Email tracking pixel regulations (CNIL, Garante, and beyond): Managing your open tracking settings
You will learn
- What data Klaviyo's tracking pixel records
- How to determine which of your recipients these regulations may apply to
- How to send a transitional email to existing recipients, and record responses once your privacy team has them
- What to consider for deliverability with a large send
- Where to turn on Klaviyo's open tracking controls
Some regulators in the EU, including France’s data protection authority (the CNIL) and Italy’s data protection authority (the Garante), have issued guidance regarding consent for using tracking pixels in emails. Whether and how this guidance applies to your program is a determination for you and your privacy team. This article covers what Klaviyo’s tracking pixel records, and how to use Klaviyo to help act on whatever your privacy team decides.
For the regulatory background, including information about each country’s transition periods, see Tracking pixels in email: the new EU consent guidelines, explained.
What Klaviyo’s tracking pixel records
When a message is sent, Klaviyo inserts an invisible 1x1 pixel image into the email. The pixel’s URL contains a unique ID tied to a record Klaviyo creates on its servers at send time, linking that ID to your account, the message, and the recipient the email was sent to. That record doesn’t know whether the message is ever opened. This is the same pixel-based mechanism described in Understanding email deliverability and How to edit the location of your tracking pixel.
When the recipient’s email app (such as Gmail, Outlook, or Apple Mail) loads the pixel, it sends a web request to Klaviyo’s servers. Like any web request, this includes the IP address, as well as the device or browser information (user agent) the request came from. Receiving that request isn’t the same as tracking the open; whether it’s recorded as one depends on your open tracking setup.
- Open tracking on (the default, for your account and that recipient, unless you’ve turned it off or that recipient is unsubscribed): Klaviyo matches the request back to your account, the message, and the recipient using the record created at send time, and records an “Opened Email” event. The event includes the account, recipient, message, timestamp, and available device or browser information. An IP address is included when available, except for recognized email proxy services. This is the event that shows up in your reporting and recipient activity, and feeds attribution, segmentation, and flow triggers.
- Open tracking off, either account-wide or for that specific recipient: the pixel is still present in the email, and when the recipient’s email app loads it, the request still reaches Klaviyo’s servers. Klaviyo checks your settings before creating an “Opened Email” event. If tracking is off, no “Opened Email” event is created, and that open is not added to the recipient’s profile, reporting, or recipient activity. This server-side check is what allows Klaviyo to honor the recipient’s current tracking preference at the moment the email is opened, rather than relying on a status that may have changed since the email was sent.
For the full mechanics of the controls, see How to manage open tracking.
Identifying recipients who may be affected
Which recipients these rules apply to, and what that means for each of them, is a determination you make with your privacy team, not one Klaviyo can make for you. The CNIL and Garante’s guidance differ by country, and within each country, by when a recipient’s consent was originally collected. See the blog article above for a breakdown by country.
You can use profile data such as location to help build a starting audience, then work with your privacy team to confirm who’s in scope and how each group should be handled.
How to send a transitional email to existing recipients
If your privacy team advises sending existing recipients a notice about tracking pixels, and a way to respond, here’s how to do that in Klaviyo.
To stop recording opens for a transitional email, choose one of the options below. Both depend on the tracking settings when an open is processed, not just when the email is sent. Turning tracking back on can allow new opens of previously sent emails to be recorded, including the transitional email.
- Turn off open tracking for your whole account before sending, and leave it off for as long as you need to stop recording opens. This is the simplest option, but it stops recording new opens for every email in your account, including emails sent before you turned tracking off.
- Set the specific recipients you’re emailing to unsubscribed from open tracking before you send, using a CSV import, SFTP or data warehouse sync, or the API. This affects open tracking for all emails sent to those recipients, not just the transitional email, and stays in effect unless you change it, or they change it, for example through your preference page. Open tracking consent is separate from email marketing consent; changing it does not subscribe or unsubscribe someone from your email marketing.
See How to manage open tracking for step-by-step instructions on both methods.
If your privacy team determines that the opt-out approach applies to your recipients (i.e., open tracking remains on unless a recipient objects), include a way for recipients to register their objection and explain how to use it. Agree with your privacy team on how you will collect and act on those objections in Klaviyo.
How to record recipients’ responses
Recipients can respond through a Tracking consent block on your preference page. Include a manage preferences link in the transitional email, and their choices are recorded automatically. Anyone who saves the page without opting in is set to unsubscribed from open tracking. To ask only about open tracking, select only Email opens in the block’s settings. See How to let recipients manage email tracking consent on your preference page.
If you collect responses another way, such as through replies or a form on your own site, record them in Klaviyo using the methods below. Building a custom form and integration requires engineering work; this article doesn’t prescribe a specific build.
Once your privacy team has collected a response outside Klaviyo, whether a reply, a form on your own site, or something else, record it using the same mechanism as any other open tracking consent update: a CSV import, SFTP or data warehouse sync, or the API, setting the recipient to unsubscribed for an objection or subscribed for an opt-in. See “Manage open tracking consent for individual recipients” in How to manage open tracking for the exact steps.
Once consent is set, Klaviyo stores it on the recipient’s profile. To check their current choice, expand their email address on the profile and look for Open tracking under Tracking consent. You can build segments based on the Consented to Open Tracking or Revoked Open Tracking Consent events to find past opt-ins or objections, but those events do not necessarily reflect a recipient’s current choice, and Revoked Open Tracking Consent also includes recipients who saved your preference page without opting in. Use the Events API to retrieve a timestamped history of consent changes. See “Track consent changes over time” in How to manage open tracking.
Deliverability guidance for a large send
A transitional email is often a one-time send to most or all of your list at once, which carries the same deliverability considerations as any large send:
- Try to avoid sending your entire list in a single blast, especially if part of it is unengaged. Sending in batches over a short window is safer for your sender reputation than one very large send.
- Review your list hygiene before sending. See How to comply with data privacy laws for general list-cleaning guidance.
- For general deliverability best practices, see Understanding email deliverability and Email deliverability FAQs.
Turn on Klaviyo’s open tracking controls
Once you and your privacy team have decided what your program needs, see How to manage open tracking for step-by-step instructions on the account-level switch, per-recipient consent, and letting recipients give or withdraw consent through sign-up forms and your preference page.