Should you email your whole marketing database about tracking pixels, like Disney did? Usually not. The trigger is the email tracking consent guidance regulators in France and Italy issued this spring, the CNIL’s recommendation and the Garante’s provision. The decision it forces is narrower: who is in scope, whether tracking is actually on, and whether consent can control the pixel. The implementation detail lives in the how-to; real examples live in the field review; this page is the decision companion. Marketing operations view, not legal advice.
The decision path
How to read it: unknown-location contacts count as in scope, under-inclusion is the expensive error. The side exits are real outcomes, not failures; "no pixel route" with evidence is a perfectly good place to stand. And the routes combine: most in-scope senders run notice-plus-objection for the existing base, opt-in for new signups, and the off switch for whatever the machinery cannot yet enforce.
Missed 14 July? Switch tracking off first
The CNIL’s practical window for informing existing French recipients closed on 14 July. If you still reach French recipients and did nothing, do not start with a rushed, tracked notice. First stop non-exempt open and click tracking for the affected segment; one setting, and the ongoing exposure ends (the how-to maps the switches per platform). Then send the notice, untracked, document the dates, and ask your DPO or legal whether non-response can support future tracking. The operational difference is simple: "still tracking, then emailing" looks worse than "stopped, then informed".
The routes
Existing French base: notice plus objection. The mechanism France designed for addresses collected before the rules, and what nearly every sender in the field review chose. It does not re-permission the list: nobody is unsubscribed, objectors keep receiving email untracked. The price is operational, the objection must actually work: a field that records it, a segment that reads it, a send path without the pixel.
Signed up after 14 April, before you fixed the form: the gap cohort. The transition route only covers addresses collected before the recommendation was published on 14 April 2026. Anyone who signed up after that date without purpose-specific tracking consent has nothing to transition: no valid consent exists, and the objection route was not designed for them. Treat them as new signups whose consent is missing, no pixel until they actively opt in, and fix the form first, because every unfixed day grows this cohort. One segment on signup date separates the buckets.
New signups: fresh opt-in. A purpose-specific choice at the form, before the pixel goes in. Also the route for missing or unclear consent, and for any use where the transition route is not available or not accepted by your legal team. As a blanket campaign over the existing base it is almost always the wrong tool: silence means loss, and silence is the default behaviour of every inbox.
Cannot enforce: off until fixed. If no consent field can control the pixel per send, switch tracking off and rebuild on clicks, replies and conversions. Opens were a polluted signal long before they were a regulated one; Apple Mail Privacy Protection saw to that. Off now means off until consent decides, not off forever.
Italy: planned, not panicked. The window runs to 28 October 2026. The Garante accepts tracking consent bundled with marketing consent for properly informed recipients, and demands granular withdrawal: the newsletter survives, the tracking stops. Build it once, correctly, before October.
If you send a notice, send an exemplary one
Five requirements, compressed from the field review. Say what tracking does, purposes separated. Offer one clear action, a single objection button, not a tickbox behind an unsubscribe flow. Promise explicitly that the emails survive the objection, the sentence most notices forget. Say what happens to data already collected. And send it without a tracking pixel, because a tracked email about tracking consent is a self-own your sharpest recipients will notice.
Behind the interface: a persistent tracking-consent field synced to CRM, a no-pixel route, preference sync across every sending system including one-to-one sales email, and opens suppressed from scoring for objectors. The free pre-check maps which of these you have, seven gates, three minutes, no email address needed. When the decision needs verifying against your actual instance, the Consent & Tracking Readiness Pulse is the fixed-scope audit: readiness report, action brief and DPO-ready pack in three working days.
Frequently asked questions
Is a notice with an objection option enough, or do we need fresh opt-in?
For French addresses collected before the CNIL recommendation, the transition route was notice with a real chance to object. After 14 July, late senders should treat that as remediation: switch tracking off first, send the notice without tracking, and ask DPO or legal how to treat non-response. Fresh opt-in is for new signups, missing or unclear consent, and any use where the transition route is not available or not accepted by legal.
What about contacts whose country we cannot determine?
Treat them as in scope. Senders like Disney rolled their notice out EU-wide precisely because location data is unreliable; under-inclusion is the expensive error, over-inclusion costs one extra email.
We kept collecting signups after 14 April. Which bucket are they in?
Neither, strictly: they are the gap cohort. The transition route covers addresses collected before the CNIL recommendation was published on 14 April 2026; later signups needed purpose-specific consent at the form. If they did not get that choice, there is no valid tracking consent to rely on, so keep the pixel off for this group until they actively opt in. Segment on signup date, fix the form, and the cohort stops growing.
Can we turn tracking back on later?
Yes, where tracking consent exists, or where DPO or legal accepts the notice-and-objection route for the relevant audience. The system must enforce it: a consent field, a segment, and a no-pixel route for everyone else. Off now means off until consent decides.