Email tracking pixel regulations (CNIL, Garante, and beyond): Managing your open tracking settings
You will learn
- What data Klaviyo's tracking pixel records
- How to determine which of your recipients these regulations may apply to
- How to send a transitional email to existing recipients, and record responses once your privacy team has them
- What to consider for deliverability with a large send
- Where to turn on Klaviyo's open tracking controls
Some regulators in the EU, including France’s data protection authority (the CNIL) and Italy’s data protection authority (the Garante), have issued guidance regarding consent for using tracking pixels in emails. Whether and how this guidance applies to your program is a determination for you and your privacy team. This article covers what Klaviyo’s tracking pixel records, and how to use Klaviyo to help act on whatever your privacy team decides.
For the regulatory background, including information about each country’s transition periods, see Tracking pixels in email: the new EU consent guidelines, explained.
What Klaviyo’s tracking pixel records
When a message is sent, Klaviyo inserts an invisible 1x1 pixel image into the email. The pixel’s URL contains a unique ID tied to a record Klaviyo creates on its servers at send time, linking that ID to your account, the message, and the recipient the email was sent to. That record doesn’t know whether the message is ever opened. This is the same pixel-based mechanism described in Understanding email deliverability and How to edit the location of your tracking pixel.
When the recipient’s email app (such as Gmail, Outlook, or Apple Mail) loads the pixel, it sends a web request to Klaviyo’s servers. Like any web request, this includes the IP address, as well as the device or browser information (user agent) the request came from. Receiving that request isn’t the same as tracking the open; whether it’s recorded as one depends on your open tracking setup.
- Open tracking on (the default, for your account and that recipient, unless you’ve turned it off or set that recipient to unsubscribed): Klaviyo matches the request back to your account, the message, and the recipient using the record created at send time, and records an “Opened Email” event that stores the account, recipient, message, timestamp, IP address, and device or browser information. This is the event that shows up in your reporting and recipient activity, and feeds attribution, segmentation, and flow triggers.
- Open tracking off, either account-wide or for that specific recipient: the pixel is still present in the email, and when the recipient’s email app loads it, the request still reaches Klaviyo’s servers. Klaviyo checks the request against your settings before recording anything. If tracking is off, the request is not logged, not stored, and not associated with the recipient’s profile. The request is discarded there: no “Opened Email” event is created, and nothing is added to your reporting or recipient activity. This server-side check is what allows Klaviyo to honor the recipient’s current tracking preference at the moment the email is opened, rather than relying on a status that may have changed since the email was sent.
For the full mechanics of the controls, see How to manage open tracking.
Identifying recipients who may be affected
Which recipients these rules apply to, and what that means for each of them, is a determination you make with your privacy team, not one Klaviyo can make for you. The CNIL and Garante’s guidance differ by country, and within each country, by when a recipient’s consent was originally collected. See the blog article above for a breakdown by country.
You can use profile data such as location to help build a starting audience, then work with your privacy team to confirm who’s in scope and how each group should be handled.
How to send a transitional email to existing recipients
If your privacy team advises sending existing recipients a notice about tracking pixels, and a way to respond, here’s how to do that in Klaviyo.
To send a specific email without recording opens, you have two options:
- Turn off open tracking for your whole account before sending, then turn it back on afterward. This is the simplest option, but it stops recording opens for every email your account sends during that window, not just the transitional one.
- Set the specific recipients you’re emailing to unsubscribed from open tracking before you send, using a CSV import, SFTP or data warehouse sync, or the API. This only affects those recipients, and their open tracking stays off going forward unless you or they change it.
See How to manage open tracking for step-by-step instructions on both methods.
Klaviyo does not yet offer a native, recipient-facing way to collect objections (such as a footer link or preference page). If your privacy team determines that the opt-out approach applies to your recipients (i.e., open tracking remains on unless a recipient objects), you will need to determine a mechanism for recipients to register their objection, and a way to act on those objections in Klaviyo.
How to record recipients’ responses
There is currently no built-in way to collect a recipient’s response directly through the Klaviyo platform, for example through a link in the transitional email itself. Building a way to collect a recipient’s response directly requires custom engineering, a landing page or form to capture the response, and a way to feed it into Klaviyo; this article doesn’t prescribe a specific build.
Once your privacy team has collected a response through whatever channel you use, whether a reply, a form on your own site, or something else, record it using the same mechanism as any other open tracking consent update: a CSV import, SFTP or data warehouse sync, or the API, setting the recipient to unsubscribed for an objection or subscribed for an opt-in. See “Manage open tracking consent for individual recipients” in How to manage open tracking for the exact steps.
Once consent is set, you don’t need a separate field or list to track who has responded. You can build a segment filtered on Open Tracking Consent status to see everyone who has objected or opted in at any time, and use the Events API to pull a timestamped history of when each recipient’s consent changed. See “Track consent changes over time” in How to manage open tracking.
Deliverability guidance for a large send
A transitional email is often a one-time send to most or all of your list at once, which carries the same deliverability considerations as any large send:
- Try to avoid sending your entire list in a single blast, especially if part of it is unengaged. Sending in batches over a short window is safer for your sender reputation than one very large send.
- Review your list hygiene before sending. See How to comply with data privacy laws for general list-cleaning guidance.
- For general deliverability best practices, see Understanding email deliverability and Email deliverability FAQs.
Turn on Klaviyo’s open tracking controls
Once you and your privacy team have decided what your program needs, see How to manage open tracking for step-by-step instructions on the account-level switch and per-recipient consent.