Consent is also required for email tracking

In many cases, prior, unambiguous consent from the recipient is required for email tracking. A tracking pixel processes personal data – such as the IP address and the time of open – that can be traced back to an individual. If you wish to measure the general reach of a newsletter purely at an aggregated level, there is sometimes scope to rely on a different legal basis. However, if you use tracking to record whether a specific recipient has opened your email, consent is almost always required. Moreover, in all cases, there is an obligation to inform recipients in your privacy statement.

What is email tracking?

In email tracking, an invisible image is added to an email. This image is transparent and, with a length and width of just one pixel, so small that the recipient does not see it. That is why we refer to it as a tracking pixel (also known as a tracking pixel, web beacon , or spy pixel). It is usually not visible to the recipient that tracking software is involved.

As soon as the email is opened, the email program automatically downloads the image from the sender's server to “display” it. With that request, the sender can register a number of details, such as:

• the recipient's IP address ;
• a timestamp (when and how often the email was opened);
• data about the browser and the operating system;
• sometimes the global location that follows from the IP address.

This data can subsequently be linked to the recipient's email address and, thereby, to their identity. In addition to opening the email, click behavior measured via redirected links: this way, you see not only whether an email has been opened, but also which link was clicked.

What is email tracking used for?

Entrepreneurs typically use email tracking to measure the effectiveness of an email campaign : what percentage of recipients open the newsletter, which links are clicked, and what is the best time to send? Additionally, tracking can serve an evidentiary purpose , for example, to demonstrate that a specific recipient actually opened an important message.

A well-known example is the Education Executive Agency (DUO). According to reports, DUO used tracking software in emails to demonstrate that students had received and opened messages. Following consultation with the Dutch Data Protection Authority, DUO discontinued this practice. This illustrates that recording reading behavior at the personal level is particularly sensitive regarding privacy – even for a government agency with an apparently legitimate interest.

It concerns personal data, so the GDPR applies

Because the registered data can be linked to an email address, it concerns identifiable personal data . An IP address is also considered personal data in principle. Consequently, the GDPR applies , and you may only process this data if you have a valid legal basis for doing so .

The GDPR recognizes various legal bases. The two most relevant to email tracking are:

• Consent – ​​a free, specific, informed and unambiguous expression of will by the recipient.
• Legitimate interest – only applicable after a careful balancing of your interest against the privacy of the recipient.

Which legal basis applies depends heavily on how intensively you track and for what purpose. Moreover, you must be able to demonstrate consent, and the recipient must be able to withdraw it just as easily as they give it.

GDPR and e-Privacy: two regimes side by side

A tracking pixel accesses information on the recipient's device (retrieving the image, sometimes placing or reading data). This brings e-Privacy legislation , enshrined in the Telecommunications Act in the Netherlands. These rules generally impose stricter requirements on consent than a "standalone" appeal to legitimate interest under the GDPR. Practice and supervision in this area are constantly evolving; if in doubt, have your intent legally reviewed rather than relying on a single general assumption.

Is email tracking prohibited?

No, email tracking is not prohibited by definition. The core lies in the question of the legal basis on which you rely and how you arrange consent. Roughly speaking, there are two situations.

1. Recording individual reading behavior

If you use tracking to record, per recipient, whether and when they opened a specific email – for example, as evidence or to build a profile – you will almost always prior, unambiguous consent . As a rule, another legitimate interest will not suffice in this case.

2. Measure general range only

If you wish to measure exclusively at an aggregated level – for example, what percentage of newsletters have been opened, without tracing this back to individual recipients or profiles – some legal experts see room to rely on a legitimate interest. This reasoning aligns with the approach regarding analytical cookies. However, this is not a free pass: the privacy impact must be demonstrably minimal, and you must be able to substantiate the assessment.

Keep in mind that the Dutch Data Protection Authority is critical of tracking pixels. The regulator even removed a tracking pixel from its own newsletter when it turned out to have been included by accident. Therefore, choose the safe route: as little data as possible, a clear unsubscribe option, and transparency.

Does this also apply to business (B2B) newsletters?

Many entrepreneurs think that the rules only apply to consumers. That is not entirely correct. The GDPR protects natural persons, even when they act in a business context. A personal business email address (such as [email protected]) is generally personal data, whereas a general address like [email protected] is as a rule not.

For sending commercial email to existing customers, a more flexible regime exists under certain conditions (the so-called “soft opt-in”). However, please note: this concerns the permission to send the email, not automatically the tracking of reading behavior at an individual level. The question of whether you may email and the question of whether you may track are therefore two separate assessments.

What does this mean for your business?

Whether or not consent is strictly required, you are in any case subject to the duty to inform under the GDPR. In practical terms, this means:

1. Determine your goal. Do you only measure open and click rates, or do you capture individual behavior? That determines your basis.
2. Obtain consent where necessary. If in doubt, request a separate, active opt-in for tracking and record when and how it was provided.
3. Inform transparently. Explain the use of tracking pixels in your privacy statement and in the unsubscribe information of your newsletter.
4. Limit processing. Do not store more data than necessary and always offer a simple unsubscribe option.
5. Check your tooling. Many email packages enable tracking by default. Know what your supplier collects and document this in a data processing agreement.

Frequently asked questions about email tracking and consent

Is a tracking pixel allowed in a newsletter?

Yes, provided you have a valid legal basis and are transparent. Consent is generally required to measure individual reading behavior; for exclusively aggregated statistics, there is sometimes scope for a legitimate interest. Always inform recipients in your privacy statement.

Do I need permission to measure open and click rates?

For purely aggregated measurement without attribution to individuals, a legitimate interest may suffice, but this must be substantiated on a case-by-case basis. As soon as you attribute behavior to a specific recipient or build profiles with it, consent is almost always required. In case of doubt, consent is the safest choice.

Is an IP address personal data?

In principle, yes. An IP address is generally considered identifiable personal data, meaning the GDPR applies to its processing via a tracking pixel.

Does email tracking also apply to B2B newsletters?

Yes, insofar as you use personal business email addresses. The GDPR protects natural persons in a business context as well. A more lenient regime for sending to existing customers does not automatically mean that you are also allowed to track reading behavior at the personal level.

What should be included in my privacy statement regarding email tracking?

State that you use tracking, which data you process, for what purpose and on what legal basis, how long you retain data, and how recipients can opt out or object. Our legal experts can align your privacy statement with this

What are the risks if I don't ask for permission?

In the event of unlawful processing, the Dutch Data Protection Authority can take enforcement action. This can lead to reputational damage and, depending on the severity, to a sanction. Careful substantiation and transparent communication significantly reduce that risk.

Have your email marketing legally reviewed

Do you use email tracking, or are you planning to? Then first have it assessed whether you are using the correct legal basis and if your privacy documents are in order. Our privacy and data protection are happy to assist you. With our GDPR package, you can get your privacy documentation right the first time.

Do you want to brainstorm directly with a legal expert? Schedule a no-obligation intake and ensure the Dutch Data Protection Authority doesn't have to rein you in.