Do you need consent to see who opened your email?

If the person you are writing to is in France, the answer is now written down, and for the way most salespeople use a tracker it is yes: you need their consent before a pixel records that they opened your email. France's data protection authority, the CNIL, published a recommendation on tracking pixels in emails on 14 April 2026 and a page of answers to practitioners' questions on 22 July. The UK regulator and the EU's data protection board start from the same rule. Here is what the texts actually say, and how to keep tracking where it is allowed.

Why a tiny image counts as touching someone's device

The rule underneath is Article 5(3) of the EU ePrivacy Directive. It allows storing information on a person's device, or reading information already there, only with their consent or where it is strictly necessary for a few narrow purposes. The recital behind it names web bugs among the devices that can intrude on privacy, which tells you the drafters had this kind of thing in mind in 2002.

Whether an email pixel is covered was settled by the European Data Protection Board's Guidelines 2/2023, adopted in final form on 7 October 2024. They describe a sender including a pixel to detect when the receiver reads the email, and conclude that both halves are in scope: delivering the image to the device is storage, at the very least through the mail client's cache, and the identifier that comes back is gaining access. The same paragraphs cover tracking links, which carry the identifier in the web address instead of an image.

What France wrote down in April

The CNIL adopted its recommendation on 12 March 2026 and announced it on 14 April, after a public consultation in the summer of 2025. The English courtesy translation lists the purposes that need consent, and the first is the everyday one: analysing the email opening rate to measure and optimise performance, including adapting how often you send or which channel you use.

Two exemptions survive. One covers pixels used only to secure a login, such as checking that an email carrying a sign in code was opened on the right person's device. The other covers deliverability: measuring opens so a sender can slow down or stop mailing people who never open. That second one is narrow. It applies only to emails the recipient asked for, or that belong to a service they asked for, such as order confirmations and password resets, and the CNIL says that in principle only the date of the last open should be kept, without the time, overwritten each time.

The text also makes the B2B point directly. Its list of emails that can be sent without the recipient's consent, yet may still need consent for the pixel inside them, includes prospecting aimed at professionals about their own line of work. Addresses collected before 14 April got a transition, three months to tell those recipients about the pixels and let them object. That window closed on 14 July.

The July answers a salesperson should read

The question and answer page, published in French on 22 July, is where the recommendation meets ordinary sending. Five of its answers matter for anyone tracking one to one mail.

• Prospects and colleagues are in scope. Asked whether some emails fall outside the recommendation, such as mail to employees at their work addresses, the CNIL answers no: it applies whatever the context, whether the recipient is a customer, a prospect or an employee.
• A cold email is not a requested service. A prospecting email sent without prior consent, under the rule that lets a company market similar products to its customers, cannot count as something the recipient asked for, so even a deliverability pixel inside it needs consent.
• The time of an open is more than deliverability needs. A pixel that also reveals when the email was opened collects beyond that purpose and loses the exemption.
• Deleting the extras afterwards does not help. Collecting the IP address or user agent and anonymising them shortly after still counts as having collected more than was necessary.
• Where the sender sits does not decide it. The CNIL says it can act against senders established outside the EU when pixels are used to follow the behaviour of people in France, and that the EU's one stop shop mechanism does not apply to these checks.

One more answer is quietly useful for sales teams. The CNIL confirms that under its framework for commercial prospecting, a simple email open is still not to be treated as the prospect contacting you. However much a dashboard celebrates it, an open is not an invitation.

The rules follow the person reading the email. Where you send from changes very little.

The UK and the rest of Europe

The ICO's guidance on storage and access technologies uses an email pixel as a worked example: an organisation whose marketing emails carry a pixel recording the time, location and operating system of the device used to read them. Most email marketing falls under regulation 22 of PECR, the ICO says, but where a pixel stores or reads information on the device, regulation 6 applies. Regulation 6 means prior consent to the UK GDPR standard, unless an exception applies.

Across the rest of the EU, the EDPB guidelines settle the scope and deliberately leave the exemptions to each country's law and regulator. That is why the French text is worth reading even if you never write to France. It works through email pixels purpose by purpose, and its reasoning rests on the directive every member state implements.

Tracking you can keep, and how to keep it clean

None of this makes it impossible to know whether your email landed. It changes which signals you rely on and whose you collect.

• Know where your recipients are. These texts follow the reader, so a list that mixes prospects in Paris with prospects elsewhere may need more than one policy.
• Send untracked where you have no consent. Fast Mail Tracker puts an On and Off switch on every Gmail compose window and a Track opens switch on the dashboard composer. With opens switched off, the message goes out with no pixel in it at all. There is no per country or per recipient rule yet, so today this is a choice you make message by message.
• Ask in a way that counts. The CNIL's preferred moment is when the address is collected, with the tracking explained beside the form. If you ask later by email, that email should itself carry no pixel, agreement should take a deliberate click on a page, and silence counts as a refusal.
• Let replies carry the weight. A reply is the recipient choosing to talk to you, and it needs no pixel. Plan follow ups on a schedule you would defend without knowing whether anyone opened.
• Know what your own tool collects. Ours records the time of each open, the IP address and the browser's user agent, which puts it on the consent side of the CNIL's line rather than the deliverability side. Any tracker that tells you when someone read your email lands in the same place, because the time is the point.

This is a reading of what regulators have published, not legal advice, and a sender with a large European list should put the question to a lawyer. The texts themselves are short and plain, and every one is listed below.

Fast Mail Tracker is in early access while Google's security review runs, so places are limited. If you want tracking you can switch off for anyone who has not agreed to it, install it from the button below.