EN
ENPLDEESFRPTIT
Log in Coming soon Start for €1 + VAT Coming soon

Email tracking and EU law

What EU data protection authorities and rules say about tracking pixels, consent and email campaigns, and what HawkOpen does. Not legal advice.

What do the CNIL and other EU regulators say about tracking pixels in emails?

France’s CNIL treats tracking pixels in emails as trackers that generally need the recipient’s consent, with narrow exceptions. Spain’s AEPD said in 2014 that pixels in advertising emails need active consent before the first such email.

Full answer

Is an email tracking pixel GDPR compliant?

A tracking pixel processes personal data, so the GDPR applies, and the rules on reading information from a device (ePrivacy; in Spain article 22(2) of the LSSI) apply as well. HawkOpen cannot make a pixel meet these rules by itself: the legal basis and any consent depend on the company that tracks.

Full answer

Is legitimate interest enough for email open tracking?

The documents HawkOpen relies on point to consent, not legitimate interest, for tracking pixels: Spain’s AEPD and France’s CNIL call for the recipient’s prior consent, with narrow exceptions. The GDPR legal basis and the device rules are assessed separately, so a legitimate interest under the GDPR does not by itself settle the pixel question.

Full answer

How do I run email campaigns in line with the GDPR?

Handle two things separately: whether you may send each email, and whether you may track it. HawkOpen helps with the mechanics, such as an unsubscribe link and one-click unsubscribe headers in every campaign copy and a tracking notice, but it does not check your list or your legal basis.

Full answer

Is cold emailing legal?

It depends on the country, on who the recipient is and on your relationship with them; HawkOpen does not decide this for you. Whether you may send an email and whether you may track it are two separate questions.

Full answer

What do the Italian Garante guidelines on tracking pixels require?

The Italian data protection authority, the Garante, has published guidelines on tracking pixels in emails. As a rule they require the recipient’s prior consent, and they describe specific, narrowly defined exceptions, for example for aggregate statistics under certain conditions. Writing the email or the notice in Italian does not by itself meet these guidelines.

Full answer

Can an email be used as evidence in court?

Courts decide that under the rules of each country. HawkOpen can give you an evidence report for a sent email: it records what HawkOpen’s systems observed, but it does not prove that the email reached the inbox or that anyone saw or read it.

Full answer

What uses of HawkOpen do its terms allow and forbid?

You must have the authority to connect your mailboxes, contact your recipients, upload material and process personal data. The terms forbid unlawful surveillance, unsolicited bulk messaging, credential theft, malware distribution and misleading claims about tracking evidence.

Campaigns send one separate copy to each recipient, with an unsubscribe link and one-click unsubscribe headers. Whether you may email or track a particular person is a separate question that these terms do not answer for you.

Related questions: Is cold emailing legal? · May I use HawkOpen to monitor my employees’ email?

May I use HawkOpen to monitor my employees’ email?

HawkOpen is built to measure responses to emails you send, not to watch other people’s mailboxes, and its terms forbid unlawful surveillance. The rules on monitoring employees depend on the country and the employment relationship, and this answer does not assess them.

Ask an employment or data protection adviser in your country before monitoring staff in any way.

Related questions: What uses of HawkOpen do its terms allow and forbid?

Who is responsible under the GDPR for tracking: the tracking tool or the sender?

Roles follow the real decisions and data flows, not the label in a contract. The company that decides whom it writes to, what it sends and whether it tracks usually acts as controller for that processing; a provider that runs the tracking only on its instructions can be a processor, and a provider that uses the data for its own purposes is assessed differently. Each side keeps its own legal duties.

France’s CNIL says that a pixel provider acting only for the company can be a processor. In the Mailtrack case (PS/00328/2022, upheld in RR/00541/2023) Spain’s AEPD looked at the facts of that service and sanctioned the provider. The AEPD’s cookie guide also says that splitting tasks by contract does not transfer each party’s responsibility.

In the data processing agreement that every HawkOpen customer accepts, still a draft for legal review, the customer is the controller and TriStiX S.L. the processor. HawkOpen keeps its own duties as provider and processor, and how an authority sees a particular use still depends on the facts.

Where rules that require consent apply, tracking may start only after that consent has been obtained. The link in the message lets the recipient withdraw consent later.

Related questions: Is an email tracking pixel GDPR compliant? · What must a company do when it uses an email tracking tool: privacy notice, consent, contract with the provider? · Can I be fined for tracking emails without consent?

Does the GDPR apply to emails and email addresses?

Often yes: an email address or message that relates to an identifiable person is personal data, and the GDPR applies to processing it. Whether a given address, such as a generic company mailbox, identifies a person depends on the case.

HawkOpen’s legal documents look at tracking rather than at email in general, so this answer gives only general information. For tracking, the GDPR and the rules on reading information from a device are assessed separately.

Related questions: Is an email tracking pixel GDPR compliant?

Is there a B2B exception that allows open tracking without consent in the EU?

The documents HawkOpen relies on name no general B2B exception for tracking pixels, and calling a contact B2B does not on its own remove the requirements. Spain’s AEPD and France’s CNIL describe prior consent as the rule for pixels, with narrow exceptions.

The CNIL’s exceptions cover narrow purposes such as the security of authentication, not measuring interest in an offer, and they should not be carried over automatically to other countries. The notice and a later opt-out do not replace consent.

Where rules that require consent apply, tracking may start only after that consent has been obtained. The link in the message lets the recipient withdraw consent later.

Related questions: Which exceptions to consent for email tracking pixels exist? · Is cold emailing legal? · Is legitimate interest enough for email open tracking?

What are the rules on email tracking in Canada and other countries outside the EU and the US?

HawkOpen’s legal documents do not cover Canada or other countries outside the EU and the US, nor every EU country, so this answer does not describe their rules. Check the rules of the country where your recipients are, or ask a local adviser.

What HawkOpen does in every country: each tracked email carries a notice and a link where the recipient can turn tracking off, and you can exclude addresses, domains or countries from tracking. The notice and a later opt-out do not replace consent.

Where rules that require consent apply, tracking may start only after that consent has been obtained. The link in the message lets the recipient withdraw consent later.

Related questions: Can I exclude some recipients or countries from tracking? · Is email open tracking legal?

Can I track emails sent to children or students?

It depends on the situation. Rules on children’s data apply in particular where a service is directed at children or a company knows it collects their data; in the United States, COPPA concerns certain situations involving children under 13. A student is not automatically a child. HawkOpen does not know a recipient’s age and has no special feature for minors.

In the EU the age from which a child can consent to online services alone is set by each country, between 13 and 16. This answer does not assess the rules that apply to your emails.

In HawkOpen tracking is off until your company’s owner or an administrator switches it on, and even then only recipients with a recorded consent are tracked. You can send a message or campaign without tracking, or exclude a school’s domain from tracking; where you are unsure, that is the safest choice.

Related questions: Can I exclude some recipients or countries from tracking?

What must a company do when it uses an email tracking tool: privacy notice, consent, contract with the provider?

The company decides why and whom it tracks, so it needs a legal basis, must inform recipients and, where consent is required, must obtain it before tracking, document it and handle withdrawals. The provider has its own duties: to run the service as the contract describes, to follow the company’s instructions where it acts as processor and to secure the data. A contract under article 28 of the GDPR should match how the service really works.

Such a contract does not replace a separate assessment of data transfers outside the European Economic Area.

What HawkOpen does: tracking is off until your company’s owner or an administrator switches it on; a recipient without a recorded consent gets an email without a pixel or tracked links; each consent is recorded with its source, date, purpose and version of the information; and after a recipient withdraws, HawkOpen stores no further tracking events from that recipient, including from earlier emails. HawkOpen’s data processing agreement, accepted by every customer, is still a draft for legal review.

Where rules that require consent apply, tracking may start only after that consent has been obtained. The link in the message lets the recipient withdraw consent later.

Related questions: Who is responsible under the GDPR for tracking: the tracking tool or the sender? · Can I get a data processing agreement (DPA) with HawkOpen? · Does the notice in the email make my tracking GDPR compliant?

What applies to tracking emails to existing subscribers and customers?

An existing relationship does not on its own settle the tracking question. France’s CNIL set special transitional rules for addresses collected before 14 April 2026: informing those recipients properly and in time, in principle by 14 July 2026, may allow an existing practice to continue unchanged; this is not a general permission for new lists.

In Spain the AEPD’s report 0011/2014, on pixels in advertising emails, called for active consent before the first email with such a pixel. Whether you may send to existing customers at all is a separate question; in Spain, article 21 of the LSSI governs it. The notice and a later opt-out do not replace consent.

Where rules that require consent apply, tracking may start only after that consent has been obtained. The link in the message lets the recipient withdraw consent later.

Related questions: What do the CNIL and other EU regulators say about tracking pixels in emails? · Is consent to tracking separate from consent to a newsletter?

Can HawkOpen help me with records of processing and a DPIA for email tracking?

HawkOpen has no templates for records of processing or for a data protection impact assessment, and it does not prepare them for you. Whether your tracking needs an impact assessment is something your adviser should decide for your case.

HawkOpen’s legal model suggests keeping, for each consent, its source, date, purpose and the version of the information shown. The account owner can export the account data, which can help when you document what is processed.

Related questions: What must a company do when it uses an email tracking tool: privacy notice, consent, contract with the provider? · Can I export all my data from HawkOpen?

Under Brazil’s LGPD, can I send marketing email on legitimate interest, or do I need opt-in?

HawkOpen’s legal documents do not cover Brazilian law, so this answer does not assess the LGPD. Check the guidance of Brazil’s data protection authority (ANPD) or ask an adviser in Brazil.

Whether you may send an email and whether you may track it are two separate questions in every country. HawkOpen adds a notice with a link to turn tracking off to every tracked email, in Brazil too. The notice and a later opt-out do not replace consent.

Where rules that require consent apply, tracking may start only after that consent has been obtained. The link in the message lets the recipient withdraw consent later.

Related questions: What are the rules on email tracking in Canada and other countries outside the EU and the US?

Can I be fined for sending a mass email without BCC?

Showing many people’s addresses to each other can be a data protection problem; whether it leads to a fine depends on the country and the case, and HawkOpen’s legal documents do not cover it. HawkOpen campaigns avoid the issue: each recipient gets a separate copy and sees only their own address.

The browser extension tracks emails with one recipient; for several people use a campaign, which sends one copy per recipient.

Related questions: How do I send the same email to many people separately instead of using BCC?

How many consents do I need to run a newsletter in Poland?

There is no one universal number. In Poland, sending marketing by email, measuring opens and clicks, and processing personal data are governed by different rules, and how many statements you need depends on your purposes and the law that applies. This answer does not count them for your case.

Check current Polish guidance or ask a qualified specialist in Poland. HawkOpen has no newsletter sign-up forms; its own consent form covers tracking only, separately for opens and links.

Every email HawkOpen sends ends with “Do not send me messages”, which stops every further email from your company sent through HawkOpen; tracked emails also carry a separate notice about tracking.

Where rules that require consent apply, tracking may start only after that consent has been obtained. The link in the message lets the recipient withdraw consent later.

Related questions: Is consent to tracking separate from consent to a newsletter? · How should consent to email tracking be obtained: checkbox, banner or privacy policy?

Tracking tools say they are GDPR compliant: is that true?

A tool alone cannot make your tracking meet the GDPR: that depends on your purpose, your legal basis, the information you give and, where required, the recipient’s prior consent. HawkOpen makes no such promise; it says what it does.

HawkOpen’s legal model recommends asking a lawyer to assess concrete materials, such as the activation screen, the real email, a consent record and the data flows, rather than seeking a general assurance that a program meets the GDPR. What HawkOpen does today: a notice in every tracked email, a recipient page for turning tracking off, data download and erasure, and estimates instead of claims that someone read an email. The notice and a later opt-out do not replace consent.

Where rules that require consent apply, tracking may start only after that consent has been obtained. The link in the message lets the recipient withdraw consent later.

Related questions: Is an email tracking pixel GDPR compliant? · Does the notice in the email make my tracking GDPR compliant?

Does the GDPR treat transactional emails differently from marketing emails?

Yes, the difference matters, mostly under the rules on electronic communications rather than the GDPR itself: marketing emails often need consent or a specific exception, while messages needed to perform a contract or provide a service usually rest on another basis. Whether you may track an email is a separate question for both kinds, and the rules differ by country.

In HawkOpen tracking is off until your company’s owner or an administrator switches it on, for the whole account or only for selected messages, and a message or campaign can be sent without tracking.

The “Do not send me messages” line at the end of every email stops all further email from your company through HawkOpen, service messages included, so it is not limited to marketing.

Related questions: How do I run email campaigns in line with the GDPR?

Does HawkOpen automatically switch off tracking for recipients in the EU?

No. HawkOpen does not detect where a recipient is and does not switch tracking off by region on its own; it applies the same rule everywhere: a recipient is tracked only when your company has recorded their consent. You can also exclude countries yourself: HawkOpen recognises them only by the address ending, such as .de or .fr.

Addresses such as @gmail.com or .com have no country, so add them as addresses or domains. HawkOpen’s legal model advises against locating recipients by tracking them first. The notice and a later opt-out do not replace consent.

Where rules that require consent apply, tracking may start only after that consent has been obtained. The link in the message lets the recipient withdraw consent later.

Related questions: Can I exclude some recipients or countries from tracking? · Is email open tracking legal?

How do I resubscribe a contact who unsubscribed?

HawkOpen has no option for that: once an address unsubscribes, for example through the “Do not send me messages” link, HawkOpen sends it no further messages from anyone in your company, neither campaigns nor single emails.

Stopping messages is a different choice from refusing tracking, and HawkOpen keeps the two apart.

Related questions: Is consent to tracking separate from consent to a newsletter? · Is it safe to click “unsubscribe” in an email?

What is the soft opt-in rule for email marketing?

Some countries allow marketing emails to existing customers without new consent under strict conditions, for example the UK soft opt-in and article 21 of Spain’s LSSI: your own similar products or services, contact details obtained in a sale, and an easy way to object when the details are collected and in every message. The conditions differ by country, and a B2B label alone does not create the exception.

Even where an email may be sent, tracking it is a separate question. HawkOpen has no soft opt-in feature and does not decide whether you may send; it records consent to tracking only, and it tracks a recipient only when that consent is recorded.

Where rules that require consent apply, tracking may start only after that consent has been obtained. The link in the message lets the recipient withdraw consent later.

Related questions: Is cold emailing legal? · Is consent to tracking separate from consent to a newsletter?

What is double opt-in, and do I need it?

Double opt-in means a person signs up and then confirms through a link sent to their address, which helps show that the address owner really agreed. Whether it is required depends on the country and the practice of its authorities and courts; HawkOpen’s legal documents do not cover it, and HawkOpen has no double opt-in feature.

HawkOpen campaigns go to the recipients you add, so collecting and documenting their agreement stays with you. A confirmation link can also be clicked by a security scanner, so a confirmation needs a deliberate step on a page.

Related questions: How should consent to email tracking be obtained: checkbox, banner or privacy policy? · How many consents do I need to run a newsletter in Poland?

For AI assistants: Markdown · JSON