Email Tracking Pixel Consent: How to Ask for Open Tracking Separately From Your Newsletter Sign-up

Most email service providers (ESPs) measure opens with a tracking pixel: a tiny, invisible image with a URL unique to each recipient. When the email is opened, the email client loads the image and the ESP logs who opened it, when, how many times, and often the device and approximate location from the IP address.

Email Tracking Pixel Consent: How to Ask for Open Tracking Separately From Your Newsletter Sign-up

Open rate has been a standard email marketing KPI for years. In Europe, the legal view of how it's measured has now caught up.

The legal basis: ePrivacy Article 5(3) and the CNIL recommendation

A tracking pixel reads information from the recipient's device, so it falls under Article 5(3) of the ePrivacy Directive, the same rule that covers cookies. The European Data Protection Board has confirmed that Article 5(3) applies to pixel tracking, not only to cookies.

On 14 April 2026, France's CNIL published its recommendation on tracking pixels in emails, adopted on 12 March 2026. The key points:

• Prior consent is the rule for tracking pixels in emails, including when they are only used to measure open rates.
• Consent should be collected when the email address is collected, separately from the consent to receive marketing.
• Every email should give recipients an easy way to withdraw that consent.
• Two narrow exceptions cover emails the recipient asked for, such as order confirmations or password resets: pixels for authentication and security, and pixels that measure deliverability so inactive addresses can be removed.
• For addresses collected before the recommendation, senders had until 14 July 2026 to inform recipients so they could object.

For privacy teams, the important word is separately. Bundling open tracking into the newsletter consent won't meet the standard. Our analysis of the CNIL recommendation goes into more detail.

Designing the sign-up flow

For product managers, the change to the sign-up form is small but deliberate. Keep the existing newsletter checkbox and add a second, unticked checkbox for open tracking. The wording should tell people what the pixel records (whether and when they open your emails, plus technical data such as device, email app and IP address), why you use it, that it is optional, and that saying no doesn't affect their subscription.

The flow then produces two independent answers per subscriber. Someone can subscribe without allowing open tracking, and that has to be a perfectly normal outcome in your data model and your reporting.

Don't forget the other places people subscribe: checkout, account creation, pop-ups and app onboarding all need the same two questions. You also need a way to withdraw from every email, for example a "manage tracking preferences" link in the footer.

What happens to open rates

Marketers will see open rates calculated over a smaller group. That's a reporting change rather than a loss of signal. Apple Mail Privacy Protection and image proxies already inflate or hide opens, so open rate was never as precise as dashboards suggested. Opens from people who agreed to be measured are a cleaner metric, and clicks, conversions and revenue per email are unaffected.

Plan for a short period where you report both the old and the new open rate, so stakeholders understand the drop isn't a fall in engagement.

Proof of consent

Under the GDPR's accountability principle (Article 5(2)) and Article 7(1), you must be able to demonstrate that consent was given. For each subscriber that means a record of the choice, when it was made, what they were shown, and every later change. A boolean field in the ESP that gets overwritten isn't enough on its own.

The ESP also has to act on the answer. If the pixel is still added for subscribers who declined, the checkbox has no effect.

How UniConsent handles it

UniConsent's consent management platform includes an Email open tracking custom purpose template, with wording in English, Italian, French, German and Spanish. It appears in your consent banner and can be used as the separate checkbox in your sign-up form.

Each choice is written to the UniConsent Consent DB, an audit log of consent records, linked to the subscriber. Email addresses are hashed with SHA-256 in the browser before they are stored, and the dashboard lets you search consent logs by typing an email address.

When a subscriber later changes their choice, UniConsent passes it to Klaviyo, Segment, Braze or Brevo if they run on your site. See consent sync for Klaviyo, Segment, Braze and Brevo.

For developers: record the form choice with __unicapi('setCustomConsent', ...) and link it to the subscriber by pushing their email to _unicData as a user ID, which the SDK converts to an email_hash. The full integration, including how to pass the value to your ESP, is in the email open tracking consent guide.

This article is general information, not legal advice.

About UniConsent

UniConsent is a consent management platform (CMP) for websites and apps, supporting GDPR, the UK GDPR, IAB TCF, US state privacy laws and more. Get started for free.