipient;
- retention and reactivation based on confirmed actions, not “openings”.
What to do with analytics if pixels are cut
The worst solution here is to just leave everything as it was and hope that no one looks too closely. The second worst solution is to completely throw out measurement and work blindly.
It would be better to switch to a confirmed actions model. That is, the center of gravity needs to be moved to where the user has already done something explicitly: clicked, reached the landing page, completed an event, left a request, placed an order. This doesn't mean opens are disappearing forever. This means they no longer have to drive decisions alone.
What is especially important for B2B and long funnels
In B2B teams, tracking pixels are often used for sales alerts, lead scoring, and database warming. This is where the risk is most insidious, because data from opens begins to influence not a beautiful report, but the actions of the salesperson: who to call, who to transfer to SDR, who is considered warm.
If such scoring is based on weak consent or opaque tracking, the problem becomes not only marketing, but also process. Therefore, following the CNIL recommendations, it is worth separately reviewing all the places where email-open automatically triggers a human action.
Conclusion
The CNIL guidelines do not prohibit email marketing. They bring it back to a more mature model: less invisible tracking, more clarity, less worship of the open rate, more reliance on real user actions. For a strong team, this is not a limitation, but a reason to collect analytics cleaner and more reliably.