Email open tracking now needs consent in France and Italy

On 2 July 2026, HubSpot wrote to account admins about new French and Italian guidance on email tracking pixels. That email looked like a platform update, but it is bigger: two European regulators have moved email open tracking into consent territory.

This is not legal advice. Treat this as a marketing operations translation of the guidance, and involve your data protection officer (DPO) or legal counsel before changing your consent model.

What did the CNIL decide about email tracking pixels?

The French data protection authority CNIL treats email tracking pixels as access to the recipient's terminal under the ePrivacy rules, the same legal logic that governs cookies. A pixel that identifies the recipient and reports email opens generally requires prior consent unless a narrow exemption applies. France's regulator published its new guidelines for email tracking pixels on 14 April 2026.

Three points matter for anyone running a marketing automation platform:

• Consent to receive an email is not automatically consent to be tracked inside it.
• Transactional emails are not automatically exempt.
• The sender remains responsible as controller. The CNIL is explicit that contractual assurances from your email service provider are not enough.

This means a generic newsletter opt-in no longer authorises open tracking. Pixel consent must be purpose-specific and clearly explained. Where email marketing and tracking serve genuinely related purposes, the CNIL leaves some room for a single informed consent, but analytics, profiling, scoring and behavioural segmentation need particular care.

What are the Garante's rules on tracking pixels?

Italy's Garante also treats tracking pixels as cookie-like technology requiring prior consent. The regulator adopted Provision No. 284 on 17 April 2026, and publication in the Gazzetta Ufficiale on 29 April 2026 started a six-month adaptation window.

Italy takes a more pragmatic line on the consent moment: tracking consent may be bundled with newsletter or marketing consent, provided the user is properly informed. As in France, the adaptation window covers addresses collected before publication; new collection should be handled compliantly from the start. But Italy is demanding on the exit: withdrawal must be granular. A recipient should be able to opt out of tracking while continuing to receive the newsletter. If your platform cannot separate "receives the email" from "is tracked in the email", that is the gap to close.

What is the deadline for email tracking consent in France and Italy?

Strictly, this is an ePrivacy issue rather than a GDPR one: the pixel sits under the terminal access rules the EDPB clarified in Guidelines 2/2023. The GDPR still governs consent quality and everything you do with the data downstream.

Permission to email is not permission to track

Permission to receive an email is not a blank cheque to track how it is read. Both regulators draw the same line: consent to send covers the message, consent to track covers the measurement. The transactional edge case follows. Order confirmations and service notices may be sent without marketing consent, but that does not automatically authorise a pixel inside them. Review those templates with the same discipline as campaigns.

Why your platform does not save you

Most major email and sales engagement platforms rely on per-recipient open tracking pixels; HubSpot and Marketo document this explicitly. This article details those two because that is where my architect-level knowledge sits, but the rules do not care which logo is on the platform. Salesforce Marketing Cloud, Account Engagement, Eloqua, Braze, Klaviyo, Mailchimp and every sales engagement tool with open alerts embed the same mechanics and need the same audit before anyone assumes compliance.

HubSpot documents that it tracks opens with an invisible one-pixel image: on by default for marketing email, with account-level controls, and one-to-one sales tracking configured separately. Marketo documents the same mechanism: an invisible pixel in HTML emails by default, controllable at email, program or API level.

None of that transfers responsibility: the platform provides the mechanics, the sender controls purpose, consent and downstream use. An ESP assurance is not a consent record.

Does this affect reporting and lead scoring?

Yes, both. The consent requirement attaches to the pixel itself, the moment it can fire from the recipient's mail client. What you do with the open data afterwards decides how much of your stack is exposed.

The universal case is reporting. Open rates, email performance dashboards, subject line A/B tests, send-time optimisation and engagement analytics are all built on per-recipient open events. Every percentage on those dashboards starts as an identified recipient opening an email. Only Italy's exemption covers genuinely aggregate measurement, and it expects a shared campaign pixel rather than per-recipient tracking.

The sharper case is scoring. Fewer teams score on opens than the panic suggests, but where opens do feed a scoring model, engagement programme, sales alert or inactivity rule, open data has been turned into intent. That goes well beyond deliverability, and it is where remediation takes the most work. In mature Marketo Engage instances in particular, open-based logic tends to be years of accumulated Smart Campaigns rather than one setting.

How to change your stack

The pattern is the same everywhere: find the tracking switches, put consent in control of them, and clean up whatever feeds on the data. Expand your platform.

How do I make HubSpot email tracking compliant?

• Review marketing email open and click tracking settings at account level.
• Review one-to-one sales email tracking separately; it has its own settings and often its own team.
• Check whether your GDPR functionality and legal basis fields cover tracking consent, not just email subscription consent.
• Segment France and Italy where needed.
• Suppress tracking for contacts without valid tracking consent.
• Remove opens from scoring, workflows or lists where consent is missing.

Do not only check whether tracking is on; check whether consent decides when it is used.

Open your marketing email tracking settings →
Open your Log and Track settings →
HubSpot knowledge base: consent requirements →

No Super Admin bandwidth? Your local HubSpot partner, such as iO Digital or Social Brothers, can run this check with you.

How do I make Marketo open tracking compliant?

• Audit email open tracking settings and templates.
• Search Smart Campaigns for "opens email" as a trigger or filter.
• Review Score Change rules and Engagement Program progression that use opens.
• Review inactive-contact logic based on non-opens.
• Create consent-driven suppression or segmentation for France and Italy.
• Replace open-based intent with stronger signals: clicks, form fills, event attendance, sales-qualified activity.

For a per-recipient no-pixel route, use Sanford Whiteman's selective tracking pattern: disable open tracking on the email, then re-insert the pixel conditionally with Velocity logic keyed to a consent field. The same approach selectively untracks links. Advanced template work; have a Marketo architect review it before rollout.

Adobe docs: open tracking settings at admin level →
Adobe docs: disable tracking for an email link →

Want your settings, preference centre or consent model reviewed by someone fully EU-based? Get in touch, or work from a defined scope with the Consent & Tracking Readiness Pulse, a fixed-scope audit of exactly this. Reviewing Marketo instances is what I do.

Salesforce, Eloqua, Braze, Klaviyo, Mailchimp and the rest

The same audit, compressed:

• Locate the open tracking pixel setting.
• Check whether tracking can be suppressed by consent, country, segment or email type.
• Identify whether opens feed scoring, attribution, engagement analytics or sales alerts.
• Create a no-pixel route for non-consented contacts where required.
• Separate marketing consent from tracking consent where needed.
• Enable granular withdrawal where needed.
• Remove or quarantine opens from scoring for contacts without valid tracking consent.

What is the deliverability exemption?

Both regulators leave room for consent-free pixel use for deliverability, and both draw it narrowly. The CNIL accepts tightly limited uses: adjusting sending frequency, stopping sends to inactive recipients, minimal data such as a last-open date, and no repurposing for analytics, scoring or profiling. Italy is narrower still: aggregate, anonymised statistics with one shared campaign pixel rather than per-recipient tracking. The Garante also leaves consent-free room for two niches outside marketing: pixels that help secure user authentication, and messages the sender is legally required to send, such as mandatory banking communications or security incident notifications.

The implication: if open data feeds reports, scoring, nurture progression or sales alerts, it is unlikely to fit either exemption. Treat that as risk to review with your DPO, not as a settled conclusion.

The consent model that works in both countries

France is strict on the consent moment, Italy on the withdrawal. For senders active in both countries, the safest operating model is the union of both regimes: purpose-specific tracking consent, a no-pixel route for non-consented contacts, and granular withdrawal that lets someone keep receiving the newsletter without being tracked at open level.

Add country-sensitive logic for France and Italy, and put the whole model in front of your DPO before rollout.

Through the Value Gravity™ lens, this is foundation-layer work: consent, governance and data architecture decide whether a regulatory change becomes a clean configuration update or an operational scramble. Open tracking is the symptom. The real question is whether the foundation layer knows which signals the business is allowed to use.

HubSpot's separate enrichment data pooling change pulls on the same raw material: email engagement signals such as delivered, bounced, opened and clicked. Whether that use fits the exemptions above is a question for your DPO. Read the companion analysis on HubSpot's enrichment data pooling.

Run the pre-check

This free, ungated self-assessment matches the sections above. Answer the questions for insight into where you stand, plus a copyable brief for your DPO or legal counsel.

What to do now

Before 14 July 2026

• Identify French recipients across every sending system.
• Inform existing recipients where needed.
• Give a real chance to object to tracking.
• Stop using non-consented open data for scoring or profiling.

Before 28 October 2026

• Identify Italian recipients.
• Implement granular withdrawal: keep the newsletter, drop the tracking.
• Review aggregate versus per-recipient tracking.
• Align deliverability reporting with the Garante standard.

This quarter

• Audit everywhere opens feed reports, scoring, workflows or alerts.
• Replace weak open signals with stronger engagement signals: clicks, form fills, demo requests, event attendance, sales-qualified activity.
• Document the consent logic and the decision trail.
• Involve legal or your DPO before rollout.

Deliverability specialists have argued for years that opens are a weak signal anyway. The regulators have now added a legal reason to do what the data already suggested: teams that replace open-based intent with stronger signals end up with a more honest funnel, not just a compliant one.

And if you want a sparring partner for your preference centre, consent setup or the marketing ops side of this in Marketo or HubSpot, get in touch. Happy to take a look, and fully EU-based.

Prefer to work from a defined scope? The Consent & Tracking Readiness Pulse is the hands-on version of the checklist above: a fixed-scope Marketo audit for teams emailing France or Italy, with a readiness report, action brief and DPO-ready pack in three working days.

Primary sources: the CNIL recommendation (with an official English translation, PDF) and Garante Provision No. 284. For a legal comparison of the two regimes: Lewis Silkin, Covington's Inside Privacy and iubenda.