Most emails sent to a subscriber from a commercial email platform like Omeda contain tracking, which are tiny, invisible images that track message opens. This tracking mechanism has been a fixture of email marketing for two decades, but this year, two European regulators issued new guidance on when these pixels require specific opt-ins.
In July of 2026, France’s data protection authority (the CNIL) and soon, Italy’s (the Garante), have each issued guidance that open tracking pixels require a recipient’s consent, similar to cookies, when the intent of the pixel is used for analytics, profiling, or advertising. This guidance is more lenient for pixels used strictly for deliverability purposes (for example, suppressing inactive recipients).
Here’s what’s changed, who it affects, and how to think through it.
What the guidance says
Both regulators have similar objectives: an open-tracking pixel that reads or stores information on a recipient’s device for analytics, profiling, or advertising purposes generally requires the recipient’s prior consent, much like a tracking cookie. Pixels used strictly for deliverability purposes are treated more leniently.
The timelines differ for each guidance:
- France (CNIL): The requirement is already in effect. Per the guidance, the window to inform pre-existing contacts closed on July 14, 2026. Read the CNIL recommendation.
- Italy (Garante): A transition period runs through late October 2026, giving senders time to review and adjust.
Who this affects — and who can mostly monitor
Whether this changes anything for you depends on your business: your audience, where they are, and what you do with open data.
If you have an audience in France or Italy, you and your legal counsel should review how you use open-tracking and whether your current setup calls for a consent or opt-out step for those recipients.
If you don’t send to recipients in those countries (and under GDPR), the immediate operational impact may be limited for now, but it’s still worth watching. These two decisions may signal where broader EU regulation and some U.S. state privacy law is heading.
The answer to “does this apply to me?” is that it depends, and the person best positioned to tell you is your privacy counsel. Which brings us to the part that gets overlooked.
Who’s responsible for consent?
Under the E.U. General Data Protection Regulation (GDPR), there’s a clear line between data controllers, who decide why and how personal data is processed, and data processors, who act on the controller’s instructions.
If you’re a media or publishing company sending email through a platform, you are the controller. Your email service provider is the processor. That distinction matters because it means the decision about whether and how to collect tracking consent rests with you, in consultation with your legal counsel, not with your vendor. It sits alongside the responsibilities you already hold: obtaining, managing, and maintaining your email permissions.
Your email platform should give you the controls to act on that decision, but it can’t make the decision for you. Because interpretations of this guidance can vary, we strongly recommend confirming your own assessment with legal counsel before making changes.
Practical steps you can take now
You don’t need to solve everything this week. A sensible sequence:
- Segment your audience. Do you have recipients in France or Italy? How many, on which brands and sends? This tells you how urgent the question is.
- Separate your purposes. Be clear about where you use open tracking for analytics and profiling versus strictly for deliverability. The two are treated differently.
- Talk to your legal counsel. Show them your audience geography, your use cases, your current consent language, and let them tell you what applies. Ask: Do our open tracking use cases require consent for French or Italian recipients? Should tracking consent be managed separately from unsubscribe? What should our disclosures say?
- Know your platform’s controls. Understand what you can turn on and off, and at what level, so you’re ready to act on whatever your counsel advises.
Omeda platform controls
Omeda gives you controls to support your compliance choices and your recipients’ preferences today. Clients have the ability to remove segments of their audience that reside in certain geographic locations.
- In Email Builder, you can disable open and click tracking at the database and deployment type levels through Deployment Defaults. You can also disable tracking directly for an individual deployment in the Tracking pleat. Learn more in the knowledge base.
- In Omeda’s email journey building tool, Odyssey, you can disable click tracking for an Email Element through Manage Link Tracking. To disable open tracking in Odyssey, navigate to View Analytics and select the TrackID, which will take you to Email Builder. From there, go to the Tracking pleat, where you can disable open tracking. Learn more in the knowledge base.
You can switch tracking off for sends going to segments where tracking permissions are required but haven’t yet been obtained, while leaving it in place for segments where permissions are held, or where the requirement doesn’t apply. The control follows the tracking purpose in accordance with French and Italian regulators’ guidance.
If you’d like to begin collecting consent for these audience members today, we suggest setting up a new deployment type to collect this permission. This allows consent to be stored at the email address level and then can be used as permission for segmentation and/or send suppression.
We’re actively reviewing this guidance and its practical implications across our platform, and we’ll share configuration guidance as it develops.
The takeaway
Two E.U. regulators have signaled that open-tracking pixels used for analytics and profiling deserve the same consent scrutiny as cookies. For some senders with audiences in these countries, that means a real review; for others, it’s a trend to watch (for now). Either way, the fundamentals are the same: understand the guidance, determine whether it applies to your audience, and make the call with your legal counsel.
If you’d like to talk through how your current tracking is configured, reach out to your Client Success Manager.
Quick answers
Do email open-tracking pixels now require consent in France and Italy? Per recent guidance from France’s CNIL and Italy’s Garante, open tracking pixels used for analytics, profiling, or advertising generally require the recipient’s prior consent, similar to the rules for cookies. Tracking used strictly for deliverability is required for deliverability measurement outside these strictly defined exemptions:
- Transactional emails: Recipient-requested messages (e.g. order confirmations, invoices, parcel tracking, password resets, security alerts).
- Deliverability measurement: Track the last email open date to identify inactive recipients and maintain sender reputation, using only the minimum necessary data.
- Security & authentication: Security measures required for user authentication.
Whether it applies to your organization depends on your audience and use cases, so confirm with legal counsel.
Does this affect senders outside France and Italy? Not directly, in most cases. But the decisions may point to broader EU and, eventually, U.S. state privacy trends, so they’re worth monitoring even if you don’t send to French or Italian recipients today.
Is my email platform responsible for compliance? Under GDPR, the sender is typically the data controller, and the platform is the data processor. The decision about collecting tracking consent rests with the controller, the sending organization, in consultation with its legal counsel.
Can I turn off open tracking for only some recipients in Omeda? You can disable open and click tracking at the database, deployment-type, organization, and individual-deployment levels, which lets you switch tracking off for specific sends or segments while keeping it on for others. Learn more about updating Email Builder settings in the knowledge base. Learn more about updating Odyssey settings in the knowledge base.
