GUIDE: Tracking Marketing Emails and CNIL Compliance (GDPR)

Email marketing tracking (opens and clicks) lies at the heart of email marketing and marketing automation strategies. However, according to the CNIL’s recent recommendations, practices must evolve and be better governed in order to protect users’ personal data.

Between the compliance requirements linked to the GDPR and the need to manage your marketing campaigns effectively, a question arises: how can you continue to leverage marketing automation while respecting users’ privacy and without taking legal risk?

This guide is designed to help you understand the rules applicable to email tracking, adopt best practices to remain compliant, and fully take advantage of Webmecanik solutions to reconcile marketing performance with GDPR compliance.

Summary of CNIL recommendations on email tracking

The CNIL (and more broadly, the GDPR) considers that trackers in emails (open pixels, tracked links) make it possible to infer personal behavior. As such:

• The principle: storing these trackers normally requires prior consent.
• The issue: without this consent, you should not be able to identify by name who opened or clicked.
• The controller: this is the data controller (you, the marketer / executive), not the publisher of your software.
• Webmecanik’s answer: we enable you to anonymize this data so you can keep your overall statistics (open rate and click-through rate) while respecting the anonymity of those who refuse individual tracking.

B2B vs B2C: what you need to remember

The CNIL specifies that the regime applicable to pixels is independent of the regime for sending the email itself. Thus, a B2B lead-generation email that can be sent without prior consent may still require consent for its tracking pixel.

The rule is the same for both B2B and B2C.

What you can continue to do without consent ✅

At first glance, these changes may seem restrictive. But in practice, they mainly govern the most intrusive uses. A large part of your marketing activities remains perfectly possible, provided you prioritize broad, non-individual approaches.

• Continue your marketing automation campaigns: your scenarios (nurturing, onboarding, follow-up…) remain usable, but it will depend on your vendor’s capabilities. Some platforms will strongly limit these uses without consent.
  With Webmecanik, however, you can continue to evolve your contacts within your scenarios even without consent, thanks to anonymized mechanisms.
• Tracking deliverability: it is possible to analyze opens, provided the volume is sufficient to avoid any individual identification.
• Manage inactive contacts: you can exclude certain contacts or adjust marketing pressure based on their last interaction (such as an open or click date).
• Security and authentication: tracking remains allowed to verify that a sensitive email (e.g., 2FA code, password reset) has indeed been accessed.
• Legal obligations: you can use trackers to prove that regulated information was properly transmitted (contractual terms, price changes, etc.).
• Transactional emails: integrating pixels is possible in emails related to an action requested by the user (order confirmation, appointment reminder…), as long as their purpose remains compliant (security, deliverability, legal obligation).
• A/B testing: tests based on open rates remain feasible as long as they rely on aggregated, non-nominative data. However, make sure your solution guarantees this anonymization.

What requires explicit consent ❌

• The restrictions mainly concern uses linked to individual tracking and profiling:
• Precisely identify who opens your emails
• Target your contacts based on their opening behavior
• Infer their areas of interest from this data
• Personalize your content or marketing pressure on an individual basis

How Webmecanik Automation covers 100% of the recommendations

Unlike all email marketing and marketing automation tools, Webmecanik gives you full control thanks to two innovations and a strong commitment:

1. Ethical Tracking: when a contact refuses tracking, their opens and clicks are not recorded. Only interactions from contacts who have given their consent are included in statistics and behavioral tracking.
2. The 3rd campaign branch: in your automation scenarios, we created a dedicated branch for the “non-trackables”. You can decide to handle them:
   • as openers/clickers, 
   • as non-openers/non-clickers,
   • or isolate them for a specific journey.
3. Data sovereignty: as a French publisher, working exclusively with sub-processors for European personal data, your consent data does not leave the European Union, ensuring maximum legal protection against the U.S. Cloud Act.

Step-by-step implementation of this new recommendation

We offer you three concrete approaches to bring your marketing automation actions into compliance with this new regulation.

Scenario A: you are in B2B (information-based approach)

The goal is to inform the user that their interactions are tracked to improve their experience, while leaving them the freedom to object.

1. Add a dedicated profile field: a system field is associated with each contact called “Consent to email tracking” (consent_email_tracking) to centralize and easily manage their status.
2. Update your preference center: add the checkbox: “I accept that my interactions are analyzed to receive more relevant content.” (Pre-checked by default in B2B, with clear wording) to give your contacts an Opt-out option.
3. Adapt your marketing automation scenarios: connect the “Non-trackable” branch to your positive branch so you don’t break your sales funnels.

Scenario B: you are in B2C (strict consent approach)

Here, the rule is explicit Opt-in. Tracking should only be enabled if the user has taken an active step to accept it.

1. Modify the collection form: add a new distinct checkbox for Opt-in Tracking with the dedicated form field (which will automatically populate the contact’s profile field).
2. Update your preference center: the contact must be able to uncheck tracking without unsubscribing from the newsletter.
3. Adapt your marketing automation scenarios:
   • Positive branch -> Continue the journey.
   • Negative branch -> Follow-up (those who said YES to tracking but did not interact).
   • “Non-trackable” branch -> Dedicated action (e.g., sending a generic email without scoring). You can also attach this branch to one of the two other usual branches.

Scenario C: you are already a Webmecanik Automation user

1. Update your preference center: enable the email tracking consent feature and add this new checkbox in your preference center..

2. Transfer the existing data into your custom opt-in field to consent native fields: to simplify and make your opt-in management more reliable, we recommend replacing your existing custom fields with the native fields from the preference center that we added.
To do this, export your contacts and re-import the data (contact ID (by default email) and the column in your file containing the consent value.

3. Modify your collection forms: replace your existing marketing forms with the checkbox to give consent, mapped to a custom opt-in field. Instead, use the new dedicated form field type for tracking consent, which will enrich the contact’s preferences in their preference center.

4. Adapt your marketing automation scenarios:

• Positive branch -> Continue the journey.
• Negative branch -> Follow-up (those who said YES to tracking but did not interact).
• “Non-trackable” branch -> Dedicated action (e.g., sending a generic email without scoring). You can also attach this branch to one of the two other usual branches.

Questions? Feel free to contact us right here.