Disclaimer: The information in this post is for general informational purposes and doesn't constitute legal advice. For guidance on how these requirements apply to your business, consult your legal or privacy team.
Editor's note: This post describes recent regulatory developments and Klaviyo functionality as of July 2026. Regulations evolve, and so will this post. Check back for updates.
If you market to customers in the EU, the consent playbook is familiar: cookie banners, preference pages, opt-in boxes. Tracking requires permission, and asking for it is simply part of doing business in Europe.
Now, two regulators are applying that same principle inside the inbox. The new regulations cover tracking technologies embedded in your emails, with a particular focus on the pixels that record email opens.
What France and Italy announced
The CNIL, France's data protection authority, published their recommendation on tracking pixels in email in April 2026. An official English translation is available. The Garante, Italy's data regulator, followed the same month with guidelines of their own.
Both recommendations arrive at the same core requirement: using tracking pixels (tiny invisible images loaded when an email is displayed) for most marketing purposes requires the recipient's prior consent. That consent stands on its own: a recipient's opt-in to receive marketing email doesn't cover it, and recipients must be able to withdraw consent as easily as they gave it.
France
The recommendation draws a line at the publication date, and which side of that line a contact falls on determines what the transition looks like.
Contacts collected before April 14, 2026 fall under the CNIL's transitional regime, which works on an opt-out basis. Senders have until July 14, 2026 to inform these contacts that they use tracking technologies in their emails and to provide a clear, simple way to object. Tracking can continue during that window and, for contacts who receive the notice and do not object, after it closes as well.
Based on the regulations, the CNIL appears to not require mass re-consent for this group. They require information and an opportunity to object. If a contact does object, tracking for that contact should stop. If the notice is not sent by July 14, the transitional regime is no longer available for those contacts.
Contacts collected between April 14 and July 14, 2026 do not benefit from the transitional regime and require affirmative opt-in consent before they can be tracked. Where consent was not collected at sign-up, the CNIL provides a mechanism: senders can send a dedicated, tracker-free email inviting the recipient to consent through a positive action, such as clicking a button on a landing page.
Tracking should remain off for these contacts until they affirmatively opt in. Recipients who do not respond are treated as having declined, and the CNIL recommends they not be re-solicited for at least 6 months. This consent solicitation should be sent promptly. CNIL enforcement activity is expected to begin after July 14, 2026.
For contacts collected after July 14, 2026, tracking consent should be captured at the point of sign-up, before any tracked email is sent. Klaviyo's native consent collection on sign-up forms, which is part of our next phase of work, is designed to support this requirement.
Once tracking consent is in place for any contact, regardless of cohort, two ongoing obligations apply. First, the CNIL appears to require that tracking consent be collected separately from marketing email consent. A single opt-in that covers both is not sufficient.
Second, recipients must be able to withdraw their tracking consent at any time through a mechanism that is as simple and accessible as the one used to collect it. In practice, this means each tracked email should include a clear way for recipients to opt out of tracking without needing to unsubscribe from emails entirely.
Italy
Italy's approach is simpler on timing: senders have 6 months from publication, through October 28, 2026, to bring their practices in line.
Contacts collected before April 29, 2026 fall under the Garante's transitional regime, which also works on an opt-out basis. Tracking can continue during the 6-month window, provided senders inform each contact about their tracking practices at the next meaningful interaction and make a withdrawal mechanism available. This can happen in the next regular email sent to that contact. A standalone notice is not required.
The withdrawal mechanism must offer two options with equal prominence: stop tracking only (continue receiving emails), or unsubscribe from emails entirely. Contacts who receive the notice and do not withdraw can continue to be tracked after October 28, provided the original legal basis for those promotional communications was valid. If a contact does withdraw, tracking for that contact should stop going forward.
Contacts collected between April 29 and October 28, 2026 do not benefit from the transitional regime and require affirmative opt-in consent before they can be tracked. Tracking should be suppressed for these contacts from the point of collection. Because new contacts will continue to arrive without tracking consent until native consent collection is available on sign-up forms, senders should consider an automated flow that defaults new in-scope contacts to "opted out" and sends a tracker-free consent solicitation on sign-up.
Alternatively, senders can suppress tracking for this group and send a batch consent solicitation once native consent collection is live, creating a clean cut-off. Recipients who do not respond are treated as having declined. Your privacy team can advise on the right timing and approach.
For contacts collected after October 28, 2026, tracking consent should be captured at the point of sign-up, before any tracked email is sent. Klaviyo's native consent collection on sign-up forms, which is part of our next phase of work, is designed to support this requirement.
Once tracking consent is in place for any contact, regardless of cohort, the Garante appears to require that recipients be able to withdraw tracking consent at any time through a mechanism that is as easy to use as the one they used to give consent.
Unlike the CNIL, the Garante seems to permit tracking consent to be collected alongside marketing email consent, provided the processing purposes are the same. Where purposes differ, separate consent is required. The withdrawal mechanism must continue to offer two options with equal prominence: stop tracking only (and continue receiving emails), or unsubscribe from emails entirely.
Your privacy team can advise on how these requirements apply to your specific program, including which contacts fall into which group and what the notice should contain.
What we've built in Klaviyo
Whether and how these requirements apply to your program is a determination for you and your privacy team to make, and it may vary across your audience. Here’s what we’ve built in Klaviyo to help you in the meantime:
Transitional email
Both the CNIL and the Garante require senders to contact certain existing recipients during the transition period, either to inform them of tracking and offer a way to object, or to request affirmative consent.
To send a transitional email without open tracking using Klaviyo, you can disable open tracking at the account level (Settings > Email > Tracking) or at the recipient level before sending, and use a third-party form or landing page (such as a hosted page) to collect each recipient's opt-out or opt-in response.
Klaviyo does not yet offer native consent collection for transitional emails, but you may use Klaviyo’s consent management system for open tracking to store the responses you collect through your own form.
We suggest you work with your privacy team to understand the requirements for these messages.
Managing open tracking
Klaviyo, like most email platforms, uses a tracking pixel to record email opens. To assist with your compliance efforts, two controls for managing open tracking are now live for every Klaviyo account.
Option 1: Turn off open tracking account-wide. One setting (Settings > Email > Tracking) stops Klaviyo from recording opens on every email your account sends.
Option 2: Opt individual recipients out of open tracking. Every recipient now carries an open tracking consent status, separate from their marketing consent. Opt a recipient out and Klaviyo stops recording their opens, effective immediately and going forward, including for emails already in their inbox.
Recipients without an explicit status continue to be tracked as they are today. You can set statuses in bulk through a CSV list import, an SFTP or data warehouse sync, or the API.
Coming later in 2026
Today, you set open tracking consent on your recipients' behalf. Later this year, recipients will be able to manage it themselves: we're building native consent collection into sign-up forms and the preference center, using the same patterns subscribers already know from marketing consent, along with a direct way for recipients to withdraw tracking consent.
We're shaping this work in conversation with our customers, and we'll share more as it ships.
What to do now
- Talk to your privacy team. They can confirm whether and how these requirements apply to your program and what the timelines mean for your situation. The regulators' documents (linked above) are the right source material to hand them.
- Identify your in-scope recipients. Which recipients are covered, and what applies to each group, is a determination to make with your privacy team, not one Klaviyo can make for you.
- Send any transitional communications your privacy team advises. Have a plan for collecting responses so you can honor them going forward.
- Use Klaviyo's controls to manage tracking appropriately. Once you and your privacy team decide what your program needs, the controls above let you put your plan into action.
Ready to set up open tracking controls? Our step-by-step guide walks you through it.
Related content
