The dates that matter:
| Date | What it means |
|---|---|
| April 14, 2026 | CNIL recommendation published. Contacts collected after this date need pixel consent at collection |
| July 14, 2026 | Deadline to send a notice with opt-out to contacts collected before April 14. Do it and non-objectors stay trackable. Enforcement expected after this date |
| October 28, 2026 | Italy's deadline under the Garante provision |
What to do, in order:
- Count contacts with a France or Italy country value in every instance you run.
- Send the notice and opt-out email to your pre-April French base before July 14. Stagger the send.
- Add pixel consent to forms as a separate, unchecked field.
- Build conditional tracking (steps below).
- Audit every scoring rule, trigger, and report that consumes an open event, and annotate dashboards where French open rates will step down mid-July.
The Marketo setup
Per Adobe's configuration guide (updated July 8): create a custom boolean Person field ("Email Pixel Tracking"), populate it by import, sync, and forms. Clone each email touching France and check "Disable open tracking" on the clone. In the Send Email flow step, add a choice: consent false gets the untracked clone, default gets the original.
The HubSpot setup
A Super Admin opts the portal into the "Switch off tracking per marketing email" beta. Create a pixel-consent contact property, split each send into consented and non-consented lists, duplicate the email, and toggle off "Track opens and clicks for this email" on the copy. HubSpot has no per-contact or per-country suppression yet, so list splits and duplicated sends carry the logic.
That is the whole job. Everything else you might be wondering is below.
If you run Marketo or HubSpot and want this handled, that is what we do. The scoped version: notice email to your French base, consent field, conditional tracking, and an audit of every open-dependent scoring rule and workflow. Reach out to us.
FAQ
We only do B2B prospecting. Are we really covered?
Yes, and the CNIL went out of its way to say so. French law lets you prospect professionals by email on an opt-out basis when the content relates to their role. The recommendation states plainly that this does not extend to the pixel. The email can be opt-out. The tracking cannot.
What is the legal mechanism here?
Article 82 of the French Data Protection Act, the French transposition of the ePrivacy Directive's cookie rule. A pixel reads information from the recipient's device, which makes it the same category of operation as a cookie: prior consent, given by a positive act, silence counts as refusal. The EDPB confirmed this reading applies to pixels in its Guidelines 2/2023, which is why other EU regulators are expected to follow France and Italy.
Does anything still work without consent?
Two exemptions. Security and authentication pixels. And deliverability measurement for list hygiene, on transactional emails only, where you may retain only the date of last open: no time, no history, no device data. Open-rate reporting, open-based personalization, and open-based scoring all require consent.
Can we just turn tracking off globally?
You can, and it is the fastest path to compliance. HubSpot has an account-level switch, and Marketo can disable tracking per email everywhere. You also lose open data for every consented contact and every recipient outside France and Italy, which for most databases is nearly all of them. Conditional tracking costs more to build once and nothing after.
What happens if we do nothing?
Enforcement is expected after July 14. Nobody has been fined over an email pixel yet, and the regulator's pattern on new guidance is formal notices before sanctions. But the CNIL's record under this exact law includes over €139 million in cookie fines between 2022 and 2024 and a €325 million fine against Google in 2025, with a statutory ceiling of 4% of global turnover or €20 million. The realistic near-term risk for a B2B sender is a complaint-triggered notice. The realistic cost of compliance this week is one email to your French list.
We will miss July 14. Now what?
Send the notice anyway. The three-month window is worded "in principle" and a notice sent July 20 puts you in a defensible position. A notice never sent does not. Lose the window entirely and the fallback is re-permissioning the French base for tracking, a consent campaign with the response rates you would expect.
Does this apply to us if we are not a French company?
It applies based on where your recipients are. A US or Israeli sender emailing contacts in France is in scope for those contacts.
How is Italy different?
Same principle, different details. The Garante allows pixel consent to be bundled with marketing consent if the wording is neutral, permits an anonymized aggregate pixel for campaign-level stats, and requires that recipients can stop tracking without unsubscribing. Sending to both markets means building for the union of both rulebooks. The French deadline is the one that sets your timeline.
Is click tracking affected?
Not by the published text, which is scoped to pixels. Some commentators argue the same doctrine reaches tracked links eventually. Watch item, not action item, and one more reason to keep click data clean: it is about to carry your reporting.
What does this do to our scoring and workflows?
Open data for French recipients becomes consent-biased: a scoring model that awards points per open now scores willingness to be tracked, and workflows branching on "opened email" will re-send to people who opened untracked. Move scoring, triggers, and A/B decisions to clicks, form fills, page visits, and replies. Apple Mail Privacy Protection forced the same rework in 2021, in the other direction. If you rebuilt for MPP then, this one is shorter.
Why did HubSpot email our admins on July 2?
HubSpot notified portal admins about the French and Italian guidance and shipped the per-email tracking toggle in beta the same day. One trap reported by admins in HubSpot's community: setting a contact's GDPR legal basis re-enables tracking for that contact, so do not rely on GDPR settings to carry pixel consent.