New email tracking rules in France and Italy: what changes for marketers

The email marketing programme itself can carry on largely as it is, and open and click data remain available for recipients who agree to be tracked. The changes sit in the setup. Tracking consent has to be recorded for each contact, applied when every email is generated and configured differently depending on the market you send to. We built Email Tracking Consent in Manago AI to handle that.

Sending and tracking are now separate permissions

Email marketing consent tells you whether you can send someone the message.
Email tracking consent tells you whether you can measure what that person does with it once it arrives.

A customer can agree to one and refuse the other. They may still want the newsletter, product updates or the occasional offer, but prefer that their opens and clicks are not recorded on their profile. Someone who declines tracking still remains a subscriber. It sounds obvious, yet most sending platforms have long treated tracking mainly as a reporting setting, and marketing teams have had little reason to think about it separately.

The effect also reaches beyond campaign reports. Opens and clicks often feed segmentation, automation, attribution and the wider customer profile, so a tracking choice that lives only in a form checkbox achieves very little. The platform has to act on it twice: when the email is generated, and again when engagement data would normally come back.

How Manago AI handles it

Email Tracking Consent has three parts: an account-level switch, a tracking status on each contact and a tracking strategy on each sender account.

Once you enable the feature, every contact can be opted in or out of tracking. Contacts who have never given tracking consent start as opt-out, and the status sits next to the existing marketing consents. The sender account then decides what Manago AI does when a contact may receive the email but cannot be tracked individually. There are three strategies to choose from. Ignore tracking opt-in status keeps tracking everyone, whatever status the contact has. Collect anonymous aggregate data keeps campaign-level counters and leaves the activity off the contact's profile. Don't track removes the tracking mechanism from that recipient's email altogether.

The anonymous option works earlier in the process than many people expect. Manago AI strips the identifying information while it generates the message, so an individual event never reaches the contact profile and there is nothing to anonymise afterwards.

We put the strategy on the sender account on purpose. A company sending across Europe may need different behaviour in each market, and the same goes for different types of message. Transactional traffic, such as password resets or order confirmations, can run through its own sender accounts, so a decision about marketing traffic never spills over into how a service message is handled. France and Italy are a good illustration of why that matters.

Why France and Italy need different settings

Both regulators have now ruled on tracking in email, and their conclusions lead to two different configurations.

France: no tracking means no tracking

For French marketing traffic, we recommend Don't track. In its recommendation on tracking pixels in emails (Délibération n° 2026-042, published on 14 April 2026), the CNIL does not accept anonymous aggregate measurement as a substitute for consent. For a French contact who has not agreed to tracking, the anonymous strategy is therefore off the table.

With Don't track, the recipient still gets the email, minus the tracking layer. It carries no open-tracking image and the links go straight to their destination, so the contact generates no tracking data at all.

Collecting the permission needs the same separation. French sign-up forms should ask for the two permissions with two checkboxes, and the tracking one should stay optional. People also need an easy way to change their mind later, which is why the tracking opt-out link belongs in the email footer, next to the usual unsubscribe link.

The French transition period ended on 14 July 2026, so all of this applies today. Existing databases are the harder part. Older contacts can't all get the same status, because the right one depends on when the address was collected and, for some, on whether the person was told about tracking earlier and given a genuine chance to object. With hundreds of thousands of records, a single bulk update is tempting, but it would wipe out exactly the history that decides how those contacts should be treated.

Italy: you can keep the campaign-level picture

Italy's data protection authority, the Garante, set out its position in Provvedimento n. 284, published on 29 April 2026. For marketers, the practical difference is that anonymous campaign-level measurement is allowed.

That makes Collect anonymous aggregate data our recommended strategy for Italian marketing traffic. Opens and clicks from recipients who haven't agreed to individual tracking still count towards the campaign totals, while their profiles stay untouched, so you keep a useful view of how the send performed as a whole. Don't track remains available too, and some organisations may find one strict setting easier to manage internally.

Consent collection is simpler as well. You can ask for both permissions with one checkbox, as long as the wording covers both purposes. For withdrawal, the standard unsubscribe link is enough, provided the page behind it lets the recipient stop the tracking and stay on the list.

Existing Italian contacts fall into three groups, depending on when the address was collected:

• Before 29 April 2026: tracking can continue, as long as you tell these contacts about it and give them an easy way to object. Any regular email can do that.

• 29 April to 28 October 2026: tracking needs active consent, so these contacts stay untracked until they agree.

• From 29 October 2026: consent is collected at sign-up, before the first tracked email goes out.

If most of your Italian base was built before April, the bulk of the work is updating statuses and adding the right footer, and you may not need a consent campaign for the whole list. A list that has grown a lot since spring will take more effort.

28 October 2026 is the last day to bring an existing base into compliance, and the full regime applies from 29 October. Plan to have the setup finished well before then.

What happens to your reporting

The consent mechanics are only half of the change. Most marketing teams will notice the other half in their dashboards.

If a sizeable share of your audience can't be measured individually and still sits in the denominator for open rate or CTR, performance appears to drop even when customers behave exactly as before. You'd be comparing campaigns measured under two different sets of rules and reading the gap as engagement.

Manago AI keeps Tracked recipients and Untracked recipients apart for this reason. Open rate, CTR and CTOR are calculated on the recipients whose behaviour can actually be measured. Where anonymous aggregate measurement is allowed and switched on, those counters sit in a separate view. They still say something about campaign activity, and they stay at campaign level.

Revenue works in a similar way. Switching tracking off leaves the email content as it is. Product recommendations and UTM parameters travel as ordinary links, so someone who declines tracking gets the same campaign and lands on the same pages, and your website analytics still show what they do once they arrive. What you lose is the ability to tie that activity to a named person inside the email platform. Email measurement carries on, at a coarser level of detail.

This reaches further in stacks that reuse engagement signals in segments, automations, scoring or personalisation. Once a signal is unavailable for a given contact, anything downstream that relied on it needs adjusting too.

What marketing teams should do now

Both markets need the same building blocks: a separate sender account, an opt-out in every template, tracking consent on forms, the right statuses for the existing base and a tracking strategy on the sender account. The order is what differs. In France the transition period is over, so the strategy changes first and the consent work follows. In Italy the consent work comes first, because every contact who agrees before the switch stays measurable afterwards.

France

1. Switch French sender accounts to Don't track. As soon as possible, at the latest on the same day as step 6. Doing both on the same day keeps contacts with a documented basis measurable without a gap.

2. Separate the traffic. Now. French marketing gets its own sender account, and transactional messages move to separate ones.

3. Add All opt-out links to every template that can reach France. Now, before any status update.

4. Use two checkboxes on forms. Now: every contact acquired since 14 July 2026 needs consent at sign-up.

5. Confirm in writing whether the cohort I notice went out before 14 July 2026, and keep the evidence. Before step 6. Cohort I covers contacts acquired before 14 April 2026, and this one fact decides whether you are updating statuses or re-consenting them.

6. Split the base on 14 April and 14 July 2026, then set notified cohort I contacts who did not object to opt-in. Contacts acquired between those dates (cohort II) stay opt-out.

7. Send one tracking-free consent email to cohort II and to any part of cohort I without the notice. As soon as possible after the switch. Send it from a Don't track sender account and don't repeat it.

8. Compare the two reporting views, reset baselines and brief dashboard readers. After the first campaign under the new setup.

Italy

1. Separate the traffic. First, and before 28 October 2026. Italian marketing gets its own sender account, and transactional messages move to separate ones.

2. Add an opt-out link to every template that can reach Italy. First, before any status update; opt-out page reviewed before 28 October 2026. The standard Opt-out link is enough here.

3. Use one checkbox on forms, with wording that covers both purposes. As early as possible: every contact acquired since 29 April 2026 without it starts as opt-out.

4. Split the base on 29 April 2026 and set cohort I to opt-in in bulk. As early as possible. Contacts acquired before that date only need to be informed and given a way to object, which any regular email with an opt-out link covers.

5. Run a consent campaign for cohort II. Well before 29 October 2026. This covers contacts acquired from 29 April onwards. Those who don't respond stay opt-out.

6. Switch Italian sender accounts to Collect anonymous aggregate data. As late as your consent work requires, and before 28 October itself.

7. Compare the two reporting views, reset baselines and brief dashboard readers. After the first campaign under the new setup.

   
   

A few practical questions

Need help reviewing your setup?

Most contact databases carry years of forms, imports and consent processes, and it's rarely obvious which rules apply to which contact. With France and Italy now needing different decisions at different stages, one account-wide change won't cover it.

If you send to customers in France or Italy and want to check whether your sender accounts, consent setup and reporting are ready, get in touch with the Manago AI team. We'll go through your current configuration with you and work out what needs to change for each market.

Manago AI provides the controls. As the data controller, you decide the legal basis and the consent wording with your legal team. This article is not legal advice.