Sending Emails to France or Italy? It's Time to Review Your Open Tracking
If you send emails to recipients in France or Italy, now is the time to review how you track opens—and how you use that data.
Does an open add a customer to a segment? Do contacts who haven't opened get the email again? Do you adjust sending frequency based on engagement?
CNIL, France's data protection authority, and Garante, Italy's data protection authority, have published guidance explaining how privacy rules apply to email open tracking. The guidance covers how you measure opens and use that data in campaigns and automations. CNIL's recommendation, Garante's guidance
In Italy, the deadline to complete the required changes is October 29, 2026. Garante's guidance
Start with this: a customer who agreed to receive your emails hasn't necessarily agreed to have their opens tracked.
To check whether their consent also covers tracking, review what you explained at signup and what they agreed to.
For marketing and CRM teams, that means three tasks: check your tracking settings, review automations that rely on opens, and make sure your reports reflect the audience you actually measured.
How Does Open Tracking Work?
Email platforms track opens using a tracking pixel: a tiny image embedded in an email. When that image loads, the platform can record an open. CNIL's explainer
When your email platform records who opened an email, that information can also feed segments and trigger automations. Check that both the tracking and your use of the data are covered by the recipient's consent or meet the conditions for operating without it.
What Should You Check in France and Italy?
In both countries, using an individual recipient's opens to improve campaigns, personalize messages, or learn about their preferences requires prior consent, unless your activity meets the conditions for operating without it.
Some uses can proceed without tracking consent. In Italy, for example, opens can be measured for campaign statistics when the data is anonymous and cannot be used to track an individual recipient. In France, limited tracking to improve email deliverability may be allowed under specific conditions in connection with a service the recipient requested. Both countries also allow certain uses related to authentication and security. CNIL's recommendation, Garante's guidance
Start with a simple question: what information does your platform collect, and what do you do with it?
Even if your dashboard only shows an overall open rate, your platform may still store an open history for each contact. In Italy, showing a summary in a report does not make the measurement anonymous. In France, anonymous data alone does not remove the need for consent to collect it. Garante's guidance, CNIL's explainer
What About Your Existing List?
In France, if email addresses were collected before April 14, 2026, tracking may continue without fresh consent under certain conditions. You need to notify recipients about the tracking, give them a clear way to stop it, and respect their choice.
The standard deadline for sending that notice was July 14, 2026. If you missed it, check with your privacy team whether a documented extension applies or whether you need consent before continuing to track opens. CNIL's FAQ
In Italy, the guidance addresses tracking that was already active separately. Among other requirements, you need to explain the tracking to recipients and let them turn it off while continuing to receive emails.
The required changes must be completed by October 29, 2026. Check with your privacy team what your existing list needs, alongside changes to the signup process for new recipients. Garante's guidance
Start With the Campaigns and Automations Already Running
Review your newsletters, Welcome journeys, promotional campaigns, win-back campaigns, and automated follow-ups.
For each one, check:
- Is open tracking enabled?
- Does the data update segments or engagement scores?
- Does an open—or the absence of one—trigger another message?
- Do you have appropriate consent for this use, or another approach approved by your privacy team?
When asking for consent, explain what you plan to do with the information. "To improve your experience" doesn't tell customers that you track opens or use them to tailor future messages.
Customers need to make an active choice, understand what they're agreeing to, and be able to withdraw consent easily. A prechecked box isn't enough. European Data Protection Board guidance
Collect, Record, and Sync Tracking Consent Across Your Systems
Collect and record tracking consent, then sync it across every system that sends emails or tracks activity on your organization's behalf.
Any change to a recipient's choice needs to reach all of those systems. If someone withdraws consent, make sure each system stops the tracking covered by that withdrawal.
"No Open Recorded" Doesn't Mean the Customer Didn't Open
An automation that resends an email to everyone who hasn't opened may also reach customers who opened it but whose activity wasn't measured.
The same issue can affect how you identify inactive customers, calculate engagement scores, or clean your lists.
Check whether you can base the decision on the action you wanted recipients to take.
For example, instead of:
"No open recorded after three days? Send the offer again."
Consider:
"After seven days, send one reminder to recipients who haven't made a purchase."
This bases the reminder on the campaign's goal. Adjust the timing to fit the customer journey and set a sending frequency cap.
Your Open Rate May Represent Only Part of Your Audience
Some email platforms calculate open rates using only emails with tracking enabled. The number in your report may therefore represent just part of your audience. Before comparing campaigns, check how many delivered emails were included in the measurement.
Suppose 10,000 emails were delivered, but only 4,000 were included in the measurement. If 1,000 opens were recorded, the platform would show a 25% open rate for the measured group.
That doesn't mean 25% of all recipients opened the email. In this example, measurement covered only 40% of delivered emails.
Alongside your open rate, show the share of emails included in the measurement. Account for those differences when comparing campaigns.
When making campaign decisions, give more weight to the outcomes you wanted to achieve: purchases, bookings, renewals, replies, and customer retention.
Can You Ask for Email and Tracking Consent Together?
Yes, in some cases and under the conditions set by each authority. You need to explain clearly that the choice also includes tracking. A general newsletter signup does not automatically cover it. CNIL's FAQ, Garante's guidance
What Happens When a Customer Withdraws Tracking Consent?
In Italy, customers must be able to keep receiving emails without the tracking. In France, the relevant tracking must stop even when a customer opens an older email you already sent. Check that your systems support this. Garante's guidance, CNIL's FAQ
Does Switching to Click Tracking Solve the Problem?
Not automatically. A tracked link can also tell your email platform who clicked and which content they clicked on. Click tracking may therefore require consent too. CNIL's explainer
For example, if clicking a product link adds a customer to an "Interested in this product" segment and triggers a follow-up, you're using that click to learn about their preferences and tailor your marketing.
Before building that automation, check what information is stored, how it's used, and whether the consent you collected covers both the tracking and those uses. Review open tracking and click tracking settings separately to make sure the recipient's choice is applied to both.
The link's purpose matters too. A link used solely to let someone withdraw consent simply and securely may operate without tracking consent under the conditions CNIL describes. Review how each link is used instead of treating every link in an email the same way. CNIL's explainer
Does the Guidance Apply to Companies Outside France?
Yes. CNIL explains that its authority may extend to companies outside France that track people located in France. A company's location alone does not determine whether the rules apply. CNIL's explainer
At Joryio, we recommend starting with three things: collect and record tracking consent and sync it across your systems, update automations that rely on opens, and measure success against the campaign's business outcomes.
This article provides general information and is not legal advice. Check with your privacy or legal team to understand how the guidance applies to your email program.