France now expects prior consent for most email open tracking.
The 1×1 image marketers have used for years is no longer a harmless analytics default. France's data protection authority, CNIL, published new guidance. PrivacyForge has a useful breakdown for ecommerce teams. The transition period ended on 14 July 2026.
If you email people in France, you need to review how you collect consent and where your platform adds open pixels.
This is not legal advice. Country rules differ, so talk to counsel if you need a formal position. This is the operator read on what changed and what you can do in Bento.
TL;DR: what changed in France
- Most open tracking needs prior consent. That includes campaign analytics, profiling, and interest targeting.
- Two uses can be exempt. CNIL allows narrow uses for deliverability of requested emails and for authentication or security.
- Unsubscribe is not a tracking opt-out. Permission to receive email and permission to track opens are separate decisions.
- The deadline has passed. New contacts needed compliant consent from 14 April 2026. The grace period for older contacts ended on 14 July 2026.
- Bento is moving away from open-based segmentation. The data has become too unreliable to use as a dependable audience filter.
- Bento now gives you three ways to respond. We are disabling opens for
.fraddresses. You can disable opens per email, or support can disable them across your account.
First, what an open pixel does
An open pixel is a tiny image inside an HTML email. When the recipient's email app loads it, the sender records an open. The request can include the time, device, and IP-derived location.
The pixel does not read the recipient's other emails. But it does let the sender observe when and how someone views a message. That remote request is why CNIL treats it like other device tracking, including cookies.
Open data was already noisy. Apple Mail Privacy Protection can preload the image. Gmail can proxy it. Security tools can fetch it before a person reads the email. An open is an image request, not proof that a human read your message.
We cover those limits in what delivery, opens, and clicks actually mean and why open and click rates often look fake.
The legal rule in plain English
CNIL adopted its recommendation on 12 March 2026 and published it on 14 April 2026.
The dates depend on when you collected the address:
- Before 14 April 2026. You had until 14 July 2026 to obtain consent or clearly inform the recipient and offer an easy opt-out.
- On or after 14 April 2026. You needed compliant consent from the moment you collected the address.
That transition is over. Non-exempt pixels now need prior consent. CNIL said it would help organisations through the transition before moving to compliance checks, so 14 July was not a promise that fines would arrive the next morning.
CNIL is applying an existing rule, not creating a new GDPR article. The legal basis comes from Article 82 of the French Data Protection Act and Article 5(3) of the ePrivacy Directive. The practical rule is familiar. Ask before you store or read information on someone's device.
GDPR Article 7 defines what valid consent looks like. It must be freely given, specific, informed, and unambiguous. A pre-ticked box does not work. Withdrawing consent must be as easy as giving it.
Legitimate interest is the lawful basis marketers often reach for when measuring campaigns. It is not a shortcut here. It does not replace the consent required for non-exempt device tracking.
CNIL's recommendation is French regulatory guidance, but the ePrivacy rule exists across the EU. The EU's data protection board said in 2023 that pixel-style tracking falls under that rule. Italy's data protection authority has issued binding guidance in the same direction. The UK has an equivalent device-access rule under the Privacy and Electronic Communications Regulations. If you email recipients in France, the French requirement applies even when your company is elsewhere.
When email tracking pixels need consent
CNIL draws the line by purpose:
| How you use the pixel | Consent needed? |
|---|---|
| Deliverability of emails the recipient requested, including list hygiene, inactive-address detection, and send-frequency tuning | No, if kept strictly to that purpose |
| Authentication or security | No |
| Open-rate and campaign-performance analytics | Yes |
| Behavioural or interest profiling | Yes |
| Fraud analysis | Yes |
The important row is open-rate analytics. The reporting most marketers want needs consent.
The exemption is narrow. You may use a pixel to identify inactive addresses for list hygiene. If the same data also feeds campaign reporting, A/B decisions, or customer profiles, you cannot rely on the deliverability exemption for those extra uses.
Consent needs its own switch
Newsletter consent and tracking consent are different decisions. Do not bundle them into one checkbox.
That split also matters for B2B lists. A soft opt-in may let you send the message, but the analytics pixel still needs its own consent.
A compliant setup should:
- Explain that you track email opens and why.
- Let the person refuse tracking without losing the newsletter.
- Keep the choice unselected until the person acts.
- Offer a tracking opt-out that is as easy to find and use as the opt-in.
- Store what the person agreed to, when they agreed, and any later withdrawal.
An unsubscribe link only stops future email. It is not a withdrawal of tracking consent. Keep a dated record of the wording and the person's choice. A platform default is not proof.
For an existing list, CNIL suggests sending one pixel-free email to a consent screen when collecting the choice at signup is no longer practical.
What Bento is changing
.fr addresses
Starting 2 August 2026, Bento is disabling open tracking for recipient addresses ending in .fr.
This is a useful safety default, but it does not identify every French recipient. Someone in France may use Gmail, Outlook, or another address that does not end in .fr. You still need a consent process for the people you email.
Open-based segmentation
Bento is disabling open-based segmentation more broadly. We have wanted to do this for a while. Open tracking has become so unreliable that it is a weak way to decide who belongs in a segment.
Privacy tools, image proxies, and security systems can create an open event when nobody read the email. Image blocking can hide real readers. For segments that matter, use clicks, replies, purchases, and first-party events instead.
Individual emails
Add this Liquid tag to an email in a broadcast or flow:
{{ "true" | disable_opens }}
It disables open tracking for that email. Use it whenever you do not have consent or do not need open data.
Your whole account
Open a support ticket if you want Bento to disable open tracking across your account. We can switch it off globally while you review your forms, automations, and consent records.
These controls apply to open tracking. Review click tracking separately as part of the same audit.
What to do now
- List every email stream. Check broadcasts, welcome flows, cart recovery, product messages, and transactional email.
- Write down why each stream uses opens. Separate narrow deliverability uses from analytics and profiling.
- Fix consent collection. Give tracking its own clear choice and record the wording, date, and purpose.
- Add a withdrawal path. Do not make people unsubscribe just to stop open tracking.
- Disable tracking where you cannot prove consent. Use Bento's
.frdefault, the per-email Liquid tag, or an account-wide support request. - Move important decisions away from opens. Prefer replies, purchases, sign-ins, and first-party product events. Our open and click tracking guide explains why.
The open pixel was always a remote image request dressed up as engagement. France has now put a consent requirement and a deadline around it.
If you need help deciding where to disable opens in Bento, send support a list of your broadcasts and flows. We will help you work through it.