In consent-based email tracking, the tracking pixel and tracked links are added only for recipients who agreed to it beforehand, and everyone else receives an ordinary, untracked email. The recipient can withdraw at any time, and from then on nothing is measured. Whether you need consent depends on the country and the purpose, but several European regulators say that tracking pixels in emails generally do, with narrow exceptions.
This article explains how such a setup works in practice, what does and does not count as consent, and what regulators have said. It is general information, not legal advice for your situation.
Two questions, two sets of rules
Before tracking anything, separate two questions:
- May I send this email at all? This is governed by rules on electronic communications and marketing: for example, whether you need opt-in consent for commercial email, or whether an exception for existing customers applies.
- May I measure its opens and clicks? A tracking pixel stores or reads information through the recipient’s device, which brings in the European rules on device access (Article 5(3) of the ePrivacy Directive and its national versions), and it processes personal data, which brings in the GDPR.
A yes to the first question does not answer the second. Permission to send a newsletter is not automatically permission to track who opened it.
What regulators have said
The positions below are summaries of official documents. They are not a complete list, and an exception recognised in one country should not be carried over automatically to another.
| Jurisdiction | Reference | In short |
|---|---|---|
| EU (all member states) | EDPB Guidelines 2/2023 | Describes a sender who includes a pixel to detect when an email is read; delivering the pixel counts as storage on the device and collecting the identifier it sends back counts as gaining access. |
| France | CNIL recommendation, published 14 April 2026 | Treats email pixels as trackers that generally need consent, with narrow exceptions such as authentication security; ordinary measurement of interest in an offer is not one of them. |
| Spain | AEPD report 0011/2014 | For pixels in advertising emails, a privacy-policy link plus the absence of objection is not enough; active consent is needed before the first such email. |
| Italy | Garante guidelines, 17 April 2026 | Prior consent as the general rule, with exceptions described for specific situations; those exceptions belong to the Italian framework. |
| Germany | § 25 TDDDG | Storing or accessing information on a device needs consent based on clear information, unless one of two narrow exceptions applies. |
| United Kingdom | PECR regulation 6 and ICO guidance | Tracking pixels fall under the rules on storage and access technologies; consent is needed unless an exception in the regulations applies. |
| United States | CAN-SPAM Act (FTC guide) | Sets rules for commercial email, such as honest headers and a working opt-out. It is not a global model and does not settle tracking questions under other laws. |
The common thread in Europe: where consent is required, it must come before the first tracked email, and it must be an active, informed choice.
What does not count as consent
- Silence or no objection. The AEPD said in 2014 that information plus the absence of an objection is not valid consent for pixels in advertising emails.
- A notice in the email. It informs, and it can offer an opt-out, but it acts after the fact.
- Pre-ticked boxes or bundled terms. The GDPR expects consent to be a clear affirmative act, freely given and specific.
- A click on an unknown link. Security scanners click links automatically, and a person clicking a link to read a page has not agreed to tracking.
- A later unsubscribe. Leaving a list says nothing about earlier consent to measurement.
How consent-based tracking works, step by step
1. Decide the purpose and the roles
Write down why you want to measure opens and clicks (for example, to time follow-ups to clients) and who decides that. The company that decides why and whom it tracks is normally the controller. A provider that runs the tracking only on its behalf can act as a processor; one that uses the data for its own purposes is assessed differently.
2. Collect consent where it fits naturally
Good moments are a sign-up form, a client portal or an onboarding step, with a short explanation of what is measured, by whom and how to withdraw. Be careful with consent requests sent by email: the request itself must not be tracked, and in some countries (Canada and Australia, for example) an email asking for consent can itself count as a commercial message.
3. Record it properly
For each consent, keep where it came from, the date, the purpose and the version of the information shown. Keep opens and links separate if you ask for them separately.
4. Decide per recipient, every time
Before an email is built, check each recipient. Recorded consent means a tracked copy. No consent, an unclear status or a refusal means an ordinary email without a pixel or tracked links.
5. Tell recipients, and make withdrawal easy
Every tracked email should say that it contains tracking and offer a simple way to stop it. The link should lead to a page where an explicit action, not just opening the page, records the choice.
6. Make withdrawal real
After a withdrawal, block future measurement on the sender’s side, including from emails sent earlier, and keep a record of the refusal so that tracking is not switched back on by mistake.
7. Separate technical logs from analytics
Some request logs are needed to operate and secure a service. Describe their scope and retention separately from behavioural measurement.
How HawkOpen implements this model
HawkOpen, the email, document and proposal tracking app made by TriStiX S.L., is built around per-recipient consent:
- Tracking is off until the company’s owner or an administrator switches it on. Then only recipients with a recorded consent are tracked, with opens and links decided separately, and everyone else gets an ordinary email.
- Consent is recorded on HawkOpen’s own consent page only when the recipient confirms it there, together with its source, date, purpose and the version of the information shown.
- Every tracked email ends with a notice saying that it contains HawkOpen tracking elements, followed by the link “Do not track my activity”. No setting or plan removes it. Every email, tracked or not, also ends with “Do not send me messages”.
- Refusal is immediate and lasting. Opening the page behind the link changes nothing; its button refuses tracking by that company for good, deletes what was measured about the address before and tells the sender. Measurement also stops in emails sent earlier.
- Documents follow the same idea. Time on document pages is measured only after the reader agrees on the page.
HawkOpen provides these tools; the company using it decides the purpose and the recipients and remains responsible for having a valid basis where one is needed. HawkOpen does not promise that any particular use of tracking is lawful. Where rules that require consent apply, tracking may start only after that consent has been obtained, and the link in the message lets the recipient withdraw it later.
HawkOpen is currently in a controlled launch. For country-specific questions, see the FAQ on tracking pixels and the GDPR and on UK PECR and the ICO. If you want to know what tracking data can and cannot show once consent is in place, start with how to tell if someone read your email.
Please note: This information is general and relates to HawkOpen’s features. It is not individual legal advice or an assessment of whether a specific campaign or document complies with the law. You make the decisions about your own activities and, where necessary, seek advice from a qualified professional. This does not limit any rights you have under mandatory law.