Reading · Seeking Tranquillity in France

If you subscribe to services in France and they communicate with you via email, you have probably recently received messages about “tracking pixels” like the one below:

Dans le cadre des récentes recommandations de la CNIL concernant les e-mails, nous tenons à vous informer en toute transparence sur nos pratiques de communication. Comme beaucoup d’acteurs, nous utilisons parfois des outils appelés pixels de suivi dans nos e-mails. Ils nous permettent simplement de savoir si nos messages sont lus et quels sujets vous intéressent le plus. L’objectif ? Éviter de surcharger votre boîte de réception et vous envoyer uniquement des contenus utiles.
In light of the CNIL’s recent recommendations regarding emails, we wish to be fully transparent about our communication practices. Like many organizations, we sometimes use tools known as tracking pixels in our emails. They simply allow us to see whether our messages are being read and which topics interest you most. The goal? To avoid cluttering your inbox and to send you only content that is useful.

Typically such statements are followed by some text and a link offering the possibility of permanently opting out of receiving “tracking pixels.”

You might have a couple questions about these messages, such as:

What is the CNIL? CNIL is the acronym for Commission Nationale de l’Informatique et des Libertés. It is France's data protection authority, whose mission is to inform the public of their rights in the domain of digital communications, to support organisational compliance with privacy regulations (including the European General Data Protection Regulation, or GDPR), to anticipate emerging issues within its purview, and to provide compliance and enforcement functions.1 The CNIL website provides a very wide range of information for business and individuals, including guidance on data privacy issues that go beyond the specifics of the GDPR (such as specific guidance for protecting the privacy of children on the web.)

What is a “tracking pixel” ? Tracking pixels (sometimes also called “web beacons”) can be thought of as the email equivalent of cookies—a technical mechanism for tracking end-user activity. It works by embedding a tiny, one-pixel invisible image in the email message.2 Then when the email is opened, a request is sent by the email application to retrieve the image, which provides the sender details about who is requesting the data. The request would include, for example, the IP address of the requesting mail application, date/time information, the email programme used, etc. But … it can identify you specifically because the request for the image also identifies you unambiguously. How, you might ask?

How does a tracking pixel work ?

Take a look at the URL of the image in this HTML-encoding of a tracking pixel:

<img src="https://pixel.example.com/open?id=QW5vbnltb3VzVXNlcg==" width="1" height="1" style="display:none" alt="" >

If you received an email with a similar code snippet embedded in it, then the encoded ID value “QW5vbnltb3VzVXNlcg==” identifies the recipient specifically: it is mapped by the vendor to some account identifier it uses internally. When you open your mail and your mail app requests the image, the sender receives confirmation that you opened the email, consisting of a timestamp indicating when you opened it, your IP address, and more. (And of course the image requested consists of one pixel and is not actually visible—it is nothing more than a mechanism for tracking your having opened the email.)

The new CNIL requirements

On 14 April 2026 the CNIL issued a guidance document for service providers (in GDPR terms, “data controllers”) instructing them to disclose their use of tracking pixels to consumers and to offer them the choice of suppressing them. Specifically, it established a three-month grace period for compliance, effectively setting a 14 July 2026 deadline. Thereafter vendors and service providers must conform to the regulation immediately when communicating with new clients.

The CNIL guidance document calls for service providers

to clarify and define the role of each actor, i.e., to articulate carefully the function and objectives of their use of tracking pixels;
to distinguish between pixels that require consent and those that are exempt from it, in conformance to Article 82 of the French Data Protection Act; and
to clarify to consumers the procedures for obtaining, withdrawing and providing evidence of consent.

At the same time, CNIL has issued guidance to consumers to assure they understand the issues and are positioned to take appropriate action once notified by service providers about the use of tracking pixels. I strongly recommend reading that guidance.

How does one’s email application fit into the regulatory picture?

So, one might ask: Doesn’t my email app play a role in protecting my privacy as well ? Indeed the answer is yes.

Some email clients offer the choice of implementing protections against tracking pixels and other mechanisms for potentially acquiring your private information. The application Proton Mail can suppress tracking pixels, for example. Here’s an informational message it has issued concerning a message sent directly by Substack, indicating that tracking elements have been suppressed:

Stored with zero-access encryption 3 trackers blocked 3 trackers blocked, No links cleaned Date:Friday, July 10th, 2026 at 3:50 PMFriday, July 10th, 2026 at 3:50 PM CommsComms Size:7.04 KB
Sender
Substack<no-reply@substack.com>

Other email clients, such as Gmail and Apple Mail, also provide a partial degree of insulation from tracking pixels by retrieving images through a proxy mechanism; still others allow user configuration of privacy settings that affect tracking pixels. It’s always a good thing to be aware of the privacy settings on your web browsers and dedicated email apps ! (For more on email app behaviours and settings, check out this article.)

How to respond to vendors’ emails about tracking pixels

As in the example email message above, vendors generally explain their use of tracking pixels in terms of the benefits they might provide you. If you agree, do nothing. But if your personal privacy concerns outweigh such benefits (such as the potential creation of detailed profiles about your preferences and email usage habits), the best way to suppress tracking pixels from a specific vendor is to choose to opt out of tracking pixels when you are provided the opportunity to do so.

But also understand that vendors outside of the French or European Union jurisdictions are less likely to respect the CNIL’s guidance on tracking pixels. So your choice of web browser when using email, or your choice of dedicated email application, still can make a world of difference in protecting your online privacy.

More about privacy protections in France and the European Union

Interested in learning more about the European Union’s General Data Protection Regulation and the CNIL? Check out my article …

If you enjoyed this post or found it useful in some way, please feel free to …

French agency acts to regulate the use of "tracking pixels"in email communications

Comments