Your open rate just got more complicated
If you send email to anyone in France or Italy, even a small handful of contacts, two new regulatory actions are about to change what you can track and what you need permission for. The rules will impact email open tracking the most.
France’s data protection authority (CNIL) and Italy’s data protection authority (the Garante) have each published new rules on tracking pixels, the tiny invisible images in your emails that may tell you when someone opened a message. Both regulators have landed on the same basic idea: a tracking pixel works like a cookie, so it needs the same kind of consent a cookie does.
This isn’t a reason to panic. But it is a reason to look at how you’re using open data and get your permissions in order before the deadlines hit.
The short version
- France: Guidance from the CNIL, not a binding law, but businesses are expected to follow it. Existing subscribers need to be told about tracking and given a way to opt out by July 14, 2026.
- Italy: A binding legal requirement from the Garante. Businesses have until October 28, 2026 to update their consent flows.
- Both apply if you have subscribers located in either country, no matter how small your list is.
What still doesn’t need permission
Not every use of open tracking is affected. Both countries carve out room for operational stuff. Keep in mind though, open rates are already unreliable due to Apple’s Mail Privacy Protection and Proxy opens. So, you could have a subscriber that opens every email you send and never know that they’ve opened it:
- Basic list cleanup. Using the date of someone’s last open to remove inactive contacts or slow down how often you email them. You can only keep the date, not the time or a history of opens.
- Security and authentication. Confirming a login code or password reset was opened on the right device.
- Anonymous, combined stats. Overall open rate numbers, as long as no individual is identifiable in the data.
- Legal proof. Confirming someone received and opened a notice you’re required to send.
If this is all you’re using open tracking for, you likely don’t need to change much beyond being transparent about it in your privacy policy.
What now needs a clear ‘yes’
Here’s where most small businesses will need to make changes. You now need separate, specific permission to use open data for:
- Optimizing your emails. Picking send times, personalizing content by device, or choosing which channel to use for someone who’s on multiple lists.
- Building a picture of someone’s interests. Using opens to trigger a follow-up email, segment openers from non-openers, or update what you think someone cares about.
- Catching fraud. Detecting fake contest entries or ad fraud tied to your sends.
France wants this permission kept separate from your general marketing opt-in. Italy allows it to be bundled with marketing consent, as long as the wording is neutral, but adds its own requirements, like letting people turn off tracking without unsubscribing entirely.
Why this matters even if you have a tiny list
It’s tempting to think rules like this are for big companies with large teams. They’re not. If even one subscriber lives in France or Italy, and you’re using your ESP’s default open tracking to make decisions about what to send them next, you are under the same obligations as a company with a million contacts.
Fixing this is mostly about adjusting your permissions, privacy policy, and segmentation. You need:
- A way to ask for tracking consent separately from your general opt-in
- A record of who said yes, and when
- A way to segment your list so tracking-dependent automations only run for people who’ve actually agreed to it
- A simple way for people to opt out of tracking without leaving your list altogether
If your re-engagement flows, your welcome series, or your segmentation depend on open rate data, you need a plan for what happens to the subscribers who haven’t consented. Segmentation is what keeps your automations compliant without breaking them for everyone.
What to do this week
- Check whether you have subscribers in France or Italy.
- Look at what you’re actually using open data for. List cleanup only, or also personalization, automation triggers, or profiling?
- If it’s the latter, start building a separate opt-in for tracking, not bundled into your general marketing consent.
- Talk to whoever manages your privacy policy and data retention practices about updating it to reflect pixel use.
Get help sorting out your permissions and segments
Little Nudge Marketing can help you build a preference center, segment your audience, and adjust your automations so you’re meeting French and Italian requirements. If you need help understanding where to start, let’s talk.
