Nearly every newsletter sent by a company contains, in all likelihood, an image that no one sees.
It’s the size of a single pixel, it’s transparent, and when the message is opened it tells the sender who opened it, when, and on which device.
In inspections carried out between October 2025 and February 2026, the Authority found it in nearly all the campaigns examined.
As of October 29, 2026, that image is subject to precise rules.
Here’s the curious part: the data it produces has long been less reliable than it appears.
Compliance thus becomes an opportunity to measure email marketing on what truly matters: people’s actions.
This article offers general guidance to help you navigate the topic. Each company should check with its own lawyer or DPO on how to apply it to its specific case.
What is a tracking pixel in emails
How it works
The tracking pixel is a single-pixel image, hosted on the sender’s server rather than inside the message.
When the email program downloads images, it requests that file from the server: the request itself signals that the email has been opened. Anyone reading in plain text, or who keeps images blocked, leaves it inactive.
It’s a close relative of the Facebook pixel, which measures actions on a website for advertising campaigns: same principle, different context. Here we’re talking only about email.
What it records
Besides the opening itself, depending on the configuration: IP address, device and email client type, number of subsequent opens, and time of reading.
Sending platforms link this data to each contact’s profile and often use it to trigger automations: a reminder for those who haven’t opened, a higher score for those who open frequently.
Why the Authority considers it invasive
The key issue is its hidden nature: the recipient doesn’t see it and is often unaware it exists.
The Authority’s guidelines (ruling no. 284 of April 17, 2026, published in the Official Gazette on April 29) trace it back to Article 122 of the Privacy Code, the same rule that governs cookies.
Inserting the pixel and reading its response means, in effect, accessing the recipient’s device.
Is consent required for the tracking pixel in emails?
Yes, in most cases.
According to the Authority’s guidelines (ruling no. 284/2026), a pixel that records individual recipients’ opens for marketing purposes requires prior, informed consent, which may be combined with consent for promotional communications.
Anonymous statistics, certain security emails, and mandatory communications remain exempt.
When it’s required
Consent is required whenever the pixel measures an individual person’s behavior: profiling, campaign personalization based on opens, lead scoring, or automations triggered by an open.
In these cases, consent is the standard condition for using the pixel, and email marketing without tracking consent remains possible only with the pixel turned off.
The exceptions: anonymous statistics, security, service
The guidelines identify three situations in which consent may not be required:
- aggregate statistics, when the pixel measures only the overall open rate, is identical for all recipients of the same campaign, and technical data such as IP address and email client are anonymized;
- security, to verify that an account activation or password change email has been opened on a recognized device;
- mandatory communications, such as security incident notifications, phishing alerts, and contract changes.
The statistical exception has one precise technical condition.
Many platforms record the open on the individual contact’s profile: the data originates as individual, even when the person using it looks only at the total.
Existing lists
For contacts collected before the guidelines took effect, the notice can be provided with the next relevant send, along with the option to revoke tracking.
For new addresses, consent must be collected before sending emails with the pixel, preferably in the sign-up form and immediately after the privacy notice.
Notice, consent, revocation: what changes for senders
Layered privacy notices
As with cookies, the Authority encourages a layered notice: a clear summary in the form where the address is provided, with a link to the full text. The full text can be included in the cookie policy already present on the site.
Consent combined with marketing consent
Consent to the pixel can be included within consent to promotional communications: a single checkbox instead of two, to avoid repeated requests that discourage sign-ups. The condition is that the request be worded neutrally and that the notice explicitly state that the emails contain tracking tools.
Revoking tracking alone, without unsubscribing
This is the most concrete change.
Every email offers a link or icon in the footer allowing recipients to choose between two options: stop receiving communications, or continue receiving them without the pixel. The sender records each choice, so it can be demonstrated, and those who decline tracking receive the same service as everyone else.
Settings matter more than the platform
Compliance depends on how the sending tool is configured, more than on the provider’s name.
The guidelines distinguish between roles: the sender decides the purpose and the tracking, while the platform acts according to the sender’s instructions. The choices therefore remain the sender’s responsibility.
What to check in any tool
- Whether open tracking is enabled by default, and where it can be turned off.
- Whether the setting applies per sending domain, per campaign, or per individual contact.
- Whether the platform can send a pixel-free version to those who have revoked tracking.
- Whether the pixel’s address uses an internal, non-sequential identifier instead of the email address.
- Whether a log exists of the preferences expressed by each contact.
Automations triggered by opens
Before turning off the pixel, it’s worth mapping the workflows that use it: welcome sequences that change path when an email remains unopened, lead scores, lists of contacts considered inactive.
Once the pixel is off, those workflows stop silently. They need to be rebuilt around clicks or actions taken on the website.
The HTML source test
After every change, a simple check is needed.
Send a test email to yourself, open the message source, and look for a 1×1 pixel image pointing to the provider’s address.
This confirms that the setting has actually removed the pixel, rather than simply hiding its data.
Click tracking works through a different mechanism: links pass through an intermediate address before reaching their destination. How the guidelines apply to this technique is a point to check with your own legal counsel.
How do you measure email marketing without the open rate?
It’s measured by what people do after reading: clicks on links, conversions on the website, revenue generated by each send, direct replies, and unsubscribe trends.
These are more reliable figures than opens, which many email programs distort by downloading images in advance, and they allow a campaign to be evaluated without recording when a person reads it.
Direct mail already did this
Anyone who has worked with direct mail knows this method.
The envelope arrived at home and no one knew whether it was opened: what counted were reply cards, phone calls, orders with the campaign code. The principle remains the same, because the response matters more than the reading.
What changes is the speed: the data arrives in hours instead of weeks and can be compared campaign by campaign. For decision-makers, the practical consequence is this: an email is evaluated like a mailed piece, for what it produces.
Clicks and conversions
The click-through rate shows how many people found a reason to act.
With UTM parameters on links, website analytics show what happens next: pages viewed, forms submitted, purchases made. The path from click to outcome is the information that truly matters for deciding the next send.
On this basis, at Factory Communication we have disabled open tracking pending further technical review, and we measure our communications on clicks.
Revenue per send and list quality
For those who sell online, revenue per email sent is the key metric; for those who sell through a sales team, appointment requests and replies matter most. List health is read through bounces, unsubscribes, and spam reports: when these rise, it’s time to rethink the message or frequency.
Inbox placement is also worth monitoring, starting with domain authentication via the DMARC protocol.
In the FARO by Factory method, this is the work of the Optimize and Amplify phase: you decide in advance what to measure, then improve with every send.
Seven-step compliance checklist
Whether you manage the sending of a professional newsletter in-house or through a provider, the steps are the same.
- List the types of emails you send and, for each, the purpose of the pixel.
- Check which automations, scores, or lists depend on the “email opened” event.
- Update your privacy notice to explicitly mention the tracking pixel.
- Update your sign-up forms with a marketing consent that covers the pixel, worded neutrally.
- Add a link in every email footer to manage tracking, separate from unsubscribing.
- For existing lists, prepare the notice to include in the next relevant send.
- After every change, check the HTML source of a test email.
In the PDF version, each step has space to note who is responsible and when it was completed.
Frequently asked questions about email tracking pixels
It’s a transparent, single-pixel image, hosted on an external server, that is downloaded when the email is opened.
The download notifies the sender that the email was opened and can transmit data such as IP address, device, and time.
It’s permitted under specific conditions: a clear notice and, except where exemptions apply, prior consent.
The Authority’s guidelines treat it like cookies: a lawful tool when the person knows it’s there and has been able to choose.
For promotional emails, a single consent covering both marketing and the pixel is sufficient, provided the notice mentions tracking and the request is worded neutrally.
Revocation, however, remains separable: you can opt out of the pixel alone while continuing to receive the emails.
For processing already underway, the guidelines allow the notice to be given with the next relevant send, along with the option to revoke tracking.
It’s advisable to prepare a clear notice to include in the next communication.
What matters is the purpose of the pixel more than the type of email. The guidelines exempt security checks, such as account confirmation or password changes, and mandatory communications.
A pixel used for profiling within an order confirmation, however, follows the consent rule: this case should be assessed with your own legal counsel.
You’re giving up data that was already unreliable: many email programs download images in advance and register opens that never actually happened.
Clicks, conversions, and revenue remain available and describe campaigns more accurately.
Click-through rate, conversions generated by links, revenue per email sent, direct replies, unsubscribes, and spam reports.
Together, they describe people’s genuine interest and the health of the list.
The sender, who decides the purpose and method of tracking.
The platform provider acts according to the sender’s instructions: roles are defined in the contract, and settings are the sender’s responsibility to check, since many platforms enable the pixel by default.
Download the compliance checklist
Seven steps on a single page, to share with whoever manages your email sends and with your privacy consultant.
If you want to set up a system that measures results while respecting people, you’ll find the method and services on the page dedicated to email marketing for businesses and SMEs.