Consent and Email Tracking Pixels: The Inbox Is a Tracking Surface Too
Privacy programs tend to stop at the website boundary. The banner is tuned, the cookie table is written, and then the email platform quietly appends a unique pixel to every send, logging opens by recipient, device, and approximate location, with settings nobody on the privacy side has ever seen.
Regulators do not share the boundary. Tracking is tracking whether the identifier sits in a cookie or an image request, and several European decisions have treated undisclosed email tracking as exactly the kind of invisible processing consent law exists to catch.
What the pixel actually collects
An open pixel records that a specific recipient's client loaded images, when, and usually the IP address, which yields rough geography and sometimes an employer network. Click tracking routes every link through a redirect that binds the click to the person, not the campaign in aggregate. Together they build a per person engagement record that is personal data by any definition the fleet's other properties apply.
Apple Mail Privacy Protection muddied the open metric by prefetching images, which made open rates unreliable. It did not make the processing disappear. Data still flows on other clients, and click data is untouched by the change.
The settings that decide your exposure
Most platforms let you disable open tracking, disable per-recipient click tracking, or anonymize at the campaign level. Those switches, and who decided their positions, belong in the privacy record next to the cookie table. A program that can produce its cookie inventory but not say whether its email tracks opens has a hole shaped exactly like its largest channel.
Disclosure is the floor everywhere: the privacy notice should say email engagement is measured, how, and how to stop it. The workable pattern offers tracking free sending for people who opt out of measurement while staying subscribed, or accepts that measurement opt out means unsubscribe in simpler stacks, and says so plainly.
Coordinate the two consent records
A user who rejects tracking on the site and then gets individually tracked email from the same company has experienced a contradiction, whatever the legal technicalities. Where the tooling allows, suppression and preference choices should travel between web and email systems, or the gap should be a documented decision rather than an accident of separate vendors.
Related reading
These earlier guides cover connected questions in more depth: When Consent Signals Disagree: Troubleshooting CMP, Tag Manager, and Vendor State, Consent and Email Tracking Pixels: The Inbox Is a Tracking Surface Too, and Consent Log Retention When You Change Vendors: Export First, Cancel Second.
Frequently asked questions
Is email open tracking illegal in the EU?
Undisclosed or non-consented tracking has drawn enforcement and is widely treated as requiring consent under ePrivacy rules as applied in several member states. The safe position is consent at signup, clear disclosure, and a real way to opt out of measurement.
Does Apple Mail Privacy Protection solve the problem?
No. It degrades open data for Apple Mail users but tracking still operates elsewhere, and click tracking is fully functional. It is a measurement problem for marketers, not a compliance solution.
Can we keep aggregate email reporting without individual tracking?
Yes. Campaign level counts, total opens and clicks without per recipient binding, satisfy most reporting needs with a fraction of the exposure. Ask whether anyone actually acts on the per person record before defending it.
Should the signup form mention tracking?
The layered approach works: a short line at signup that engagement with emails is measured, linking to the full notice section. Silence at signup plus a buried notice paragraph is the pattern that reads as concealment.