Hi, {{first_name|friend}}. 👋

Welcome to Issue #252 of All About Email!

Last week, we were back with another summer guest author. Robert Brandl has built this awesome Chrome Extension (I use it), and that comes with a serious amount of data, as we looked at what the email platforms behind 16,655 brands can tell us.

This week, I'm returning to the CNIL and Garante tracking pixel story from Issues #238 and #239. The response to those two issues was fantastic, and a lot of what's been written publicly since has left me with a nagging feeling that something important is being missed.

Let’s go! 👇

⚠️ Before we get stuck in, I am not a legal professional or a privacy expert (although I am a big privacy advocate, and cover topics like this often), so the below is not legal advice; check with your organisation’s legal support.

If you are not familiar with this topic and you haven’t read Issues #238 and #239, start there before going any further.

🚨 Some important things to note:

Since Issues #238 and #239, a common piece of advice has been appearing in articles and social posts:

🚨 It sounds practical and actionable. But it rests on a false premise that most articles never actually examine; let me explain:

💡 Nationality, residence, current location, and what's in your CRM are not interchangeable legal tests:

People move. People travel.

The dependency is on other things, which are much harder to segment:

The CNIL actually made this clearer in its July FAQ. It says French law can apply to a non-EU organisation where pixels are used to monitor the behaviour of people located in France. Article 82 also specifically refers to its competence regarding users located in France.

🚨 Notice the wording: users located in France, not French citizens.

That doesn't mean someone's physical location automatically answers every territorial-scope question. Still, it does reinforce why identifying “French people” by nationality, email domain, or a CRM country field is the wrong starting point.

💡 Domain matching (@orange[dot]fr, @laposte[dot]net) and CRM country fields are useful proxies for identifying who is “likely” in France.

The advice isn't completely wrong. But you're making an educated guess, not achieving legal certainty, and you should frame it as such rather than present it as a complete compliance solution.

This is exactly the point Lauren Meyer raised back in April: determining who is "French" at the time of interaction isn't straightforward.

🤔 It's one reason a single global standard starts to look more defensible than segmenting by geography.

The obvious response is: "use IP data to work out where someone is when they open."

Here's the problem with that:

The IP address is received when the remote image is requested. The tracking pixel has already fired before you can use the IP to estimate where the recipient might be.

🤔 You can't use data collected through a tracking operation to decide retrospectively whether that tracking operation should have happened.

And even setting that aside, IP geolocation in email is increasingly unreliable:

🚨 As I mentioned in Issue #238, MPP already compromised open rate.

The same problem that broke your open rate is now breaking your compliance location signal.

This isn't just me arguing that ESPs need to build better controls. In its July FAQ, the CNIL specifically tells service providers that their products should make it easier for customers to comply.

It says providers should offer functionality that supports:

💡 The CNIL also says providers may offer functionality to collect that consent.

Since Issues #238 and #239, I've been watching which platforms have actually moved on this, although the below is not an exhaustive list:

💡 That gives it a reasonably complete consent-management model: a default policy, recipient-level overrides, and a way for subscribers to change their preference themselves.

The remaining question I’d still like answered is whether withdrawing consent also neutralises tracking of emails already in the inbox, which the CNIL now expects providers to handle.

💡 Until HubSpot documents a true recipient-level tracking-consent mechanism, I'd treat its current position as more of a campaign-level workaround than a complete consent-management solution.

💡 That puts Brevo much closer to the recipient-level model the regulators are asking ESPs to support, rather than relying on a blanket country segment or account-wide switch-off.

Brevo’s implementation covers both open and click tracking, which is broader than Klaviyo’s current documented recipient-level control, which is specifically focused on open tracking.

🧠 That distinction is useful because it shows different ESPs are interpreting and implementing the regulatory requirements differently.

🚨 And then there are the platforms that have said nothing, including Beehiiv, my ESP.

There's no documentation of tracking consent controls, no per-contact suppression, no global tracking disable for email opens, and no public statement about CNIL compliance that I can find.

But Beehiiv isn't alone. Several platforms are in the same position, and if you're on one of them, the questions I'm raising here apply just as much to you.

💡 French compliance consultancy Dipeeo goes further in its CNIL guide. It recommends that if your email platform cannot disable tracking pixels or otherwise implement the required controls, you should consider whether the provider remains suitable for your compliance needs.

Dipeeo links that back to Article 28 GDPR, which requires controllers to use processors that provide sufficient guarantees around appropriate technical and organisational measures.

🚨 That does not mean Article 28 automatically says “your ESP has no tracking toggle, therefore you must leave.” The assessment is broader and depends on the processing, available safeguards, and how the service is configured.

But if your ESP cannot technically enable you to comply with a regulatory requirement, processor suitability becomes a legitimate question.

I’m not saying switch… I’m saying it’s a question worth asking.

That’s a lot to take in, and I have even more to say on the topic. 😂

A lot of the compliance guides that have appeared since July 14th are genuinely well-intentioned (like my articles), and some have useful platform-specific detail.

But the “identify your French contacts and segment them” framing that runs through almost everything is not the complete answer; it’s a practical starting point.

💡 The IP chicken-and-egg problem, where the pixel has already fired before you can determine location, is a gap that almost no article addresses.

So, I’ll leave you with this:

That comes with consequences of its own, of course.

But maybe the answer to a tracking-consent problem isn’t better geographical tracking. Maybe it’s accepting that open tracking isn’t worth preserving in its current form.

🫠 I’m going to guess this is where some of us are right now:

🤔 Is this where most of us will sit until ESPs catch up?

For some platforms, that’s happening now. For others, including mine, we’re still waiting.

And in a couple of weeks, I’m going to look at the other option properly: what actually happens if we switch off open tracking?

That's it for this week, {{first_name|friend}}. 👋

Simon

Every week, as I write this newsletter, I'll share the track of the moment to create an unbelievably eclectic playlist just for your inbox.

🚨 If you’re interested in sponsoring the “All About Email” newsletter, you can find all the details in this Google Doc.

This week's excellent and insightful email news & tips:

If you have any questions about this email or email marketing, please reply, and I will get back to you as soon as possible.

I hope you have a great week! 👋