Email Tracking Pixels Are a Consent Problem, Not a Privacy Footnote
A tracking pixel collects personal data the moment an email is opened: the time, an IP address, and usually a device fingerprint, tied to an address you already hold. In the EU that collection needs a lawful basis and a clear notice before the first tracked send, and consent records that only mention the signup form do not cover it.
What the pixel actually reports back
The pixel is a one by one image hosted on the sender side. When the mail client loads it, the server logs the timestamp, the IP address, and the user agent string, and because the image URL carries a unique token, all of that attaches to one recipient. Open rate dashboards present this as an aggregate percentage. Underneath, it is a per person event log, retained by the email platform and exportable by the account holder.
That distinction matters for the notice. A privacy page that says the site uses cookies says nothing about email opens, and a signup form that asks permission to send marketing messages has not asked permission to measure reading behaviour. Regulators reading the file will compare what was collected against what was disclosed, field by field, and the pixel is usually the field nobody disclosed.
Where the consent gap usually sits
Most teams inherit tracking as a platform default. The email tool turns open tracking on, the template carries the pixel, and nobody makes a decision anyone can point to later. When a data subject asks what is held about them, the open history surfaces in the export and the team discovers a processing activity that never made it into the record of processing activities, the vendor assessment, or the retention schedule.
The fix starts with an inventory, not a banner. List every send type, transactional included, and record whether it tracks opens, clicks, or both. Transactional mail is the awkward case: a password reset does not need an open pixel, and keeping one there collects behaviour data with no marketing consent anywhere near it. Our earlier piece on The Consent Record Export Test Every Team Should Run Once a Quarter covers the neighbouring records problem from the audit side.
What to change in practice
Decide per send type whether tracking stays, and write the decision down with the lawful basis next to it. Where tracking stays, the signup notice names it in plain words: we measure whether emails are opened and links clicked, using a small image and tagged links. Where a subscriber objects, the platform needs a suppression that removes tracking for that person, not just an unsubscribe from future sends.
Retention is the second change. Open events from three years ago have no marketing use that survives scrutiny, and they inflate what a breach or a subject access request exposes. Set the platform retention to a period the team can defend, twelve to twenty four months is a common working range, and check that deletions actually propagate to the platform exports and backups on the schedule the policy promises.
Keep reading: The Consent Record Export Test Every Team Should Run Once a Quarter When Purposes Change, Consent Has to Be Asked Again Dark Pattern Consent Banners: The Designs Regulators Name in Complaints.
Frequently asked questions
Do I need consent just to track email opens?
In the EU, open tracking collects personal data and needs a lawful basis, and consent is the basis most marketing programmes rely on. The signup notice should name open and click measurement plainly. A consent record that only covers sending messages does not clearly cover measuring how they are read.
Does turning off Apple Mail Privacy Protection change anything?
Apple Mail Privacy Protection preloads pixels, which makes open data unreliable as a read signal, but the collection still happens and still lands in your platform logs. Inaccuracy is a data quality problem. It does not remove the disclosure and retention duties attached to collecting the events.
Should transactional emails carry tracking pixels?
Usually no. A receipt or password reset needs delivery, not behavioural measurement, and the recipient never gave marketing consent for that message. Removing pixels from transactional sends is the lowest cost reduction in exposure most programmes can make.
How long should we keep open and click history?
Keep it only as long as a named marketing use requires it. Many teams settle on twelve to twenty four months and then delete or aggregate. Whatever period you choose, write it into the retention schedule and verify the email platform honours it in exports as well as in the dashboard.