For years, email tracking had a pretty simple job. Someone opened an email. A pixel recorded it. Your marketing automation platform logged the engagement. A score moved. A workflow fired. Maybe sales got an alert.
Nothing particularly exciting.
Then comes the question that changes the whole equation:
Were you allowed to track that person in the first place?
France’s CNIL published its final recommendation on email tracking pixels in April 2026. Italy’s Garante followed with guidance of its own. Both put clearer conditions around how individual email behavior can be tracked, when consent is required, and how people should be able to control that tracking.
And this is where it stops being a privacy-team conversation. Because the pixel is only the first domino.
If your CRM, scoring model, segmentation, nurture logic, and reporting all use the data that pixel creates, your tracking rules just became workflow rules.
So, What Actually Changed for Email Tracking?
Email tracking pixels have not suddenly been banned. The more useful way to think about the 2026 guidance is that you can no longer assume every missing engagement signal means the same thing.
Depending on the jurisdiction, purpose, and applicable exemption, individual tracking may require consent.
Which means a missing open could mean:
They did not open the email.
Or:
You were not tracking the open.
Those are two very different data points. Your marketing stack needs to know the difference.
This Is Where Lead Scoring Gets Interesting
Take a rule that exists in thousands of marketing automation setups:
No email open for 60 days → subtract engagement points.
Seems reasonable.
Except now imagine the recipient can still receive your marketing emails but their individual opens are not being tracked.
Your system sees:
0 opens.
Then it does exactly what you told it to do.
The score drops.
The contact lands in an inactive segment.
A re-engagement sequence starts.
Sales deprioritizes the account.
Everything worked perfectly.
And the conclusion was still wrong.
Because your system turned “we don’t know” into “they’re not interested”.
That is the bit marketing teams need to fix.
The logic can no longer simply be:
No open → disengaged
It needs another check first:
Was this person eligible to be tracked?
If yes, evaluate the permitted engagement data.
If no, that signal is unavailable. Do not quietly convert it into a negative one.
And once you see it that way, this stops being an email setting.
It touches scoring, segmentation, automation, reporting, lifecycle logic, and potentially sales prioritization.
Is Marketing Consent the Same as Tracking Consent?
Not necessarily. And this is also where a neat little global field called “Email Opt-In = Yes” starts looking a lot less neat.
France and Italy do not take identical approaches to every scenario.
France’s CNIL sets out when consent is required and defines limited circumstances where certain uses can qualify for exemptions.
Italy’s Garante also requires consent for many tracking uses but allows communication and tracking consent to be collected together in certain circumstances when the individual has been properly informed. It also requires people to have granular control over withdrawing tracking while continuing to receive emails.
So, there is no useful universal rule that says:
Subscribed = track everything.
Your privacy or legal team needs to determine what applies to your organization. Then your MarTech stack needs somewhere to put that answer.
Depending on the setup, that could mean tracking:
- Marketing communication permission
- Tracking preference
- Jurisdiction
- Consent source
- Consent date
- Consent version
- Withdrawal status
- Permitted tracking purposes
The exact fields will vary. The principle does not:
Your systems need to know what they are allowed to do before they do it.
And What Happens When Someone Changes Their Mind?
This is where a checkbox can give everyone a false sense of accomplishment.
Someone withdraws tracking consent. Great. The preference center recorded it.
Now what?
- Did the email platform get the update?
- Did the CRM?
- Did your marketing automation platform?
- Will tomorrow’s email still include the same tracking?
- Will the lead score still use historical open behavior the same way?
- Will another integration overwrite the updated preference overnight?
That is the real implementation problem. Both CNIL and Italy’s Garante address the ability to withdraw tracking choices, including scenarios where someone stops individual tracking but continues receiving email.
So, recording the preference is step one. Making the rest of the stack respect it is the actual job.
Do You Need to Stop Using UTMs?
No.
And this distinction is worth making because open tracking, click tracking, and campaign attribution tend to get thrown into one very large privacy bucket.
They are not the same thing.
- Open tracking: A tracking pixel can tell an email platform whether an individual email was opened.
- Individual click tracking: Your email platform may rewrite a link or attach an identifier that allows a click to be tied back to a specific recipient.
That needs its own assessment.
CNIL’s July 2026 FAQ specifically notes that tracking links are not directly covered by its email-pixel recommendation, while also pointing out that they can involve accessing or writing information on a user’s device and therefore still need to be considered under applicable tracking rules.
UTMs
A URL like:
utm_source=email
utm_medium=email
utm_campaign=fintech_2026
does something different.
It helps your analytics setup understand:
This traffic came from the FinTech email campaign.
That is campaign attribution.
It is not inherently the same thing as saying:
This specific recipient clicked at 11:43 a.m.
So no, the answer is not to bin your UTMs.
And it is not:
Fine, we’ll just stop tracking opens and use clicks instead.
That just moves the question. The useful question is:
What exactly are we collecting at each point in the journey, why are we collecting it, and what should the person’s consent state allow us to do with it?
That gets you somewhere.
What Does a Consent-Aware MarTech Stack Actually Look Like?
This is where regulation meets reality.
Your privacy team might determine:
Do not track this recipient unless condition X is satisfied.
Perfect. Now someone has to make that work across the tech.
- Where is the consent stored?
- Which platform owns the source of truth?
- How does your email platform receive it?
- What happens after withdrawal?
- Does the CRM update?
- Does your preference center stay in sync?
- Do your scoring rules understand when an open is unavailable?
- Do your dashboards distinguish not engaged from not tracked?
- Do old automations still use logic written when none of this distinction existed?
That is the implementation layer. And it is exactly why we would treat this as a platform-agnostic MarTech problem rather than an email-platform setting.
1. Trace Where the Data Actually Goes
Start with the pixel. Then keep going.
Email platform → CRM → marketing automation → CDP → analytics → scoring → reporting
An open rarely stays an open.
It becomes a score.
A segment.
A trigger.
A dashboard metric.
A sales signal.
Before changing anything, understand every place that data is being used to make a decision.
2. Give Consent a Proper Data Model
You need a reliable answer to a very simple question:
What can we track for this person right now?
That answer may live in CRM properties, consent objects, preference records, or several synchronized systems. How you build it depends on the stack.
What matters is that downstream platforms can actually interpret it. A consent field nobody checks is just documentation.
3. Make the Preference Change Something
Forms and preference centers should not merely collect a choice. That choice needs consequences.
If someone withdraws tracking consent, the relevant tracking should stop.
If another system depends on that preference, it should know.
If a workflow relies on data that is no longer available, the workflow needs another path.
Otherwise, your front-end consent experience and your back-end marketing behavior are telling two different stories. That is not a great place to be.
4. Revisit Every Workflow That Uses Email Engagement
This is probably where the most hidden problems will sit.
Look for anywhere an open, non-open, or other tracked behavior changes:
- Engagement scores
- Contact segments
- Account segments
- Lead stages
- Lifecycle stages
- Re-engagement
- Send frequency
- Sales alerts
- Sales prioritization
- Reporting
Then ask:
What does this rule do when the engagement signal simply isn’t available?
That one question can expose a surprising amount of broken logic.
5. Separate Opens, Clicks, UTMs, and Website Tracking
Please do not call all of this “email tracking” and move on.
Map each piece separately:
- Open pixels.
- Individually tracked links.
- Campaign UTMs.
- Website analytics.
- Advertising pixels.
- CRM visitor identification.
- Consent management.
They may sit in the same customer journey but they do not all do the same thing.
You can preserve useful campaign measurement without blindly carrying over every piece of individual-level tracking.
6. Your Existing Database Counts Too
Changing the form today does not magically clean up everyone who entered your database yesterday.
France’s CNIL included a transitional approach for addresses collected before its April 14, 2026 recommendation, with specific conditions around informing existing recipients and giving them an opportunity to object.
Italy’s Garante provided a six-month implementation period following publication of its guidelines.
So, your existing database needs attention too.
Different contacts may have entered at different times, under different notices, from different jurisdictions, with different preference histories.
Treating the entire database as one consent state is the easy option. It is not necessarily the right one.
7. Test What Happens Five Systems Later
Do not just test whether the checkbox saves correctly. Create contacts representing the consent states your business actually supports.
Then follow them.
- Does the email contain tracking?
- Does withdrawal propagate?
- Does the CRM retain the right value?
- Does an integration overwrite it?
- Does the scoring model behave differently?
- Does the contact enter the correct segment?
- Does the dashboard know the difference between a missing signal and a negative one?
This is where you find out whether your consent architecture exists only on paper or actually works.
No, You Probably Do Not Need a New MarTech Stack
HubSpot. Salesforce. Marketo. Braze. Klaviyo. Or a stack held together by several of them.
The implementation details will differ. The job does not.
- Collect the right choice.
- Store it correctly.
- Pass it between systems.
- Enforce it where tracking happens.
- Respect withdrawal.
- Make your automation understand what the data actually means.
Your privacy and legal teams should determine the requirements that apply to your organization.
Growth Natives can help make those requirements work inside your technology: across forms, preference centers, CRM properties, consent data models, integrations, email configurations, workflows, scoring, and reporting.
Because knowing what the rule says is one thing. Knowing whether the fifteen workflows downstream got the memo is another.
If your email tracking rules have changed but your CRM, scoring, and workflows are still running on the old logic, that is where the real problem starts.
Email us at info@growthnatives.com. Our MarTech team can help you trace where consent, tracking, and engagement data move across your stack and rebuild the logic so your systems act on the right signals.
[This article provides general information about MarTech implementation and is not legal advice. Organizations should work with qualified privacy or legal counsel to determine the requirements that apply to their specific circumstances.]
Sources Cited:
https://www.stoneshot.com/blog/pixels-need-permission-eu-email-tracking-rules/
https://maciejturek.com/resources/email-tracking-pixel-consent-rules.html