Email pixels now need consent in France and Italy. Stop treating untracked contacts as non-openers

KEY TAKEAWAYS

1. An untracked contact and a contact who never opened look the same to most open-based rules. That turns sunsets, resends, score decay and sales alerts into errors for anyone without tracking consent.
2. Platform defaults for contacts with no consent value disagree. HubSpot's beta treats them as untracked everywhere, while Klaviyo and Adobe Journey Optimizer track them unless told otherwise.
3. France keeps a last-open date for list cleaning. Italy keeps only aggregate statistics. One rule set rarely satisfies both.
4. Clicks are not a consent-free substitute. Rebuild the funnel's decisions on replies, form fills, bookings, purchases and campaign-level UTM tags.

Italy's guidelines on email tracking pixels apply from 29 October 2026. France's have applied since April. Most compliance guides end with a list of automations that use opens. The harder problem sits one step later. Once some contacts are untracked, your funnel rules see silence and read it as disinterest.

What changed on 29 October?

The Garante adopted its guidelines on 17 April 2026 and published them in the Gazzetta Ufficiale on 29 April, with six months to comply. Italian counsel cite a Garante note of 5 October that fixes the date at 29 October. Several vendor pages say 28 October, so check your own deadline logic if you built it from those pages. The Garante has placed pixel compliance in its inspection plan for August to December 2026.

The rule is simple to state. A pixel that tracks an individual reader needs consent. The Garante lists three examples: adapting messages to which emails were opened, changing send frequency by interest, and building profiles. Readers who refuse tracking must still be able to receive the emails, without pixels.

France moved first. The CNIL published its recommendation on 14 April 2026. Addresses collected before that date could stay tracked if recipients were told by 14 July and given a way to object. Addresses collected from 14 April need consent. A non-response counts as a refusal. A CNIL FAQ of 22 July confirmed the rules cover B2B recipients too.

Why does an untracked contact look like a non-opener?

Because most platforms record nothing for them. Klaviyo creates no "Opened Email" event when tracking is off. HubSpot says workflow branches that depend on opens or clicks will not trigger, active segments stop updating on new engagement, and lead scores get no new events.

Now look at how funnel rules are written. "No open in 180 days" means suppress. "Not opened after three days" means resend. "Opened twice" means alert sales. Each rule treats an empty record as a fact about the reader. For an untracked contact, the empty record is a fact about your settings.

The two cases need opposite responses. A real non-opener may need fewer emails. An untracked reader may be reading every one. Unless the rule checks tracking status first, it treats both the same.

This was already a weak signal. Litmus counted Apple at 76.56% of opens in September 2026, across more than 1.5 billion opens, and calls opens from Mail Privacy Protection unreliable. Apple's own page says Mail downloads remote content when a message arrives, whether or not it is opened. Consent rules do not create the problem with opens. They make one group of contacts permanently silent.

Who is untracked depends on your platform's default

The size of the silent group depends on how your platform treats a contact with no consent value. Vendors do not agree.

Two consequences follow. In HubSpot, switching the beta on makes every contact without recorded consent silent, worldwide, not just in France and Italy. In Klaviyo or Adobe, leaving the default alone keeps tracking new French sign-ups, which the CNIL says need consent. Neither default is a compliance decision. Make that decision yourself.

The group also grows over time. In France, contacts collected before 14 April could stay tracked after notice. Every sign-up since then is silent unless your form asked for consent and the reader agreed. As your list turns over, the untracked share rises even if nothing else changes.

France and Italy disagree on the one open signal you can keep

The CNIL allows one individual open signal without consent. You may keep the date of the last open, to the day, replaced at each new open. Its only uses are adjusting frequency or stopping sends to inactive recipients. It applies only to emails the recipient requested, such as transactional email or mail sent with consent. Per the 22 July FAQ, a newsletter sent under the soft opt-in for similar products cannot carry it.

The Garante has no such carve-out. It exempts aggregate statistics, measured with the same pixel for every recipient and anonymised technical data. It names changing frequency by interest as a use that needs consent. Lewis Silkin's comparison finds no aggregate exemption in the CNIL text. The Garante's own list of exemptions has no individual deliverability case.

Even France's carve-out is weaker than it looks. Postmastery argues that a last-open date is useless without filtering machine opens from Apple Mail and security gateways. That filtering resembles fraud detection, which the CNIL says needs consent. Badsender reports a CNIL representative saying a campaign identifier is not strictly needed for the exemption. If so, campaign-level open rates may not survive without consent either.

The evidence supports a plain reading. A last-open sunset is defensible for requested French email. It is not a basis for Italian contacts, and it is a poor engagement measure anywhere.

Are clicks a safe replacement?

Many guides say yes. Astral and Scalero both recommend clicks as the main engagement metric for French and Italian contacts. Astral does flag that tracked links may fall under the same logic.

The stronger evidence says not by default. The EDPB's Guidelines 2/2023, version 2.0 of 7 October 2024, treat URL tracking and pixels together in paragraphs 49 to 51. Adding an identifier to a link counts as gaining access to the device. Badsender reports a CNIL representative saying tracking links face similar obligations, with work under way. Platforms differ here too. HubSpot turns click tracking off with open tracking by default. Klaviyo keeps them separate. Customer.io offers a setting to strip link tracking for people without consent.

So treat a per-person click as the same consent question as a per-person open. Campaign-level UTM tags that are identical for every recipient do not identify anyone, which follows the Garante's same-pixel logic. Confirm that reading with counsel. Clicks were never clean anyway, as bot clicks in email shows.

What does this do to a real list?

A hypothetical example, with assumed numbers. A B2B software company has 24,000 contacts. 3,600 are in France or Italy, and 1,200 of those are untracked. Some joined after the cut-off through a form with no consent box. Others refused. Assume the untracked group reads like everyone else, and 70% open at least occasionally.

• Sunset at 180 days without an open. All 1,200 hit the rule. About 840 of them are readers. The rule removes them because of a setting.
• Resend if not opened in three days. All 1,200 get every resend. Across a six-email nurture, that adds 7,200 sends to people who may already have read the first copy.
• Lead score with points for opens and decay for inactivity. All 1,200 drift down. None of them can reach a threshold built partly on opens.
• Open-rate reporting. If the denominator counts all delivered email, the rate falls with no change in reading. If it counts tracked email only, as HubSpot and Customer.io do, the rate holds but describes a smaller group. Mailgun expects that group to skew towards your most engaged readers. A/B tests by opens then pick winners for your keenest readers only.

Which automations should you keep, rebuild or retire?

Scoring on meetings rather than opens is the better rule anyway. AI-personalised nurture makes the same case for a different reason.

A seven-step rebuild

1. Inventory every open reference. List each workflow, list, score rule, A/B test and alert that reads opens or clicks. Check Marketo smart campaigns and HubSpot active lists with care, since open filters often sit inside them.
2. Add a tracking-status field. Store granted, refused or unknown per email address, with date and source.
3. Gate every open rule on that field. Rules that read opens apply only to tracked contacts. Route untracked contacts to a separate path that never reads silence as inactivity.
4. Set the unknown default on purpose. Decide by country and collection date, not by vendor default. Write the decision down.
5. Rebuild sunsets on human actions. Use replies, logins, purchases and form fills across channels, as Kath Pay argues in MarTech. Before suppressing an untracked contact, send one pixel-free reconfirm email with a clear link.
6. Replace resends and open branches with fixed schedules. One planned follow-up for everyone costs less than a resend aimed at people who already read.
7. Relabel reporting. Show open rate on the tracked base with its size beside it, and report conversions per 1,000 delivered as the main number.

The broader point applies beyond France and Italy. Any rule that turns missing data into a judgement about a person will fail as measurement narrows. Build funnel decisions on actions people choose to take. If you want to see where your brand is visible and where your data has gone quiet, join the Ethos Engine waitlist.

Questions

Do email tracking pixels need consent in France and Italy?

In most marketing uses, yes. France's CNIL published its recommendation on 14 April 2026 and Italy's Garante set 29 October 2026 as the compliance date for its guidelines. Both require consent when a pixel tracks an individual reader. Each allows narrow exceptions, such as security, and they differ on deliverability and aggregate statistics.

Can I still run a sunset policy for French and Italian contacts?

In France, a sunset can run without consent if it keeps only the date of the last open and the emails were requested by the recipient. The Garante names changing send frequency by interest as a use that needs consent, and exempts only aggregate statistics. A sunset rule that works for both countries needs signals other than opens.

Is click tracking a safe replacement for open tracking?

Not by default. EDPB guidelines from October 2024 treat tracking links and pixels the same way under the ePrivacy rules. A CNIL representative has said tracking links face similar obligations. HubSpot switches click tracking off with open tracking by default. Treat individual clicks as the same consent question as opens.

What happens to open rates once some contacts are untracked?

It depends on the platform. HubSpot and Customer.io divide open rate by tracked emails only, so the rate holds but describes fewer people. Where the denominator includes untracked sends, the rate falls with no change in reading. Either way, the remaining tracked group is likely to skew towards your most engaged readers.

Sources

1. Garante per la protezione dei dati personali, Tracking pixel nelle e-mail garanteprivacy.it
2. CNIL, Recommandation relative aux pixels de suivi dans les courriers electroniques cnil.fr
3. CNIL, Pixels de suivi dans les courriers electroniques, vous devez etre mieux informes cnil.fr
4. EDPB, Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive, version 2.0 edpb.europa.eu:443
5. HubSpot Knowledge Base, Email tracking consent guidelines knowledge.hubspot.com
6. HubSpot Knowledge Base, Manage email tracking consent knowledge.hubspot.com
7. Klaviyo Help Center, How to manage open tracking help.klaviyo.com
8. Klaviyo, Tracking pixels in email, the new EU consent guidelines explained klaviyo.com
9. Customer.io Docs, Manage consent for open-tracking docs.customer.io
10. Adobe Experience League, Understanding CNIL's updated guidance on email tracking pixels (Journey Optimizer) experienceleague.adobe.com
11. Adobe Experience League, CNIL guidance, Conditional email open tracking (Marketo) experienceleague.adobe.com
12. Brevo, Email tracking pixels, France's CNIL recommendation on consent brevo.com
13. Litmus, Email client market share litmus.com
14. Apple, Mail Privacy Protection and Privacy apple.com
15. Studio Legale Privacy, Pixel di tracciamento nelle e-mail e la scadenza del 29 ottobre 2026 studiolegaleprivacy.com
16. Sbircia la Notizia, Pixel nelle email, le linee guida del Garante sbircialanotizia.it
17. De Gaulle Fleurance, Pixels de suivi dans les courriels et la FAQ du 22 juillet 2026 degaullefleurance.com
18. Badsender, Consentement au tracking email, comment s'adapter badsender.com
19. Postmastery, CNIL Recommendation on Email Tracking Pixels, What Changes and the Open Questions postmastery.com
20. Lewis Silkin, Tracking pixels in emails, a comparative analysis of the CNIL and Garante guidance lewissilkin.com
21. Mailgun, EU guide to tracking pixels mailgun.com
22. Scalero, What CNIL's deadline means for lifecycle teams scalero.io
23. Constant Contact Knowledge Base, The new EU consent guidelines and the impact on email open tracking knowledgebase.constantcontact.com
24. Astral, Email tracking pixels now require consent in France and Italy weareastral.co.uk
25. MarTech, How to create a re-engagement strategy that doesn't insult your subscribers martech.org

NEXT STEP

See where your brand stands.

Your Digital Authority Score, who AI recommends for your target questions, and the placements that close each gap. Your first report is free.

Get your free report →