The open rate has been the most closely watched email metric for twenty years. It relies on a mechanism most teams have never assessed from a legal standpoint: an invisible pixel, loaded when the message is opened. Since April 14, 2026, this mechanism falls under the same rules as cookies. In other words, for a large share of your uses, measuring an open now requires the recipient's consent.
The CNIL, the French data protection authority, adopted this position on March 12, 2026 (deliberation no. 2026-042), then published it on April 14. It gives organizations three months to get their existing databases in order. The deadline is July 14, 2026, and audits have been announced from that date.
For a HubSpot user, the real question is not “should we turn off tracking”. It is: which uses of open data currently rely on a non-consented pixel, and how can these uses be secured without breaking campaign management.
The CNIL's reasoning fits in one sentence: inserting a tracking pixel means performing a read operation on the recipient's device. As such, the practice falls under Article 82 of the French Data Protection Act, the text that already governs cookies and trackers. The pixel therefore follows the consent logic, like a cookie.
Two principles structure everything else.
First principle: the purpose is what matters, never the type of email. A pixel is not “exempt” because it sits in an order confirmation. It is exempt or not depending on what you do with the data collected.
Second principle: the rules for the pixel are independent of those for the email. You may have the right to send a prospecting email (valid legal basis) and not have the right to measure its opening without consent. The two consents are separate.
A point many will miss: B2B is concerned. The recommendation makes no exception for exchanges between professionals. If you think you are not affected because you do B2B emailing, the opposite is true: B2B marketing automation and emailing are explicitly cited as the cause of the rise in complaints that prompted the text.
The CNIL divides pixel uses into two regimes. Here is the summary to keep at hand when auditing your campaigns.
| Purpose of the pixel | Regime | Basis |
|---|---|---|
| User security and authentication | Allowed without consent, strictly limited | Art. 82 exemption |
| Individual deliverability measurement on transactional or expressly requested emails | Allowed without consent, strictly limited | Art. 82 exemption |
| Managing inactive contacts (stopping or reducing sends to those who no longer open) | Allowed without consent, but only the date of the last known open, to the day | Deliverability exemption |
| Measuring opens to optimize / analyze campaign performance | Consent required | Tracker rules |
| Personalizing content based on opens | Consent required | Tracker rules |
| Adjusting frequency or choosing between channels (email / SMS / push) | Consent required | Tracker rules |
| Profiling, targeting in other environments | Consent required | Tracker rules |
| Certain fraud detection purposes | Consent required | Tracker rules |
The transactional exemption is narrower than most teams imagine. It covers deliverability measurement on messages linked to a requested service: welcome email, order confirmation, shipping notification, invoice, password reset, customer service reply. It does not cover marketing personalization added to these same messages. A marketing pixel slipped into a transactional email remains subject to consent.
And for managing inactive contacts, the constraint is concrete: you can only keep the date of the last open, to the day. Not the detailed open history, not the time, not the device. This is enough to remove a contact who has gone silent, not to feed an engagement score.
Sources: CNIL recommendation on tracking pixels and the CNIL's summary for the general public.
The topic becomes tangible when applied to everyday HubSpot objects. Here are the common uses and their exposure.
| HubSpot use | Relies on | CNIL exposure |
|---|---|---|
| Segmenting non-openers for follow-up or cleanup | Individual “email opened” event | Gray area: OK if the purpose is “managing inactive contacts” (date of last open only), consent required if the list is used for follow-up / personalization |
| Workflows triggered on Marketing email open | Individual open measurement | Consent required as soon as the open serves a marketing scenario (nurturing, lead scoring, re-engagement) |
| Individual personalization based on open behavior | Open linked to the contact | Consent required |
| Aggregated performance reporting (a campaign's open rate) | Opens, aggregated | Less exposed if truly aggregated and not linked to the contact, but the aggregate is built from individual measurements: to be assessed |
| Lead scoring including email opens | Individual open | Consent required |
| Choosing channel / cadence based on email engagement | Individual open | Consent required |
The operational consequence is direct: the volume of measurable opens will fall. Mechanically. Only consenting contacts will still be measured, and your engagement curves will drop without your campaigns having changed. Teams that do not anticipate this will diagnose a deliverability problem where there is none.
It is also an opportunity to repeat a point we make in our projects: the open rate has never been a good KPI. Image pre-fetching (Apple Mail Privacy Protection, Gmail proxies) has already been inflating it artificially for years. The CNIL recommendation speeds up an underlying shift toward first-party measurement: authenticated clicks, visits, replies, purchases, declared preferences. The signals that remain robust are those the recipient produces voluntarily.
The drop in measurable opens is not only a reporting problem. The open is an input for a whole downstream mechanism, and it is this mechanism that will silently go wrong if you do not rework it.
If your scoring model gives points for email opens, it will no longer score engagement: it will score consent. A highly engaged contact who has not consented to the pixel will be artificially capped, while a consenting contact with moderate interest will climb. The bias is invisible in reports, but your sales reps will see it: less qualified MQLs, hot contacts never surfaced.
The fix is to shift scoring weight back to first-party signals: clicks, page visits, form submissions, replies, event attendance. Opens can stay in the model, but as a supplementary signal, never as a deciding criterion.
A classic scenario: “if the email is opened, send the next one; otherwise, follow up with another subject line”. With a growing share of unmeasurable contacts, the “not opened” branch fills up with contacts who may have opened, and your follow-ups are perceived as duplicates.
Map all workflows with a trigger or condition based on “Marketing email open”, and replace the logic with robust events: click in the email, visit to a target page, registration, reply. Click-driven nurturing is lower in volume, but every signal in it is reliable.
Email subject line tests are traditionally decided on open rate: on a partially measured population, the winner of a test may simply reflect the consenting makeup of the sample. The same caution applies to reports: comparing the September 2026 open rate with January's means comparing two different scopes.
Switch your comparisons to cohorts (measurable contacts only), decide your tests on click rate, and record the switchover date in your dashboards so that nobody interprets the drop as poor campaign performance.
The common thread is the same everywhere: fewer signals, but more reliable ones. Teams that rebuild their mechanisms on this basis will come out of the project with healthier management than before the recommendation.
HubSpot already documents that France and Italy require the recipient's consent before using open and click tracking pixels, and that this requirement applies to any sender writing to recipients located in these countries, whatever the sender's country. On the HubSpot side, there are currently two levers.
You can turn off open and click tracking for all your marketing emails at account level: Settings > Tools > Marketing > Email > Tracking, then switch off the Track email opens toggle. A useful detail: this setting is global, not regional. It does not target France only; it turns tracking off everywhere.
It is a blunt switch. Turning tracking off globally to solve a compliance problem means giving up measurement across the entire database, including consenting contacts and contacts outside the affected area. For an agency or a multi-market organization, this is rarely the right answer.
Configuration detail: click tracking is set separately (Track clicks in HTML emails, Track clicks in plain text emails). And even when you turn off open tracking, HubSpot continues to collect this data anonymously for the health of its sending infrastructure. Check this with your DPO in light of the purpose.
Documentation: managing open and click tracking for marketing emails.
This is the granular answer to the problem posed by the global toggle. HubSpot has opened a beta that lets you override the global tracking setting (opens and clicks) for an individual marketing email, directly in the Setup tab of the email editor. A Super Admin of the portal can request access to this beta from the Product Updates page.
In practice, this enables the clean scenario: keep tracking on campaigns sent to consenting contacts, and turn it off email by email on sends where you cannot justify consent (enriched transactional emails, sends to a part of the database that has not been informed, etc.).
Important caveat: this is a beta, and its scope and access conditions are changing. Availability must be checked in the relevant portal at the time of implementation.
The work can be scoped. Here is the order in which we carry it out in our projects.
1. Audit campaigns by purpose. Review each type of send (newsletter, nurturing, transactional, prospecting) and qualify the actual use of open data. The question is not “is this a marketing email”, it is “what is the pixel used for here”. Then map everything in HubSpot that consumes the open event: workflows, active lists, scoring properties, reports.
2. Update collection forms. For any new address collected since April 14, 2026, consent to the pixel must be obtained, separately from consent to prospecting, through a clear positive action. No pre-ticked box. Silence means refusal. Information about pixels can appear on the form, at the moment the contact gives consent.
3. Inform the existing database. For contacts collected before April 14, 2026, no retroactive re-consent is required. But there is an obligation to provide clear information, with a simple way to object, to be sent before July 14, 2026. An information email is enough: it explains the use of pixels, specifies the purposes and offers an opt-out link. This is the transitional regime, and it is good news operationally.
4. Update the footer and notices in emails. Provide an accessible notice on the use of pixels and an objection or withdrawal mechanism as simple as consent itself. Withdrawal must be as easy to exercise as consent (a button of the same visibility).
5. Update the privacy policy. Document the use of tracking pixels, the purposes, retention periods (reminder: date of last open, to the day, for managing inactive contacts) and how to exercise rights.
A cross-cutting rule: you must be able to prove your purposes and consents in the event of an audit. Traceability is not a side deliverable; it is the document the CNIL will ask for.