CNIL Email Compliance: Sending Consent vs. Tracking Consent

Email marketing rules differ depending on whether the recipient is a consumer or a professional. While opt-in is the default in B2C, B2B follows a more flexible framework, subject to specific conditions.

For marketers, this means understanding which rules apply and making sure each campaign meets the relevant requirements before it is sent. 

B2C marketing
The default is opt-in. The sender must hold prior consent – free, specific, informed, unambiguous, given by an affirmative act –before the first commercial message goes out.

• The "soft opt-in" exception
  Prior consent is not required where three conditions hold together: the recipient is an existing customer, the message concerns similar products or services from the same legal entity, and a means to object was offered when the address was collected. All three. Miss one and the default returns.
• Non-commercial exemption
  Transactional and informational messages – a terms update, a security alert – need no marketing consent, provided they carry no promotional content. One embedded offer converts the message into direct marketing.

B2B marketing
The default is opt-out. Prior consent is not required where the message addresses the recipient in their professional capacity: HR software to an HR director, for instance. Where the offer falls outside that scope, the B2C opt-in rules apply. 

Audit requirement: CNIL treats a pre-ticked box as no consent at all, in B2B as in B2C. Where the address will be passed to commercial partners, the sender names those partners at the point of capture or links to a list of them, and records a separate opt-in for each.

Consent-mandatory tracking pixels

Prior explicit consent is required for:

• Reading open rates to optimize a campaign or adjust send frequency.
• Profiling recipient preferences for cross-platform ad targeting.
• Detecting mass automated opens or fraud through the pixel.
• Recording open metrics at individual level, beyond database hygiene.

Consent-exempt tracking pixels

Consent is not required for:

• Aggregate deliverability analysis, provided the cleaning routine overwrites the previous access record and stores only the date of last interaction – not the timestamp.
• Evidencing that mandatory legal information reached the recipient.
• Pixels used only to verify authentication state or identify a device during a single sign-on flow.

Obtaining consent properly (opt-in)

• Timing – ask for tracking consent in the form that collects the address. Consent sought later runs into the constraints below.
• Transparent information – give each tracking purpose a short, plain title immediately above the control. Put the full description one click away, a hyperlink or an expandable panel, so the detail is available without burying the choice.
• Freely given & granularity:
  • A separate checkbox for tracking, in addition to the sending checkbox.
  • A single bundled opt-in, permitted only where the mail is advertised as personalized and the pixel serves that personalization.
  • Email tracking consent may be collected together with website tracking consent where the form describes both.
• Subsequent consent via email – where consent was not captured at collection, the email requesting it carries no consent-mandatory pixel. The link lands on a page where the recipient takes an affirmative action — clicking a button, not merely arriving. After a refusal, the sender waits before asking again; six months is the working figure.