Email Tracking in France and Italy

Email tracking consent requirements for recipients in France and Italy.

If you send email to anyone in France or Italy, the way you track opens and clicks has just changed. France’s data protection authority (the CNIL) and Italy’s regulator (the Garante) have both ruled that the tracking pixel in your emails is, in legal terms, the same kind of technology as a cookie. It accesses the recipient’s device, so it needs the same kind of consent.

The French rules are already in force: the CNIL’s recommendation was published on 14 April 2026, and the transition period for existing contacts ended on 14 July 2026. Italy’s provision was published on 29 April 2026, with a six-month window for existing contacts running to late October 2026.

This applies regardless of where your business is based. A US company, a UK agency, an Australian SaaS: if a tracked email lands in a French or Italian inbox, the rules apply to that send.

Here is what changed, and how to handle it in BigMailer.

A quick note before we start: this is operational guidance for email senders, not legal advice. Talk to your legal counsel or Data Protection Officer before finalising your consent model.

What changed

A tracking pixel is a tiny invisible image embedded in your email HTML. When the email is opened, the recipient’s mail client loads the image from your email platform’s server, and that request is what registers the “open”. The European Data Protection Board confirmed in 2024 that loading a pixel counts as accessing information on the user’s device under the ePrivacy Directive, which is the same legal basis that requires consent for cookies.

France and Italy are the first regulators to turn that position into formal guidance with deadlines attached. The key point in both countries: consent to receive your emails and consent to be tracked inside them are two separate permissions. Someone can be validly subscribed to your list and still not have agreed to the pixel.

France (CNIL recommendation, published 14 April 2026):

• Tracking consent must be collected separately from marketing consent. A single sign-up checkbox covering both is not enough.
• Contacts collected before 14 April 2026 could continue to be tracked during a transition period, provided you informed them about the pixel and gave them a way to object by 14 July 2026. If you didn’t do that, tracking those contacts should stop until you have consent.
• Contacts collected on or after 14 April 2026 need explicit tracking consent from the point of sign-up.
• Recipients must be able to opt out of tracking without unsubscribing from your emails.
• There is a narrow exemption for deliverability management (suppressing inactive contacts, adjusting frequency), but only if you store nothing more than the date of last open and use it for no other purpose.

Italy (Garante provision, published 29 April 2026):

• Italy allows tracking consent to be bundled with marketing consent, as long as the request is neutral and both purposes are clearly explained.
• Contacts collected before 29 April 2026 can continue to be tracked during the six-month window, provided you tell them about the pixel in your next email and give them a way to opt out.
• Contacts collected on or after 29 April 2026 need consent in place before any tracked email goes out.
• The opt-out must work independently of the unsubscribe. One “unsubscribe from everything” link does not satisfy this. The Garante wants a separate, clearly visible mechanism in the footer.
• Italy’s exemption for anonymised tracking is narrower than France’s: it requires a single shared pixel per campaign with fully anonymised IPs, which standard per-recipient ESP tracking does not meet.

What is not covered by any exemption in either country: campaign open-rate reporting, lead scoring based on opens, segments built on open behaviour, sales alerts on opens, send-time optimisation using individual open history, and re-engagement automations triggered by non-opens. In other words, nearly everything marketers actually use open data for.

The practical choice

You have two realistic paths:

1. Turn tracking off for your French and Italian contacts. No consent needed, no compliance question about the pixel. The trade-off is losing open and click data for that part of your list.
2. Collect proper consent and keep tracking the contacts who agree. This requires changes to your sign-up forms and preference handling, and your legal team should be involved in the wording.

For a lot of senders, turning tracking off for the affected segment is the faster, lower-risk starting point. You can always build the consent path afterwards. The rest of this post walks through the no-tracking route in BigMailer.

Step 1: Find your French and Italian contacts

You can’t act on contacts you can’t identify, and this is where a lot of senders get stuck: they never captured country data.

If you’re on BigMailer, you have more to work with than you might think. BigMailer captures location data when a contact clicks a link in your emails and when they sign up through a BigMailer form. So even if you never asked for a country at sign-up, a portion of your list already has location data attached from their own activity.

Combine three sources:

• Your own country field, if you collect one at sign-up or have it synced from your CRM.
• BigMailer’s captured location data from clicks and form signups.
• Email domain matching for French and Italian mailbox providers. The main ones to look for: @orange.fr, @wanadoo.fr, @laposte.net, @sfr.fr, @free.fr for France, and @libero.it, @virgilio.it, @alice.it, @tin.it, @tiscali.it, @email.it for Italy.

None of these is complete on its own. A French subscriber with a Gmail address and no click history won’t match any of them. Act on the contacts you can identify, and ask your DPO how to treat the unknowns.

Step 2: Build the segment in BigMailer

Create a segment that combines those signals with OR logic. Conceptually:

Segment: France + Italy contacts Match contacts where ANY of the following is true:

• Country field is France or Italy
• Captured location (from clicks or form signup) is France or Italy
• Email address contains any of the French or Italian provider domains above

Example BigMailer segment using ANY conditions to identify French contacts by location and email domain.

You can also create the inverse segment (contacts matching none of those conditions) so you have a clean “rest of world” audience for your normal tracked sends.

Step 3: Send to that segment with tracking off

BigMailer lets you control open and click tracking per campaign. The working pattern:

1. Duplicate your campaign.
2. Set the audience of the copy to your France + Italy segment, and exclude that segment from the original.
3. In the copy, uncheck open tracking and click tracking before sending.

Example BigMailer segment using ANY conditions to identify French contacts by location and email domain.

 

Two versions of each campaign is extra work, but it keeps you compliant today without waiting on anything. Build it into your send checklist so it happens every time, because the French rules in particular allow no exceptions once the transition period has passed: one tracked send to the segment is one tracked send too many.

If you run automations, review every one that touches these contacts. Any flow triggered by opens, or any suppression rule based on non-opens, will treat untracked contacts as permanently disengaged and quietly remove people who read everything you send. Rebuild those triggers around clicks on your tracked audience, and around replies, purchases, or site activity for the untracked segment.

Step 4: Fix your reporting before it confuses you

Once tracking is off for these contacts, they will register zero opens and zero clicks while still counting in your send totals. Your averages will drop, and it will look like an engagement problem when it’s a measurement change.

Exclude the France + Italy segment from your campaign benchmarks, or report on it separately. Otherwise you’ll spend months explaining a performance dip that isn’t real, or worse, “fixing” content and frequency that were never broken.

For the untracked segment, the signals that still work: replies, conversions and purchases, unsubscribes, and complaint rates. These were always the more honest metrics anyway. Between Apple Mail Privacy Protection inflating opens since 2021 and Gmail’s AI features auto-loading images, open rates were a shaky signal long before regulators got involved.

Step 5: If you want to keep tracking, do the consent work properly

If open data for these markets genuinely matters to your programme, the consent route is available:

• Add a separate, unchecked tracking consent option to your sign-up forms for French contacts, with plain-language wording about what the pixel does. Italy permits bundling with marketing consent if the request is neutral and both purposes are explained.
• Add a tracking opt-out to your email footer that works without unsubscribing, with the same prominence as your unsubscribe link.
• If you email existing contacts to tell them about tracking or ask for consent, send that email with tracking off. A pixel firing in the email that asks permission for the pixel defeats the whole point.
• Get your legal team involved in the wording. This part isn’t something to improvise.

Don’t treat this as a two-country problem

The ePrivacy Directive that the CNIL and Garante applied exists in identical form across every EU member state, and the EDPB position they built on is available to every other European regulator. The UK’s PECR takes a comparable view of cookie-like technologies. France and Italy simply moved first.

If you’re building segments, consent capture, and a tracking preference option for these two countries, build them so they can extend to your whole list. The incremental effort now is small compared to redoing it country by country as more regulators follow.

Author: Pavel Ivanishchev