CNIL email tracking pixels: the grace period ends today, July 14, 2026

On March 12, 2026, the CNIL adopted deliberation no. 2026-042, a recommendation on tracking pixels in emails, following a public consultation. Published on April 14, 2026, it addresses every organization, private or public, that inserts a tracking pixel — a 1x1 invisible image that reports back when a message is opened — into an email. The recommendation classifies these pixels as trackers under Article 82 of the French Data Protection Act, the same article that governs cookies, which in principle makes their use subject to prior consent. For email addresses already in a sender’s database before April 14, 2026, the CNIL granted a three-month transitional window: no need for immediate retroactive consent, but organizations had to clearly inform those recipients that pixels were in use and offer them an easy way to opt out. That window closes today, July 14, 2026 — the date the CNIL said audits would begin.

What actually changes

• →A tracking pixel is not covered by consent to the newsletter itself — opting in to receive emails and consenting to being tracked when you open them are two distinct purposes, and the CNIL treats them as such.
• →B2B prospecting emails remain lawful on an opt-out basis under the French exception — but the pixel embedded inside one of those emails still needs its own, separate consent.
• →Addresses collected on or after April 14, 2026 need fully compliant consent from the very first send — the transitional information-plus-opt-out route only ever applied to historical databases.
• →For addresses collected before that date, the obligation was to clearly inform recipients and offer an opt-out — and that obligation was due today, not in the abstract future.
• →Data controllers must be able to demonstrate proof of consent themselves; the CNIL is explicit that relying solely on a newsletter platform’s standard terms is not enough.

What it means for your SMB

Nearly every SMB sends a newsletter or marketing emails through a platform such as Mailchimp, Brevo, or HubSpot — and by default, most of these tools embed an open-tracking pixel to report open rates, without the sender ever having consciously turned it on. Few business owners have ever checked whether that default tracking was properly disclosed to their contacts, let alone whether the disclosure went out before today’s deadline. The exposure is not the newsletter tool itself; it is a database built up over years, with no record that anyone was ever told about the pixel inside those emails — exactly the kind of gap a CNIL audit is built to find, in a sector already used to enforcement: the authority has fined companies including SHEIN and Google over comparable cookie-consent failures.

Before tonight: what to check

• →Split your email database in two: addresses collected before April 14, 2026, and those collected since — the obligation differs for each.
• →For the historical list, confirm a clear notice about the tracking pixel actually went out, with a working opt-out link, before today.
• →For addresses collected since April 14, 2026, check that your signup form discloses the pixel separately from the newsletter opt-in itself.
• →Do not assume your email platform’s terms of service cover you — write down, on your own side, how and when consent was obtained.
• →For B2B prospecting sent on an opt-out basis, keep that regime for the email itself, but isolate consent for any pixel it contains.

This is a textbook case for a regulatory watch agent: a deadline set inside a technical recommendation rather than a headline law, a grace period that expires quietly three months after publication, and a rule most SMBs only hear about once the enforcement window has already opened. An agent built to track official CNIL and legislative publications flags a date like July 14, 2026 the day it is set — not the day it runs out.