If you send marketing email to contacts in France or Italy, the rules on open tracking have changed. You can still email your subscribers. But tracking whether they open now needs its own consent.
Here's what changed, what it means for you, and what SendX is doing about it.
What changed
France's data protection authority, the CNIL, published its recommendation on tracking pixels in email on April 14, 2026. The transition period ended on July 14, 2026. The rules are in force now.
Italy's regulator, the Garante, followed with guidelines of its own, published in the official gazette on April 29, 2026. The compliance deadline is October 28, 2026.
Both arrive at the same core rule. The tracking pixel, the tiny invisible image that reports opens, device, and location back to the sender, is treated like a cookie under ePrivacy rules. Using it for marketing purposes requires the recipient's prior consent.
What the rules actually require
Two separate consents.
A contact agreeing to receive your emails is one thing. Agreeing to be tracked is another. An opt-in to your newsletter doesn't cover the pixel.
Purpose matters.
Consent is required when tracking measures campaign performance, analyzes behavior, personalizes content or feeds profiling. It's the purpose that triggers the rule, not the technology.
Easy withdrawal.
Recipients must be able to withdraw open tracking consent as easily as they gave it, and without having to unsubscribe. Tracking and subscription are separate choices in both directions.
Proof.
You need a record of when and how each contact's consent was given or withdrawn.
What doesn't need consent
The exemptions are narrow:
Security and authentication emails, like password resets
Minimal deliverability tracking, only to spot inactive addresses and stop mailing them
Italy Only: Fully anonymized, aggregate campaign statistics, where the pixel is identical for every recipient and data is anonymized before storage. In France, this is treated as opening a back door for other purposes of tracking, which are not allowed.
If you're using opens to measure campaigns or trigger automations for individual contacts, that's consent territory.
Who's affected
Anyone sending marketing email to recipients in France or Italy. Where your company is based doesn't matter. The recipient's location does.
What SendX is building
We're making tracking consent a first-class part of SendX so contacts in regulated countries can opt out of tracking without unsubscribing.
The key part is we will treat .it and .fr domains as auto opt out. The Preference center will have a country drop down for all customers. Regulated countries will then see this opt-in option. Additionally, we will have a new 'Compliance' section in settings to identify the per country regulatory rules, link to the regulation, and the behavior in SendX.
A tracking-consent status on every contact, separate from subscription status, with a record of when and how it was set
Preference center controls, so your contacts can opt out of tracking without unsubscribing
Automatic pixel removal, at send time, for contacts who haven't consented
Country selection on signup forms, showing tracking-consent options for countries that require them
Bulk tools, to view, update, and export tracking-consent status across your list
A per campaign tracking toggle to better treat your specific segments of recipients
What you can do today
Start collecting tracking consent at signup.
Add a separate, unticked checkbox to your signup flow, with plain wording like "You can measure how I interact with your emails (opens)." Keep a record of it. Native SendX form fields for this are on the way. It will be possible to merge this information in bulk once shipped in SendX.
FAQ
Am I at risk right now?
France's rules are in force. Italy's bite on October 28, 2026. If you track French recipients without tracking consent today, you're outside the CNIL's recommendation. However, retroactive consent is allowed; therefore, nothing has to happen to the data you already possess.
Can I still email contacts who decline tracking?
Yes. Declining tracking doesn't unsubscribe anyone. You just won't see their opens and clicks. We still track delivery, bounce, unsubscribe and spam complaints.
Why doesn't SendX detect country by IP and opt people out automatically?
IP location is unreliable. VPNs, travel, corporate networks, and privacy proxies all break it. A declared country is defensible. A guessed one isn't.
What about a French contact using a gmail.com address?
The .fr/.it safety net won't catch them. They stay tracked until they declare a country or opt out. This is why collecting consent at signup and pointing contacts to your preference center matters.
What happens to my existing open and click data?
Nothing retroactive is required by these rules for data already collected. Going forward, collect only what you have consent for.
Does this hurt deliverability?
Maybe. The inclusion of tracking pixels is a highly debated topic among delivery professionals. We have conducted multiple tests to prove this either way and it's always been inconclusive. In any case, open tracking has been getting less reliable for years.
What about other countries, or US states?
Regulators elsewhere are watching this space, and so are we. We're evaluating state-level preferences for the US.
This is our reading of the CNIL and Garante guidance as email software makers, not legal advice. For your specific situation, talk to your counsel.
Sources:
CNIL recommendation (April 14, 2026) and official English translation. Garante guidelines (April 29, 2026).
https://www.iubenda.com/en/blog/garante-email-tracking-pixel-rules/
