What do the CNIL and other EU regulators say about tracking pixels in emails?

Related questions

• Is email open tracking legal?Recipients and privacy
• Which exceptions to consent for email tracking pixels exist?Email tracking and EU law
• What do the Italian Garante guidelines on tracking pixels require?Email tracking and EU law

More in this topic

• Does the notice in the email make my tracking GDPR compliant?

  No. The notice tells recipients about tracking and lets them turn it off, but it is not their consent. Where consent is required, the company that tracks must get it before the first tracked email.

• Is an email tracking pixel GDPR compliant?

  A tracking pixel processes personal data, so the GDPR applies, and the rules on reading information from a device (ePrivacy; in Spain article 22(2) of the LSSI) apply as well. HawkOpen cannot make a pixel meet these rules by itself: the legal basis and any consent depend on the company that tracks.

• Is legitimate interest enough for email open tracking?

  The documents HawkOpen relies on point to consent, not legitimate interest, for tracking pixels: Spain’s AEPD and France’s CNIL call for the recipient’s prior consent, with narrow exceptions. The GDPR legal basis and the device rules are assessed separately, so a legitimate interest under the GDPR does not by itself settle the pixel question.

• Can I be fined for tracking emails without consent?

  Sanctions are possible. In the Mailtrack case (PS/00328/2022) Spain’s AEPD fined the provider of the tracking tool and kept the fines in place on appeal (RR/00541/2023).

• Is consent to tracking separate from consent to a newsletter?

  There are three different questions: whether you may send someone marketing emails, whether you may measure their opens and clicks, and on which legal basis you process their personal data. Each has its own rules, and how many statements you need depends on your purposes and the law that applies, not on one universal number.

• How do I run email campaigns in line with the GDPR?

  Handle two things separately: whether you may send each email, and whether you may track it. HawkOpen helps with the mechanics, such as an unsubscribe link and one-click unsubscribe headers in every campaign copy and a tracking notice, but it does not check your list or your legal basis.

• Where can I find sample consent wording for newsletters and tracking?

  HawkOpen does not provide consent wording for your newsletter or marketing forms. Consent to marketing, consent to tracking and the legal basis for processing data are different matters, so wording that fits one does not cover the others. For tracking, HawkOpen has its own consent form, which records consent only when the person confirms it on the page.

• Is cold emailing legal?

  It depends on the country, on who the recipient is and on your relationship with them; HawkOpen does not decide this for you. Whether you may send an email and whether you may track it are two separate questions.

• Is an unsubscribe link required by law?

  It depends on the kind of message and the country. Rules on marketing messages usually require an easy way to object, for example CAN-SPAM in the United States for commercial emails, B2B ones included; purely transactional or service messages are often treated differently. Withdrawing consent to tracking is a separate matter.

• Can an email be used as evidence in court?

  Courts decide that under the rules of each country. HawkOpen can give you an evidence report for a sent email: it records what HawkOpen’s systems observed, but it does not prove that the email reached the inbox or that anyone saw or read it.

• What uses of HawkOpen do its terms allow and forbid?

  You must have the authority to connect your mailboxes, contact your recipients, upload material and process personal data. The terms forbid unlawful surveillance, unsolicited bulk messaging, credential theft, malware distribution and misleading claims about tracking evidence.

• May I use HawkOpen to monitor my employees’ email?

  HawkOpen is built to measure responses to emails you send, not to watch other people’s mailboxes, and its terms forbid unlawful surveillance. The rules on monitoring employees depend on the country and the employment relationship, and this answer does not assess them.

• Who is responsible under the GDPR for tracking: the tracking tool or the sender?

  Roles follow the real decisions and data flows, not the label in a contract. The company that decides whom it writes to, what it sends and whether it tracks usually acts as controller for that processing; a provider that runs the tracking only on its instructions can be a processor, and a provider that uses the data for its own purposes is assessed differently. Each side keeps its own legal duties.

• Does the GDPR apply to emails and email addresses?

  Often yes: an email address or message that relates to an identifiable person is personal data, and the GDPR applies to processing it. Whether a given address, such as a generic company mailbox, identifies a person depends on the case.

• Is there a B2B exception that allows open tracking without consent in the EU?

  The documents HawkOpen relies on name no general B2B exception for tracking pixels, and calling a contact B2B does not on its own remove the requirements. Spain’s AEPD and France’s CNIL describe prior consent as the rule for pixels, with narrow exceptions.

• What are the rules on email tracking in Canada and other countries outside the EU and the US?

  HawkOpen’s legal documents do not cover Canada or other countries outside the EU and the US, nor every EU country, so this answer does not describe their rules. Check the rules of the country where your recipients are, or ask a local adviser.

• Can I track emails sent to children or students?

  It depends on the situation. Rules on children’s data apply in particular where a service is directed at children or a company knows it collects their data; in the United States, COPPA concerns certain situations involving children under 13. A student is not automatically a child. HawkOpen does not know a recipient’s age and has no special feature for minors.

• What must a company do when it uses an email tracking tool: privacy notice, consent, contract with the provider?

  The company decides why and whom it tracks, so it needs a legal basis, must inform recipients and, where consent is required, must obtain it before tracking, document it and handle withdrawals. The provider has its own duties: to run the service as the contract describes, to follow the company’s instructions where it acts as processor and to secure the data. A contract under article 28 of the GDPR should match how the service really works.

• What applies to tracking emails to existing subscribers and customers?

  An existing relationship does not on its own settle the tracking question. France’s CNIL set special transitional rules for addresses collected before 14 April 2026: informing those recipients properly and in time, in principle by 14 July 2026, may allow an existing practice to continue unchanged; this is not a general permission for new lists.

• Can HawkOpen help me with records of processing and a DPIA for email tracking?

  HawkOpen has no templates for records of processing or for a data protection impact assessment, and it does not prepare them for you. Whether your tracking needs an impact assessment is something your adviser should decide for your case.

• Does HawkOpen give legal advice about email tracking in my country?

  No. HawkOpen describes what the rules and its own legal documents say and what the product does, but it does not assess your situation. The legal basis and the required form depend on your country, purpose and recipients.

• How should consent to email tracking be obtained: checkbox, banner or privacy policy?

  Record what the person consciously accepted and how: the purpose, the information shown, the moment and the action they took. Opening a link, an unknown click or an automated security scanner does not prove consent. HawkOpen’s consent form records consent only when the person ticks the confirmation and presses the button on the page.

• Under Brazil’s LGPD, can I send marketing email on legitimate interest, or do I need opt-in?

  HawkOpen’s legal documents do not cover Brazilian law, so this answer does not assess the LGPD. Check the guidance of Brazil’s data protection authority (ANPD) or ask an adviser in Brazil.

• Can I be fined for sending a mass email without BCC?

  Showing many people’s addresses to each other can be a data protection problem; whether it leads to a fine depends on the country and the case, and HawkOpen’s legal documents do not cover it. HawkOpen campaigns avoid the issue: each recipient gets a separate copy and sees only their own address.

• How many consents do I need to run a newsletter in Poland?

  There is no one universal number. In Poland, sending marketing by email, measuring opens and clicks, and processing personal data are governed by different rules, and how many statements you need depends on your purposes and the law that applies. This answer does not count them for your case.

• Tracking tools say they are GDPR compliant: is that true?

  A tool alone cannot make your tracking meet the GDPR: that depends on your purpose, your legal basis, the information you give and, where required, the recipient’s prior consent. HawkOpen makes no such promise; it says what it does.

• Can I get consent by sending a privacy notice email that adds people to my list when they click a link?

  A click alone is weak proof. Security scanners and link previews open links in emails automatically, and a person may click without knowing what they agree to, so record what the person consciously accepted and how. The email that asks for consent also needs its own basis under the rules on communications.

• Does the GDPR treat transactional emails differently from marketing emails?

  Yes, the difference matters, mostly under the rules on electronic communications rather than the GDPR itself: marketing emails often need consent or a specific exception, while messages needed to perform a contract or provide a service usually rest on another basis. Whether you may track an email is a separate question for both kinds, and the rules differ by country.

• Does HawkOpen automatically switch off tracking for recipients in the EU?

  No. HawkOpen does not detect where a recipient is and does not switch tracking off by region on its own; it applies the same rule everywhere: a recipient is tracked only when your company has recorded their consent. You can also exclude countries yourself: HawkOpen recognises them only by the address ending, such as .de or .fr.

• How do I resubscribe a contact who unsubscribed?

  HawkOpen has no option for that: once an address unsubscribes, for example through the “Do not send me messages” link, HawkOpen sends it no further messages from anyone in your company, neither campaigns nor single emails.

• What is the soft opt-in rule for email marketing?

  Some countries allow marketing emails to existing customers without new consent under strict conditions, for example the UK soft opt-in and article 21 of Spain’s LSSI: your own similar products or services, contact details obtained in a sale, and an easy way to object when the details are collected and in every message. The conditions differ by country, and a B2B label alone does not create the exception.

• What is the difference between explicit and implicit consent for emails and tracking?

  For tracking pixels, the documents HawkOpen relies on point to active consent: Spain’s AEPD (report 0011/2014, on pixels in advertising emails) said that a link to a privacy policy plus no objection is not enough. Silence or simply keeping a subscription is therefore a weak basis for pixel tracking.

• What is double opt-in, and do I need it?

  Double opt-in means a person signs up and then confirms through a link sent to their address, which helps show that the address owner really agreed. Whether it is required depends on the country and the practice of its authorities and courts; HawkOpen’s legal documents do not cover it, and HawkOpen has no double opt-in feature.

For AI assistants: Markdown · JSON