- Product
- Increase Client Engagement
- Elevating the Client Experience
- Minimize Operational Inefficiencies
Product Features
Client Outcomes
Discover the three pillars that drive everything we do.
- Services
- Increase Client Engagement
- Elevating the Client Experience
- Minimize Operational Inefficiencies
Professional Services
Client Outcomes
Discover the three pillars that drive everything we do.
- Resources
- Increase Client Engagement
- Elevating the Client Experience
- Minimize Operational Inefficiencies
Resources
Client Outcomes
Discover the three pillars that drive everything we do.
Email Tracking Pixels Now Require Consent in France and Italy
Email tracking pixels are now treated like cookies under GDPR and the ePrivacy Directive, which means consent and documentation matter more than they used to. ConsentTrack tracks each contact exactly as far as their consent allows, without losing your campaign-level view.
Inside the CNIL and Garante Guidance
Consent to receive marketing emails is not consent to be tracked inside them. The CNIL and the Garante have both made this clear this year. Neither wrote a new law; instead they set out how existing GDPR and ePrivacy rules apply to email tracking pixels. A pixel is treated like a cookie, so it needs its own consent unless a narrow exemption applies. If you email contacts in France or Italy, check now whether you hold both permissions. If you only hold the first, your open tracking needs to change before your next send.
France's CNIL deadline was July 14, 2026, and has already passed, with a narrow exemption for deliverability purposes only. Italy's Garante deadline is October 28, 2026, and its exemption is narrower still, limited to aggregate, anonymized statistics. Both expect consent withdrawal to be easy, including retroactively for emails already sitting unopened.
Three Gaps Most Compliance Teams Are About to Discover
1. One Consent Record, Doing Two Jobs
Most CRMs and ESPs store a single marketing opt-in and treat it as covering tracking too. Under both rulings, that distinction now matters. If tracking consent and email consent aren't separated in your own records, that's worth a closer look.
2. No Audit Trail on Withdrawal
It's not enough to stop tracking someone going forward. The guidance points toward a documented, timestamped record of when consent was given or withdrawn, and evidence that the withdrawal actually took effect, including for messages already sent.
3. Multi-Jurisdiction Lists Need More than One Setting
A single send to a mixed list of UK, French, and Italian contacts may need three different tracking treatments at once, and most platforms only offer one setting per campaign.
What "Compliant" Actually Looks Like
The rulings don't ask you to abandon email measurement, just to justify it, limit it, and document it well enough to hold up under scrutiny. Exactly what this means for your organization depends on your own audience, but here's a good starting point.
- Identify your in-scope contacts. Pull a list of everyone you have in France and Italy, and check that your CRM records reflect where each contact is based.
- Separate tracking consent from marketing consent. Signup forms and preference centers need to ask for these as two distinct permissions, not one checkbox covering both.
- Give people a way to opt out of tracking without unsubscribing. Both regulators expect this to be independent of the marketing subscription itself.
- Run a notice or re-permission pass on existing contacts. For anyone already on your list who hasn't been asked about tracking specifically, a one-time notice explaining the change and offering an easy opt-in closes the gap.
- Update new-contact intake. Any signup form, landing page, or CRM integration that adds French or Italian contacts going forward should capture tracking consent from day one, not as an afterthought.
How StoneShot ConsentTrack Meets This
ConsentTrack was built in 2018, well before this became a regulatory question. The architecture that solved that problem is the same one that satisfies these rulings today.
How consent is captured and recorded
Contacts can be elevated to full tracking three ways: a consent flag synced from your CRM, an opt-in through a StoneShot preference form, or a list import explicitly marked as consented. Every change is timestamped.
How it's applied per contact
Each contact carries one of three tracking statuses:
- Full Tracking – Consent given. Open and link tracking, and the contact can be identified.
- No Tracking – Consent declined or withdrawn. Links route straight to the destination with no pixel and no redirect.
- Anonymous Tracking – No consent captured yet. Open and link tracking, but the contact can't be identified.
How mixed jurisdictions are handled
One list, one send, each contact measured at the level their own consent status and account default allow. No separate campaigns per country, no manual list-splitting to stay compliant.
Let's Talk
Want to see how ConsentTrack works compared to your current setup? We're happy to talk it through.
You'll be in Great Company
We are trusted by a number of companies in the financial services sector
Disclaimer: The regulatory information on this page, including the CNIL and Garante requirements, deadlines, and checklist above, is provided for general informational purposes and doesn't constitute legal advice. Regulations continue to evolve, and how they apply to your organization will depend on your specific setup and the jurisdictions your list touches. We'd recommend checking with legal counsel or your Data Protection Officer before making changes to your tracking or consent practices.
