rdyrct
Dashboard
← All articles

Email Link Tracking and GDPR: What EU Law Actually Allows

Individual-level email open and click tracking requires consent in the EU in nearly every marketing scenario. That is the verdict, full stop. Under the ePrivacy Directive’s Article 5(3) and the EDPB Guidelines 2/2023, tracking pixels and uniquely identified links count as accessing information on a user’s device, which puts them in the same legal bucket as cookies. A handful of narrow exemptions exist for deliverability and security purposes, but they’re tightly scoped and increasingly jurisdiction-specific after fresh guidance from France’s CNIL and Italy’s Garante.

If you’re sending marketing email into the EU right now, take two actions today. First, suspend individual-level open tracking for any recipient whose consent you can’t document. Second, start evaluating anonymized, aggregate-only measurement as your fallback, since it sidesteps most of the consent burden entirely. A privacy-first link platform like Rdyrct is built around exactly that fallback.

Key Takeaways

Individual-level email tracking in the EU requires demonstrable consent in almost every marketing scenario, and aggregate, anonymized measurement is the most durable way to keep performance data without that legal burden.

Point Details
Consent is the default Pixels and identified links fall under ePrivacy Article 5(3) and generally require opt-in consent, not just a GDPR lawful basis.
Exemptions are narrow Deliverability, security, and transactional use cases get limited latitude, but only with minimization and short retention.
Withdrawal must be dynamic Pixel and redirect endpoints should check consent status at request time, not just at send time.
Align to the stricter standard Sending EU-wide means matching the Garante’s tighter aggregate-only rules to avoid fragmenting your tracking logic by country.
Rdyrct offers a lower-risk path Rdyrct’s short links skip default IP storage and report campaign-level analytics, reducing the identifier exposure that triggers consent rules.

Table of Contents

Three techniques dominate email measurement, and they don’t carry the same legal weight.

A tracking pixel is a tiny, often invisible image embedded in an HTML email. When the recipient’s client renders it, their device fires an HTTP request to a server, and that request typically logs an IP address, user agent, timestamp, and a unique identifier tied to the recipient. A tracked link works differently: the visible URL is rewritten to point to a redirect server first, which logs the click and identifier before forwarding the user to the real destination. Read receipts, the oldest of the three, rely on the email client itself sending a notification back to the sender, and most modern clients ignore or block them by default.

Here’s what typically gets collected across these methods:

  • IP address (often geolocated to city or region level)
  • Device and browser fingerprint data from the user agent string
  • A recipient-specific identifier embedded in the pixel URL or the rewritten link
  • Precise timestamp of the open or click event

A click is arguably less intrusive than a pixel because it requires deliberate action rather than passive rendering. But that distinction only matters if the link isn’t rewritten to carry a persistent per-recipient ID. Once it is, you’re processing personal data whether the recipient clicked or just previewed the message. Both techniques land you in the same regulatory territory the moment the identifier can be tied back to a real person.

Why ePrivacy, Not Just GDPR, Governs Email Tracking

The GDPR gets all the attention, but it’s not the law doing the heavy lifting here. Article 5(3) of the ePrivacy Directive governs “storing information, or gaining access to information already stored, in the terminal equipment of a subscriber or user.” That language was written for cookies, but the EDPB’s Guidelines 2/2023 confirmed it applies just as directly to email pixels and to tracked links that trigger a device-side request. The moment your email causes a recipient’s device to send data back to you, you’ve triggered the same consent requirement that governs a cookie banner on a website.

This matters because ePrivacy’s consent bar sits earlier and is stricter than GDPR’s menu of six lawful bases. You cannot reach for “legitimate interest” to justify a tracking pixel the way you might for, say, fraud prevention. Consent is the default, and the exemptions are narrow by design.

Delivery and monitoring are legally distinct processing activities. Having a lawful basis to send an email does not give you a lawful basis to track what happens after it lands.

That distinction, flagged by privacy counsel reviewing the CNIL’s recommendation, trips up more marketing teams than any other point in this area. You can send transactional or even marketing email under legitimate interest or contract performance. But watching what the recipient does with it, individually, is a separate act that ePrivacy regulates on its own terms.

GDPR doesn’t disappear once you clear the ePrivacy consent hurdle, either. It governs everything that happens after the pixel fires: how long you retain the identifier, whether you profile the recipient based on open patterns, and whether you disclose that data to third parties like ad networks. Both regimes run in parallel. The CNIL’s 2026 guidance and the Garante’s 2026 guidelines are best understood as recent, detailed applications of this same underlying framework, not new rules layered on top of it.

For individually identified tracking, consent is almost always the basis you need, even when the underlying email itself was sent under a different lawful basis like legitimate interest or contract. That gap catches out teams who assume one basis covers the whole campaign lifecycle.

Legitimate interest can theoretically support some processing, but for pixel-based or uniquely-linked tracking, it’s a fragile foundation. Documentation experts warn that demonstrable consent is what regulators expect in most marketing contexts, and a legitimate interest assessment (LIA) that skips the balancing test won’t hold up under scrutiny.

If you’re going to attempt an LIA anyway, it needs to include:

  1. The specific purpose you’re pursuing (campaign optimization, deliverability monitoring, fraud detection).
  2. A necessity test showing tracking is the least intrusive way to achieve that purpose.
  3. A balancing test weighing your interest against the recipient’s reasonable privacy expectations.
  4. A documented outcome with a date, the assessor’s name, and a review trigger if circumstances change.

Pro Tip: Run a simple decision tree before you build anything: can this data point be tied back to an identifiable person? If yes, default to consent or anonymize the data at the point of collection. If no, an aggregate legitimate-interest basis is far more defensible.

Most marketing operations skip this test because it’s inconvenient, not because it’s ambiguous. The honest answer, in nearly every commercial email campaign, is that individual identification is both possible and intended. That’s the whole point of open and click tracking. Which means the decision tree above resolves to “get consent” far more often than marketing teams would like.

Narrow Exemptions: Deliverability, Security, and Their Limits

A small set of use cases don’t require opt-in consent, but they’re narrower than most vendors’ marketing copy suggests.

The CNIL’s 2026 recommendation permits tracking for deliverability purposes, monitoring bounce rates and spam complaints, under strict conditions: the data collected has to be minimized, retained briefly, and not repurposed for marketing analytics. The Garante’s 2026 guidelines go further in the other direction, allowing only aggregate, non-individualized measurement, with a preference for a single shared pixel per campaign rather than per-recipient identifiers.

Security and authentication contexts get similar latitude. If a pixel exists to confirm a password-reset email was received, or to flag a suspicious login attempt, that’s a defensible security exemption. Transactional messages, order confirmations, shipping updates, carry a bit more flexibility too, since they’re not marketing communications in the traditional sense.

None of these exemptions are a blank check. Regulators expect:

  • Minimization: collect only what the stated purpose requires, nothing more.
  • Short retention: deliverability and security logs get purged quickly, not stored indefinitely.
  • Anonymization at the earliest point: strip identifiers before the data reaches analytics dashboards.
  • Per-recipient checks: even under an exemption, you generally can’t build a persistent behavioral profile of one person’s engagement history.

The exemption disappears the moment you start using “deliverability data” to segment audiences or personalize send times. That’s marketing analytics wearing a security exemption’s clothes, and it’s exactly the kind of purpose-creep the Garante’s narrower framework was written to close off.

Here’s the practical build order most teams follow, and it works whether you’re retrofitting an existing list or launching a new program.

  1. Capture consent at signup wherever possible. A checkbox specific to tracking, separate from the general marketing opt-in, gives you the cleanest evidence.
  2. For legacy lists without that consent, send a non-tracking email first. No pixel, no rewritten links. Ask explicitly for permission to track future opens and clicks, and require an affirmative action, a click or form submission, to turn tracking on.
  3. Log consent records properly: user ID, timestamp, the exact purpose text shown to the recipient, and the source of the consent event. A vague “subscribed to newsletter” entry won’t survive a regulator’s request for evidence.
  4. Put a single-click withdrawal link in every email footer, tied to a preference center where recipients can toggle tracking off without unsubscribing entirely.
  5. Architect your pixel and redirect endpoints to check consent status at request time, not just at send time. This is the piece most teams miss.

That last point deserves detail. The CNIL specifically recommends a tracked withdrawal link that works without friction, and expects systems to stop logging opens for anyone who’s withdrawn, including on emails already sitting in their inbox. The technical fix is a dynamic consent check: your pixel endpoint queries a consent store when the request comes in, and if consent is absent or has been withdrawn, it still returns the image (so the email doesn’t look broken) but skips persisting any identifying metadata. Mailjet’s technical guidance describes this pattern as the standard way to satisfy the CNIL’s retroactive neutralization expectation.

Pro Tip: If your redirect infrastructure runs on something like Cloudflare Workers, build the consent lookup directly into the worker’s logging logic rather than bolting it onto your analytics layer after the fact. It’s far easier to get right at the edge than to retrofit downstream.

You don’t have to abandon measurement to fix your consent problem. Aggregate-only analytics, where individual opens and clicks feed a campaign-level counter with no persistent per-recipient ID attached, satisfies most regulators’ anonymization expectations because there’s no realistic path back to an identified person.

The engineering pattern is straightforward: decouple identity from measurement entirely. Clicks increment a counter tied to the campaign and link variant, not to the recipient’s email address or IP. You still get open rates, click-through rates, and A/B test results. What you lose is the ability to say “this specific person opened this specific email three times,” which, for most marketing use cases, was never the point anyway.

A few implementation patterns worth knowing:

  • Thresholding: only report metrics once a campaign or segment crosses a minimum recipient count, which prevents re-identification through small sample sizes.
  • No durable IP storage: process the IP for the request, then discard it rather than writing it to a log.
  • Campaign-scoped identifiers only: track “this link, this campaign” rather than “this link, this person.”
  • Short link services designed around this model: a platform like Rdyrct handles the redirect and analytics layer without storing IP addresses by default, giving you country, referrer, and device-level reporting without the individual identifier that triggers ePrivacy’s consent requirement.

What you trade off is real. You can’t do individual re-engagement triggers (“send a follow-up to anyone who didn’t open”) without some form of consented, identified tracking. For most campaigns measuring aggregate performance, that trade is worth making, and it’s a smaller migration lift than most teams expect once the redirect infrastructure is already in place.

Regulator Enforcement Is Diverging by Country, and Timing Matters

France and Italy have taken meaningfully different positions, and that divergence is the single biggest operational headache for anyone sending EU-wide campaigns.

The CNIL’s 2026 recommendation gave organizations a transitional window to bring pixel-based tracking into line, alongside its deliverability exemption and consent-at-capture expectations. The Garante’s 2026 guidelines set a longer transitional period and pair it with a stricter substantive standard: aggregate-only pixels, one shared image per campaign rather than per-recipient tracking, and narrower exemption criteria overall.

If you send to recipients across both countries, and most EU-wide senders do, aligning to the stricter standard rather than building two parallel systems is the more defensible path. Legal analysis of both frameworks consistently recommends this approach specifically to avoid fragmentation risk: a system compliant with the Garante’s narrower rules will generally satisfy the CNIL’s requirements too, but the reverse isn’t guaranteed.

Practical prioritization looks like this:

  • Pull your send volumes by recipient country for the last two quarters.
  • Rank markets by combined volume and enforcement posture, with France and Italy first given the fresh 2026 guidance.
  • Fix the highest-exposure markets first, then extend the same standard to your full EU list rather than maintaining country-specific tracking logic.
  • Treat the UK’s PECR framework as functionally aligned with the EU approach for planning purposes, even though it sits outside GDPR’s direct scope.

Enforcement is shifting from advisory guidance to active review in 2026, with both regulators expecting organizations to have already acted rather than to be still planning.

Your Audit and Remediation Checklist

Run this in order, and assign an owner to each step before you start.

  1. Inventory every tracker. List every pixel, rewritten link, and read-receipt mechanism across your ESP, marketing automation platform, and any third-party embeds in email templates.
  2. Map the data flow for each one. Where does the identifier go, who stores it, and how long does it live there.
  3. Record the lawful basis and consent evidence for each tracker. If you can’t produce a timestamp and purpose text, treat it as unconsented.
  4. Check your processor agreements. Any third party handling tracking data needs a current Data Processing Agreement reflecting this specific use.
  5. Disable individual-level tracking immediately for any EU recipient without documented consent. This is the single highest-impact fix and the fastest to execute.
  6. Add a tracking-specific consent capture point at signup and in a preference center for existing contacts.
  7. Insert withdrawal links in every template footer, wired to the same consent store your endpoints check.
  8. Anonymize historic tracking data where the identifiers can be stripped without breaking existing reporting.
  9. Build a QA test that sends a test email to a withdrawn-consent account and confirms no identifying data gets logged on open.

The QA step is the one teams skip and regret. A policy that says opens aren’t logged for withdrawn consent means nothing if nobody has verified it against the actual running system.

Most compliance conversations treat privacy-first measurement as a cost. It’s actually the cheaper path long-term. A system built to work without individual identifiers doesn’t need constant legal review every time a regulator issues new guidance, because there’s less personal data in it to regulate. It also protects deliverability: recipients who feel surveilled report emails as spam at higher rates. Rdyrct’s decision not to store IP addresses by default, and to build analytics around aggregate campaign performance rather than per-recipient profiles, reflects that same logic: fewer identifiers processed, less legal exposure carried, and reporting that still answers the questions marketing teams actually ask.

Where Rdyrct Fits in Your Compliance Plan

If you’ve read this far, you already know the fix isn’t “track less.” It’s “track differently.” Rdyrct is built as a short link and QR code platform that gives you country, referrer, and device-level analytics without storing IP addresses by default, which sidesteps the exact identifier problem that triggers ePrivacy’s consent requirement in the first place.

Migrating from a rewritten-link tracker that logs per-recipient IDs to a privacy-first short link doesn’t mean giving up campaign performance data. You still get click counts, device breakdowns, and referrer sources for every campaign you run, branded to your domain rather than a generic redirect string. What you drop is the durable, individually-identified log that turns a marketing metric into a GDPR liability. Rdyrct’s free forever plan lets you test that migration on a live campaign before committing to a paid tier, and the self-hosted, open-source option works if your engineering team wants full control over the redirect infrastructure. Set up your first branded short link and see the analytics dashboard for yourself.

Frequently Asked Questions

Does GDPR alone govern email link tracking? No. The ePrivacy Directive’s Article 5(3) governs the initial device access when a pixel fires or a tracked link is clicked, and it generally requires consent. GDPR governs what happens to that data afterward, including retention, profiling, and disclosure.

Can I track email opens without consent for transactional emails? Limited tracking tied to security or delivery confirmation may be defensible, but using that same data for marketing analytics or segmentation isn’t covered by the exemption. Keep transactional tracking narrowly scoped to its stated purpose.

What’s the safest fallback if I can’t get consent from my whole list? Switch to anonymized, aggregate-only measurement for anyone without documented consent. You lose individual-level re-engagement targeting, but you keep campaign performance reporting without the legal exposure.

Is a rewritten click link less risky than a tracking pixel? Only if it isn’t tied to a persistent per-recipient identifier. A rewritten link that logs a unique ID per recipient carries the same consent requirement as a pixel.

How long do I have to fix non-compliant tracking? The CNIL’s 2026 recommendation set a three-month transitional window, while the Garante’s 2026 guidelines allowed six months. Given enforcement is already active in both countries, treat these as deadlines already in effect rather than distant targets.

Sources