Tracking pixels have been a standard feature in many newsletter and email marketing solutions for years. They enable businesses to measure the open and click-through rates of the emails they send, allowing for the optimization of email marketing campaigns.
From a privacy perspective, the conditions governing their use have not been entirely clear. In particular, the interplay between the GDPR and the ePrivacy Directive with its different implementations in the Member States left open the question of whether the recipients’ prior consent is always required for the use of tracking pixels. With new guidelines from France and Italy, clearer – yet simultaneously differing – regulatory approaches are now emerging.
The French data protection authority CNIL is taking a strict position. According to their new guidance, prior consent is generally required for the use of tracking pixels used to measure open and click-through rates. An exception applies only if the technology is used just to identify permanently inactive email addresses to remove them from the mailing list. Furthermore, the CNIL imposes strict requirements on the consent request process.
The Italian data protection authority Garante, however, takes a considerably more practical approach. According to their recently published guidelines, no consent is required if tracking pixels are used exclusively to compile aggregated – and therefore anonymous – statistics, without it being possible to trace the behaviour of individual recipients. If, on the other hand, individual analytics profiles are created, consent is required. However, in the Garante’s view, the corresponding consent prompt may also be tied to the newsletter subscription. Businesses can therefore obtain consent for the tracking together with the newsletter opt-in, provided that all other requirements for valid consent are met.
In Germany, the data protection authorities adopted a rather restrictive stance as well. The German Data Protection Conference assumes that the collection of information via tracking pixels generally requires prior consent. However, no specific guidelines on the use of tracking pixels in marketing emails exist as yet, meaning that a certain degree of legal uncertainty remains.
In practice, it is therefore advisable to disclose email tracking during the newsletter sign-up process and – where possible – to obtain consent with the newsletter opt-in. This becomes difficult, however, if the mailing is sent without consent in the first place. In such cases, businesses should refrain from any personalised analytics and only use tracking pixels for the creation of aggregated statistics, if at all.
(Dr. Lukas Mezger, Unverzagt Law)