Businesses have become accustomed to measuring who opened an email, when it was opened and which links were clicked.

This data is used to analyse campaigns, create segments, adjust content, assign lead scores or notify a sales representative when a potential customer shows interest.

However, this type of tracking is facing increasing scrutiny from data protection authorities.

In 2026, France and Italy published new guidance reinforcing an important principle: when tracking makes it possible to identify which individual opened or clicked an email, prior and explicit consent may be required.

This affects not only newsletters and marketing campaigns, but also sales emails sent through platforms such as HubSpot, including sequences and individual messages.

What has changed?

Until now, many businesses treated tracking as a standard feature of their email platform.

Contacts agreed to receive communications, and businesses assumed that they could also measure email opens and clicks. In other cases, the privacy policy or email footer referred generically to the use of tracking technologies.

The new guidance calls this practice into question.

The French and Italian authorities consider that consent to receive an email does not automatically mean that the recipient agrees to have their activity tracked.

This means that a business may have permission to send a communication but may not have permission to know whether a specific person opened it, how many times they viewed it or which links they selected.

A notice in the email footer may also be insufficient. Informing recipients that tracking is in place is not the same as obtaining consent.

Where consent is required, the contact must make an active, clear and informed choice.

How does email tracking work?

To measure an email open, platforms usually insert a small invisible image into the email, known as a tracking pixel.

When the recipient opens the message and the images are loaded, the platform can record the open.

Clicks are measured through tracking links. Before the user reaches the final page, the click is routed through an address that allows the interaction to be identified.

In HubSpot, these mechanisms may be used in:

• Marketing emails.
• Emails sent through workflows.
• Sales sequences.
• Individual emails sent through the CRM.
• Gmail and Outlook extensions.

The issue is not only the technology itself. It is also how the data is used.

An aggregated statistical analysis showing the overall open rate of a campaign does not represent the same level of intrusion as identifying that a specific contact opened a message and automatically creating a task for a sales representative to follow up.

The more individual and behavioural the tracking becomes, the greater the likelihood that specific consent will be required.

What is changing in France and Italy?

France and Italy follow a similar approach: individual email tracking for marketing, personalisation or behavioural analysis purposes requires prior consent in many cases.

The practices most affected include:

• Identifying which individuals opened an email.
• Personalising content based on interactions.
• Changing communication frequency.
• Creating behavioural segments.
• Increasing a lead score after an email open.
• Alerting the sales team based on a contact’s behaviour.
• Building interest profiles.

There may be exceptions for strictly technical or security-related purposes, or for certain aggregated and anonymous statistics.

However, these exceptions are limited and should not be used as justification for keeping all tracking features active.

Businesses with contacts in France or Italy should review their current processes and confirm whether the consent collected effectively covers the individual measurement of email opens and clicks.

Is it necessary to ask every contact for consent again?

Not necessarily.

Before launching a reconsent campaign across the entire database, businesses should analyse how their contacts were originally collected.

The organisation should confirm:

• What wording was presented on the form.
• What consent was given.
• Whether tracking was clearly explained.
• How email opens and clicks are used.
• Whether evidence of consent exists.
• Whether the contact can withdraw consent specifically for tracking.

Some contacts may already have provided sufficiently clear consent. Others may only have authorised the organisation to send communications.

Where the existing consent is insufficient, it may be necessary to request new authorisation.

That communication should be sent without using any tracking that has not yet been authorised. Otherwise, the organisation would be using the technology before obtaining the consent it is trying to collect.

What should businesses using HubSpot do?

The first priority should be to identify where tracking is currently active.

Many businesses review only their marketing emails and overlook the fact that sales teams may also track opens through the CRM, sequences or email extensions.

The review should cover both marketing and sales.

1. Audit current tracking

Businesses need to identify which emails measure opens and clicks and understand how that information is used.

For example, an email open may simply appear in a report, or it may trigger a workflow, update a property, increase a score or generate a sales notification.

This distinction is relevant when assessing the risk and purpose of the data processing.

2. Identify the contacts affected

Businesses should create reliable segments for contacts located in France and Italy.

Using only language or email domain may produce inaccurate results. Fields such as contact country, company country, market and location should also be considered.

Where this data is incomplete or recorded in different formats, the first step should be to standardise the information in the CRM.

3. Review forms and consent wording

Forms should clearly explain whether the organisation measures email opens and clicks and how that data will be used.

A generic option such as “I accept the privacy policy” may not be sufficient to demonstrate informed consent.

Changing the wording on the form is also not enough. HubSpot should store the date, source and status of the consent so that the organisation can demonstrate when and how it was obtained.

4. Review sales emails

These rules do not affect only the marketing department.

Where sales representatives use open notifications to decide when to contact a lead, that tracking should also be reviewed.

The organisation should define when this functionality may be used and ensure that users understand the applicable rules.

5. Provide a simple way to withdraw consent

A contact may wish to continue receiving emails without allowing their email opens to be tracked.

A full unsubscribe option may therefore be insufficient.

It may be necessary to create a preference centre where contacts can withdraw only their permission for tracking.

Are open rates still a reliable metric?

Even before these changes, open rates already had significant limitations.

Some email clients block images. Others automatically load tracking pixels even when the message has not been read.

Privacy systems, corporate security filters and preview panes may also generate unreliable email opens.

Businesses should reduce their dependence on this metric and give greater importance to indicators that are more closely connected to commercial outcomes:

• Email replies.
• Contact requests.
• Meetings booked.
• Qualified leads.
• Opportunities created.
• Pipeline influenced.
• Revenue generated.

The objective should not simply be to know whether someone opened an email. It should be to understand whether the communication contributed to an action or decision.

Tracking is no longer just a technical setting

The new guidance from France and Italy reflects a broader shift in how email tracking is being assessed.

Enabling open tracking simply because the platform supports it is no longer sufficient.

Businesses need to understand what data they collect, how they use it, what consent exists and how they respect each contact’s choices.

In HubSpot, this assessment should include marketing campaigns, workflows, sequences, sales emails, forms, properties and reporting.

Liminal supports organisations with CRM audits and configuration, marketing automation, consent management and data governance. To assess your current processes, complete our Marketing Automation Diagnostic.

This article is for informational purposes only and does not replace legal advice tailored to the specific circumstances of each organisation.