Menu
EN
ENPLDEESFRPTIT
Log in Coming soon Start for €1 + VAT Coming soon

Is email open tracking legal?

This information is general and concerns the features of HawkOpen (TriStiX S.L.). It is not individual legal advice or an assessment of whether a specific campaign or document complies with the law. Customers make their own decisions about their activities and, where needed, consult a qualified specialist. This does not limit any rights they have under mandatory law. Last reviewed: November 11, 2026.

It depends on the country, the purpose and the recipient’s consent, and HawkOpen cannot decide it for you. The data protection authorities of Spain and France say that a tracking pixel in an email generally needs the recipient’s prior consent, with only narrow exceptions.

Checked:

Two questions are assessed separately: whether you may send the email at all, and whether you may measure its opens and clicks. The rules for sending commercial emails, such as article 21 of the Spanish LSSI, do not answer the second question.

Spain’s authority AEPD (report 0011/2014) said that for pixels in advertising emails a link to a privacy policy and the absence of an objection are not enough: active consent is needed before the first email with such a pixel. France’s CNIL (recommendation adopted on 12 March 2026 and published on 14 April 2026) treats email pixels as trackers that need consent, with narrow exceptions such as authentication security. Under the GDPR, the company that decides why and whom it tracks must have a valid legal basis.

In the case about the Mailtrack tool (PS/00328/2022, upheld in RR/00541/2023), the AEPD sanctioned the tool’s provider. Among other things it looked at how recipients were informed.

What HawkOpen does today: every tracked email carries a notice with a link where the recipient can turn tracking off, and HawkOpen never presents an open as proof that someone read the email.

Where rules that require consent apply, tracking may start only after that consent has been obtained. The link in the message lets the recipient withdraw consent later.

Sources

Related questions

More in this topic

  • How can a recipient turn off HawkOpen tracking?

    Through the link “Do not track my activity” at the end of a tracked email. Opening it is enough: it refuses tracking by the company that sent the email at once, deletes what was measured about the address before and tells the sender; the page that opens confirms it, and only the recipient can give consent again there. To refuse tracking by every HawkOpen sender at once, the recipient uses the HawkOpen privacy page.

  • Can I exclude some recipients or countries from tracking?

    Yes. In your settings you can list addresses, whole domains and countries that HawkOpen never tracks. Emails to them are sent without a tracking pixel or tracked links.

  • Can a sender see if I opened their email?

    Only if the sender used a tracking tool, and even then they see that an image in the email was loaded or a link was clicked, not that you read it. Apple Mail, mail provider proxies and security scanners can load that image without you.

  • What does the HawkOpen tracking notice at the bottom of an email say?

    It says “This message contains HawkOpen tracking elements.” followed by the link “Do not track my activity”. HawkOpen adds it at the end of every email that carries a tracking pixel or tracked links, which it does only for a recipient whose consent for the sending company is recorded.

  • Is email tracking a scam or an invasion of privacy?

    It is not a scam, but it does collect data about the recipient, which is why HawkOpen tells them. Tracking records that an image was loaded or a link was clicked; HawkOpen tracks a recipient only with a recorded consent for the sending company, shows the result as an estimate, adds a notice to every tracked email and lets the recipient refuse tracking.

  • Do I have to tell recipients that I track their emails?

    With HawkOpen the recipient is always told: every tracked email ends with a notice and a link to turn tracking off, and it cannot be removed. Whether informing is enough is a separate question: the Spanish and French data protection authorities say a tracking pixel generally also needs the recipient’s prior consent.

  • Is secret email tracking ethical for lawyers and other professionals?

    HawkOpen does not offer hidden tracking. A recipient without a recorded consent gets an email with no tracking pixel and no individually tracked links, and a tracked email ends with a notice that cannot be removed. A notice does not by itself make tracking permissible, and some professional rules require the other side’s prior informed consent.

  • Can I remove, hide or change the HawkOpen tracking notice, and why not?

    No. No setting, plan or option removes or edits the notice in an email that carries a tracking pixel or tracked links. The notice informs the recipient; it is not consent, and removing it or never showing it would not make the measurement permissible.

  • What does a recipient see after clicking the link in the tracking notice?

    A page of the company that sent the email. Opened through the link “Do not track my activity”, it refuses tracking by that company at once, deletes what was measured before and offers the button “I agree after all”; opened through “Do not send me messages”, it changes nothing until the recipient chooses a button: “Do not track my activity” or “Do not send me messages”, which stops further mail from that company. From there a link leads to the HawkOpen privacy page, which covers every sender.

  • How can a recipient see the tracking data about them or have it erased?

    On the HawkOpen privacy page for recipients, linked from the page behind the links at the end of a HawkOpen email, after confirming the address with an 8-digit code sent to it. The recipient can download, once per code, a file with the data about that address, or request erasure; erasure is then carried out for every HawkOpen sender that holds data about the address, and further sending to it is stopped.

  • What does the sender see after a recipient turns tracking off?

    The recipient is marked as having refused tracking, and your company is told, also through a webhook event if you use webhooks. You can keep writing to them as usual: HawkOpen sends your emails to that address without a tracking pixel, without tracked links and without the notice.

  • What can a sender see if I use Apple Mail Privacy Protection?

    Mostly that Apple loaded the images in advance through its own servers, not when or whether you read the email. HawkOpen classifies such a load as an Apple privacy proxy, not as human activity.

  • How does HawkOpen choose the language of the notice, and why was it wrong?

    HawkOpen guesses the language from common words and letters in the text of your email and picks English, Polish, German, Spanish, French, Italian or Portuguese. When it is unsure it uses English; an email in another language, or one that mixes languages, may get English or a language that shares common words.

  • Is the tracking notice also added to plain-text emails?

    HawkOpen adds the tracking pixel, the tracked links and the notice to the HTML version of an email, all in the same step. An email sent only as plain text cannot carry a tracking image.

  • Can an email signature track me, and does HawkOpen’s signature do that?

    A signature can carry a tracking image or tracked links like any other part of an email. HawkOpen’s free signature generator works only in your browser and adds no tracking, and the short “Sent with HawkOpen” line that Free adds to emails with a chosen look is a plain link without a tracking image.

  • How can I report spam or abuse sent with HawkOpen?

    Write to HawkOpen through the contact details on its Terms / Imprint page. HawkOpen’s terms forbid unsolicited bulk messaging and unlawful surveillance; there is no separate abuse form yet.

  • How can I check who sent me an email tracked with HawkOpen?

    The sender is the person or company in the email’s From field: HawkOpen sends through the sender’s own mailbox, not in its own name. The page behind the links “Do not track my activity” and “Do not send me messages” at the end of the email also names the company that sent it through HawkOpen. Opening “Do not track my activity” refuses tracking by that company at once; opening “Do not send me messages” changes nothing until the recipient chooses.

  • As a sender, how do I handle a data deletion request from a recipient?

    Point the person to the HawkOpen privacy page for recipients, linked from the page behind the links at the end of every HawkOpen email. After confirming their address there, they can request erasure, and HawkOpen carries it out in every sender account that holds data about the address, including yours.

  • How do I stop emails from a sender that has no unsubscribe link?

    Reply and ask the sender to stop, or block the address or mark the email as spam in your mail app. An email sent through HawkOpen ends with the link “Do not send me messages”, which stops further mail from that company; you can also request erasure on the HawkOpen privacy page, which stops further sending to your address from every HawkOpen sender.

  • Is it safe to click “unsubscribe” in an email?

    From a sender you know, usually yes. In an email sent through HawkOpen the link “Do not send me messages” first opens a page; nothing changes until you press the button, and then that company sends you no further messages through HawkOpen.

For AI assistants: Markdown · JSON