Email tracking pixels

A pixel that records who opens an email stores and reads information on the reader's device. What that means for senders in the UK and the EU, and what to change.

Markmatix editorial teamUpdated 3 November 20266 min

Email · measurement

  • Open pixelonly with consent
  • Tracked linksonly with consent
  • Withdraw measurement onlylink in every email
  • Without consentemail with no pixel

measurement off by default

Example: how we are designing it, with made-up data.

In short A tracking pixel in an email is a storage and access technology. In the UK, PECR regulation 6 applies to it, separately from the email marketing rules in regulation 22. In the EU, Article 5(3) of the ePrivacy Directive applies, as the EDPB confirmed in 2024. Unless an exception fits, you need consent before you track opens. Telling people is always required. Italy has issued specific guidelines, with an adaptation period that ended on 29 October 2026.

What a tracking pixel does

A tracking pixel is a tiny image, often invisible, that lives on a server rather than inside the email. When someone opens the message, their email client fetches it. That request tells the sender, or a partner, that the email was opened. Depending on how the pixel is built, it can also reveal when, how often, on which device and, through the IP address, roughly where. You will also see it called a web beacon or a spy pixel.

The rule in the EU: Article 5(3) ePrivacy

Article 5(3) of Directive 2002/58/EC allows storing information on a user's device, or accessing information already stored there, only with consent based on clear and comprehensive information. The exceptions are storage or access needed solely to transmit a communication, or strictly necessary for a service the user explicitly asked for.

The EDPB's Guidelines 2/2023 on the technical scope of Article 5(3), adopted in final form on 7 October 2024, deal with pixels directly (paragraphs 47 to 51):

  • delivering a pixel to the device, even if it is only cached by the email client, is storage;
  • the pixel is an instruction to the device to send back an identifier, so collecting it is gaining access;
  • tracking links that carry an identifier in the web address work the same way.

So Article 5(3) applies to email open tracking, and to per-recipient tracked links too.

The rule in the UK: PECR regulation 6

Since 5 February 2026 regulation 6 of PECR has been in a new form, substituted by section 112 of the Data (Use and Access) Act 2025. You must not store information, or gain access to information stored, on a subscriber's or user's device unless an exception in the new Schedule A1 applies. Consent, with clear and comprehensive information about the purpose, is one of them.

The ICO's guidance on storage and access technologies, finalised in April 2026, names tracking pixels and gives an email example. Most email marketing is governed by regulation 22, it says, but where tracking pixels store or access information on a device, regulation 6 applies. The ICO's email marketing guidance makes the same split. The marketing rules apply to the email itself, and if the email includes tracking pixels you must also comply with the rules on storage and access technologies.

An open question: the statistical purposes exception

Schedule A1 now includes an exception for collecting information for statistical purposes about how a service, or the website it runs on, is used, with a view to improving it. It needs clear information and a simple, free way to object. The ICO reads it narrowly. It covers aggregate statistics about how your service is used, not who uses it. It is not for identifying, tracking or monitoring people, and it never covers online advertising.

The ICO's guidance does not say whether an aggregate count of email opens can rely on this exception. Per-recipient open tracking looks like tracking individuals, which the exception does not cover. Don't assume that an anonymous open rate is exempt in the UK: take advice.

Italy: specific guidelines from the Garante

The Italian data protection authority has issued guidelines just for this. Its guidelines on tracking pixels in email (decision no. 284 of 17 April 2026, published in the Official Gazette no. 98 of 29 April 2026) gave senders six months to adapt. The Garante's newsletter of 8 October 2026 put the date at 29 October 2026, and said checks are part of its inspection plan for the second half of 2026. Points worth knowing if you email people in Italy:

  • you must always tell people about pixels, whatever the email is for;
  • the Garante gives three examples where consent is not needed: an anonymous statistical count of opens with the same pixel for every recipient of a campaign and anonymised IP addresses; security and authentication emails; and service messages the sender is legally required to send;
  • measuring opens person by person, changing subject lines for low openers, or stopping emails to people who don't open all need consent;
  • consent to the pixel can be included in marketing consent, if the request is neutral;
  • people must be able to withdraw consent to the pixel alone and keep receiving emails without it.

Note the difference: the Garante explicitly accepts an anonymous open count without consent, while the UK position on the same practice is not settled.

Consent under PECR and the UK GDPR, and under the GDPR in the EU, must be freely given, specific, informed and unambiguous, and you must be able to show it (Article 7(1) GDPR). In practice:

  • ask when you collect the address, with a clear line about open tracking and a link to full information;
  • don't make the newsletter conditional on agreeing to tracking;
  • record what each person chose, and when;
  • give a way to switch tracking off from every email, without having to unsubscribe;
  • keep a pixel-free version of each email for people who say no.

The EDPB generally expects a separate consent for each purpose (Guidelines 05/2020, paragraph 44). The Italian single-consent approach is a national simplification. If you send across several countries, the separate tick box is the cautious choice.

A checklist for senders

  • List every email type with a pixel: newsletters, promotional emails, transactional and service emails.
  • For each, write down the purpose and the basis: consent or a specific exception.
  • Add a section on pixels and tracked links to your privacy information.
  • Switch per-recipient open tracking off for anyone who has not agreed to it.
  • Use random, non-sequential identifiers, and keep email addresses out of pixel requests.
  • Agree roles in writing with your sending platform and with anyone who rents you lists.
  • If you don't use the open data, remove the pixel.

The GDPR applies alongside all of this whenever the data relates to an identifiable person, including data protection by design and by default (Article 25).

A proposal to watch

On 19 November 2025 the European Commission proposed a "Digital Omnibus" (COM(2025) 837). Among other things it would move the EU rules on accessing devices from the ePrivacy Directive into the GDPR. It is a proposal only: on 3 November 2026 the European Parliament's procedure file showed it awaiting a committee decision. It would not change UK law.

How we are designing Markmatix for this

Markmatix is in development, and service emails are part of the design. Open tracking will be off by default. Clicks and third-party pixels in promotional emails will follow each publisher's privacy settings and each contact's choices. Measuring opens and clicks will be a purpose of its own in the consent record, and the link to stop measurement will always take priority over any other rule. You can follow progress through the waitlist.

Sources

  • The Privacy and Electronic Communications (EC Directive) Regulations 2003 (SI 2003/2426), regulation 6 and Schedule A1, in force from 5 February 2026. Regulation 6 · Schedule A1
  • ICO, Guidance on the use of storage and access technologies: "What are storage and access technologies?" and "What are the exceptions?", finalised April 2026. ico.org.uk · Exceptions
  • ICO, Guidance on direct marketing using electronic mail, "What else do we need to consider?", latest update 28 April 2026. ico.org.uk
  • Directive 2002/58/EC (ePrivacy Directive) of 12 July 2002, Article 5(3), as amended by Directive 2009/136/EC. EUR-Lex
  • EDPB, Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive, version 2.0, adopted 7 October 2024: paragraphs 47-51. edpb.europa.eu
  • EDPB, Guidelines 05/2020 on consent, version 1.1, adopted 4 May 2020: paragraph 44. edpb.europa.eu
  • Regulation (EU) 2016/679 (GDPR), Articles 7 and 25. EUR-Lex
  • Garante per la protezione dei dati personali (Italy), decision no. 284 of 17 April 2026, guidelines on tracking pixels in email, doc. web no. 10241943; Newsletter no. 553 of 8 October 2026, doc. web no. 10305399. Guidelines · Newsletter
  • European Commission, proposal COM(2025) 837 final of 19 November 2025 (Digital Omnibus), procedure 2025/0360(COD). EUR-Lex · Legislative Observatory

This guide explains the rules in general and is not legal advice: for your case, ask a lawyer.

Common questions

Are email tracking pixels legal under GDPR?

They can be, but the pixel itself falls under the ePrivacy rules: Article 5(3) of the ePrivacy Directive in the EU, PECR regulation 6 in the UK. Unless an exception applies, you need consent before tracking opens, and you must always tell people.

Does PECR regulation 22 cover tracking pixels?

No. The ICO says the email marketing rules apply to the email itself. The pixel is covered by the separate rules on storage and access technologies in regulation 6.

Can I measure open rates without consent?

In Italy, yes, for an anonymous count with the same pixel for everyone and anonymised IP addresses. In the UK the new statistical purposes exception is aimed at aggregate analytics about a service, and the ICO has not said whether it covers email open counts. Take advice before relying on it.

Do tracked links need consent too?

The EDPB treats links that carry a per-recipient identifier like pixels under Article 5(3). The ICO says regulation 6 applies to link decoration when it stores or accesses information on a device. Check how your links work before assuming they are exempt.

What is a spy pixel?

A common name for a tracking pixel: a small, usually invisible image that reports back when an email is opened. The legal rules are the same whatever it is called.

Save me a seat:

We will email you a link: you are only signed up after you open it and press "I confirm". The data controller is Redbit S.r.l.s., Viale della Grande Muraglia 494, 00144 Rome, Italy. We use your email and, if you give them, your name and website only to send you news about the Markmatix launch and the early access invitation, with your consent. You can withdraw it at any time. privacy notice.