CNIL and Garante Compliance

France and Italy have changed the rules on email tracking. rezora now lets you turn off link tracking and open tracking for specific contacts, so you can stay compliant without giving up tracking everywhere else.

Why This Changed

Both countries now treat tracking pixels the same way they treat cookies: as something that requires consent before you use it.

• France (CNIL): As of April 14, 2026, tracking pixels used for open-rate measurement, campaign optimization, or profiling require the recipient's consent. If you added a contact before that date, you have until July 14, 2026 to notify them or stop tracking their opens. New contacts need consent from day one.

• Italy (Garante): As of April 29, 2026, the same standard applies. Businesses have until October 28, 2026 to comply, and recipients must have an easy way to opt out of tracking specifically, separate from unsubscribing entirely.

Deliverability-only tracking (adjusting send frequency, pausing sends to inactive addresses) is exempt in both countries. Tracking used to measure engagement or build profiles is not.
 

Understanding the CNIL Recommendation

Open tracking works the same way across the email industry: a small, invisible pixel embedded in an outgoing email that registers when the message is opened. This is the standard mechanism most email platforms use, and it's exactly the mechanism the CNIL's recommendation addresses.

In short, the CNIL has stated that tracking pixels in emails may only be used with the explicit, prior consent of the recipient, unless the use falls under a narrow set of exemptions, such as basic email delivery management, user authentication, or removing inactive addresses from a database. Uses like campaign optimization, profiling, or fraud detection are not exempt and require consent.

You can read the CNIL's full recommendation directly on their site: CNIL Recommendations on Tracking Pixels in Emails.
 

What's New in rezora

You can now disable link tracking and open tracking on a per-contact basis, without turning it off for your whole list. This means:

• Contacts in France and Italy who haven't consented can be excluded from tracking while the rest of your campaign tracking stays intact.

• No need to run separate campaigns or duplicate templates to manage this.

• Settings apply automatically going forward, so you don't have to remember to toggle it send by send.

If most or all of your list falls under these rules, or you'd rather not manage it contact by contact, you can also turn off link and open tracking account-wide in one setting.

In addition to being able to control these settings yourself, contacts can control their preferences directly after receiving an email by clicking on "Opt out of future emails" at the bottom of an email sent to them through rezora, then utilizing the "Open and Click Tracking" settings.

What You Should Do

If your contact list includes recipients in France or Italy, review how and when you collected their consent. For anyone without clear consent to be tracked, use the new setting to turn off open and click tracking on their contact record.

Should You Talk to a Lawyer?

Whether the CNIL Recommendation requires you to notify recipients or obtain their consent depends on your specific situation, including whether your emails are sent for commercial purposes, whether French privacy law applies to your organization, and how your contact list was originally collected. Because these factors vary from business to business, it may be recommended to check with a lawyer about what steps you may need to take to comply with the CNIL Recommendation.