About email tracking pixels and the CNIL recommendation in Brevo

The following help article is for educational purposes only and should not be construed as legal advice. Brevo declines all responsibility for the content of this help article. The information it contains is of a general nature only and cannot be applied to the specific situation of any individual or legal entity. It is not necessarily complete, exhaustive, accurate, or up-to-date. We strongly recommend that you consult your lawyer or attorney for any interpretation or application of the GDPR.

On April 14, 2026, the CNIL (France's data protection authority) published a binding recommendation on email tracking pixels. Email tracking pixels now require prior, explicit, and separate consent from your recipients, in the same way website cookies do. The transition window for existing databases runs approximately three months from publication, until mid-July 2026.

What this recommendation means for your email tracking

By default, Brevo embeds a tracking pixel in your emails to measure opens and record per-contact engagement data. Under the CNIL recommendation, collecting and storing that individual-level data requires explicit consent from each recipient, collected separately from consent to receive your emails.

This applies to all emails sent to contacts based in France, regardless of the sending channel you use (Email Campaigns, Automations, or Transactional email via SMTP or API).

❗️ Important
The exemptions described below apply based on the purpose of the email, not the sending channel. Sending a promotional email through the SMTP API or a transactional template does not make it transactional. If the content is commercial, individual tracking requires consent.

What is exempt from the consent requirement?

The following table summarizes which tracking use cases are covered by a deliverability exemption and which require explicit consent.

Use case Status after CNIL recommendation
Campaign-level open rate reporting (anonymous) ✅ Exempt, use anonymous tracking
Suppressing contacts based on the date of last open (no history log, day precision only) ✅ Exempt, only the last open date may be stored, overwritten on each new open
Reducing send frequency for inactive contacts ✅ Exempt, same data minimization conditions apply
Transactional emails (order confirmations, shipping notifications, password resets, security alerts) ✅ Exempt
A/B testing based on aggregate open rates (non-individual) ⚠️ Likely exempt if non-nominative, to confirm with your legal team
Per-domain open rate analysis for deliverability monitoring (large lists only) ⚠️ May fall under the deliverability exemption if data is effectively anonymized and the use is strictly operational. Confirm with your DPO.
Send-time optimization at individual contact level ❌ Requires explicit consent
Targeting non-openers from a previous campaign (commercial purpose) ❌ Requires explicit consent
Engagement scoring feeding segmentation or personalization ❌ Requires explicit consent
Win-back and reactivation campaigns targeting non-openers ❌ Requires explicit consent, commercial purpose removes the deliverability exemption
Behaviorally triggered promotional emails (abandoned cart, price drop, browse abandonment) ❌ Requires explicit consent, event-triggered does not mean transactional

How to comply with the CNIL regulation

Brevo offers two ways to comply with the recommendation:

Open the tab that matches the option you want to use to see how it works and how to set it up:

Solution 1: Per-contact tracking consent Solution 2: Tracking anonymization

Per-contact tracking consent lets you continue collecting individual engagement data, such as opens, but only for contacts who have explicitly given permission.

✅ Allows you to... ❌ Does not allow you to...
  • Track opens for contacts who consented
  • Use engagement data to personalize and segment
  • Trigger automations based on engagement behavior
  • Let contacts manage their tracking preferences via update profile forms
  • Track contacts who have declined consent
  • Track contacts in Unknown status unless you explicitly choose to do so during setup
  • Assume silence means consent, you must actively collect consent

Once you activate per-contact tracking consent, Brevo automatically creates four default contact attributes to store each contact's tracking consent:

Attribute Description
Pixel Tracking Consent

Whether the contact agreed to be tracked: Yes, No, or empty. 

Only contacts with Yes are tracked for opens, so you keep engagement data while respecting consent.

Pixel Tracking Consent Date The date the contact accepted or refused pixel tracking.
Pixel Tracking Consent Source The source through which the contact gave their answer, for example a sign-up form.
Last Email Open Date

The date your contact last opened one of your emails. 

The CNIL recommendation allows you to keep this attribute even if a contact did not agree to pixel tracking.

Choose per-contact tracking consent if:

☑ You need individual engagement data for personalization or segmentation
☑ You have the resources to actively collect and manage consent

Step 1: Activate per-contact tracking consent

  1. Go to Settings > Campaigns > Default settings > Tracking & reports.
  2. Under the Tracking section, select Yes under Per-contact pixel tracking consent to activate per-contact consent management for all your email channels.
    settings_tracking-pixels_en-us.png
  3. Configure your default behavior by setting Track contacts whose consent is unknown to either:
    • Yes: for a softer transition, where contacts continue to be tracked while you progressively collect consent.
    • No: for a stricter approach, where contacts are not tracked until they explicitly consent.
  4. Click Save. All existing contacts are automatically set to unknown status.

Step 2: Add a tracking consent checkbox to your sign-up forms

Once you have enabled per-contact tracking pixels, add a consent checkbox to your sign-up forms so new subscribers can choose whether they agree to be tracked before they join your list.

  1. Create or edit a sign-up form.
  2. From the Build tab, drag and drop a Checkbox field into your form.
  3. In the Object type dropdown, select Contact.
  4. In the Attribute list dropdown, select the _PIXEL_TRACKING_CONSENT attribute.
    form_pixel-tracking_en-us.png
  5. Next to the checkbox, enter a consent statement to ask for your subscribers consent for pixel tracking. For example, "I agree to be tracked through email tracking pixels for personalized communications".
  6. In the left panel, add a label name and a help text so your subscribers clearly understand that you will use tracking pixels to send them personalized communications.
  7. Activate the Required field option to make giving consent mandatory before the form can be submitted.
  8. Continue editing your form, then publish it.

Your new subscribers can now share their consent as soon as they sign up. Their answer is saved to the _PIXEL_TRAKING_CONSENT attribute in their contact profile, so you can filter and segment your contacts based on their tracking consent.

Step 3: Send a re-consent campaign to your existing French contacts

  1. From the CRM > Contacts page, create a segment of French contacts with an empty pixel tracking consent attribute: Add filter > Contact attributes > Pixel Tracking Consent > Not filled.
    contacts_segment-pixel-tracking-unknown_en-us.gif
  2. From the Marketing > Campaigns page, create an email campaign.
  3. When designing your email campaign, include:
    • Reassurance about privacy
      Explain why you're reaching out and reassure contacts about data protection. Example: "We value your privacy and want to ensure our communications are transparent and compliant with new data protection guidelines."
    • A clear explanation of pixel tracking
      Briefly explain what pixel tracking is and how you use it. Example: "When you open an email, we use a small tracking pixel to measure open rates and understand which content resonates with you. This helps us send you more relevant communications."
  4. Insert a clear, clickable button or link to decline tracking consent. The option must be as easy to find as the opt-in option. Depending on your email editor, the procedure defers. Open the tab that matches your email editor:

    Drag & Drop Editor
    1. Drag and drop a Button content block into the email canvas.
    2. Click the button to open its settings in the left panel.
    3. In the Link settings section, choose from the Type of link dropdown the Revoke pixel tracking consent link.
      dde_button-revoke-pixel-tracking_en-us.png
    4. Replace Call to action with clear text that makes it obvious your recipients can decline the use of tracking pixels, such as "I prefer not to be tracked."
    HTML and Simple editors

    You need to manually add your revoke pixel tracking link placeholder:

    • HTML editor
      Add the {{ revoke_open_pixel_tracking }} placeholder in an HTML hyperlink tag <a>:
      <a href="{{ revoke_open_pixel_tracking }}">Opt out of the use of tracking pixels</a>
      html_revoke-pixel-tracking_en-us.png
    • Simple editor
      Click the Insert link icon, then paste the {{ revoke_open_pixel_tracking }} placeholder in the URL field, and enter the text you want to display in the Link title field.
      simple-editor_revoke-pixel-tracking_en-us.png
  5. At the Recipients step of your email campaign creation, select the segment of contacts you created earlier.
  6. Send your email campaign. A contact's pixel tracking consent attribute is automatically set to No if they click the revoke consent link.
❗️ Important
Contacts who do not respond remain in unknown status. Whether they continue to be tracked depends on the setting you chose in Step 1: Activate per-contact tracking consent.

Step 4: Add an easy opt-out link in the footer of your emails

Give contacts ongoing control over their tracking consent by including an opt-out link in your email footers. This lets recipients change their tracking pixel consent at any time, without friction.

email_revoke-pixel-tracking-footer_en-us.png

Specific considerations for B2B communications

The CNIL recommendation makes clear that the consent requirement for tracking pixels is independent of the consent regime for sending the email.

A B2B prospecting email sent under professional exemptions is legally sendable without consent. However, inserting a tracking pixel into that email still requires separate, explicit tracking consent from the recipient.

For B2B cold outreach and prospecting sequences, use anonymous tracking or collect explicit tracking consent before deploying individual pixels. Deliverability exemptions apply in B2B under the same conditions as in B2C.

❓ FAQs

Expand the accordions below to find answers to common questions about the CNIL recommendation on tracking pixels.

Does a tracking pixel in an email require consent?

Yes. Just like cookies, the CNIL considers that loading a tracking pixel counts as an operation performed on the recipient's device. Prior consent is therefore required, unless the use falls under one of the defined exemptions, such as deliverability measurement.

Is measuring my newsletter's open rate banned without consent?

It is not banned, but it is regulated. If you measure opens to optimize campaigns, personalize content, or adjust sending frequency, consent is required. An exemption exists only for deliverability measurement, meaning identifying inactive contacts to clean your list, and only for transactional emails or emails sent with consent, with minimal data retention.

Do I need to collect new consent from my existing contact list?

The CNIL does not require retroactively collecting consent for contacts that already exist. However, it does require clearly informing existing contacts about the use of pixels and giving them an easy way to opt out of future tracking.

➡️ To learn more on how to inform existing contacts, check our dedicated section Step 3: Send a re-consent campaign to your existing French contacts.

Does agreeing to receive a newsletter also count as consent to tracking?

No. The CNIL draws a clear distinction between the two. Consent to receive an email is separate from consent to pixel-based tracking. Unless the pixel's purpose falls under an exemption, separate and specific consent for tracking is required.

⏭️ What's next

🤔 Have a question?

If you have a question, feel free to contact our support team by creating a ticket from your account. If you don't have an account yet, you can contact us here.

If you’re looking for help with a project using Brevo, we can match you with the right certified Brevo Agency partner.

💬 Was this article helpful?

0 out of 0 found this helpful