What a tracking pixel is, legally
A tracking pixel is a remote image whose address is unique to one message. When the recipient's mail client loads it, the server learns that the message was displayed, when, and by what kind of client. Legally, the interesting fact is not the image. It is that loading it causes the recipient's device to make a request that tells you something about them, without their knowledge, using their equipment.
The EU and the UK
The ePrivacy Directive, as implemented in each member state and retained in the UK, regulates "storing information, or gaining access to information already stored, in the terminal equipment" of a user. Regulators read a tracking pixel as exactly that: it gains access to information on the recipient's device, so it needs the recipient's consent, with narrow exceptions for what is strictly necessary to provide a service the user asked for. Learning whether your email was read is not something the recipient asked for.
Two consequences are easy to miss:
- The consent question is separate from whether you may send the email at all. A legitimate interest that justifies sending a business email does not extend to tracking whether it was read.
- In April 2026 France's data-protection authority, the CNIL, published a recommendation requiring prior consent for marketing pixels, with exceptions only for security and deliverability purposes. Other EU regulators routinely follow the CNIL's lead on tracking questions.
One-to-one professional email
Most of the guidance is written with bulk marketing in mind. An individual email from one person to another, tracked so the sender knows whether to follow up, sits in murkier territory: it is not marketing in the usual sense, the volumes are tiny, and the recipient often expects a reply anyway. Murkier is not exempt. The device-access reading of ePrivacy does not depend on how many messages you send, and the safest assumption is that consent is needed for EU and UK recipients unless you have a specific reason to think otherwise.
The United States
Open tracking is lawful in the United States. CAN-SPAM regulates commercial email but does not prohibit tracking whether a message was opened. State privacy laws focus on the sale and sharing of personal information and on consumer rights, and a one-to-one tracked email from a small sender is generally outside their thresholds. None of this makes tracking invisible to your recipients' expectations, which is a different question from legality.
Recipient data and who is responsible for it
Under the GDPR and the UK GDPR, an IP address can be personal data, and so can a timestamp linked to a named recipient. Whoever decides to track is the data controller for what the tracker records: with a hosted service, you and the vendor share that role; with software you run yourself, it is you alone.
That makes what the tracker keeps a legal matter as much as a technical one. This is why MailSignals stores about the recipient only a timestamp, a user agent, an IP truncated to a /24 (or /48 for IPv6) plus a salted hash of it, the referrer and the method; never the full address, never a location, never the message. Behind Gmail, Outlook.com, Yahoo and Apple Mail the request comes from the provider's proxy anyway, so even the truncated network describes a data centre rather than a person.
The controls that let you comply
A tracker cannot obtain consent for you; it can give you the means to honour the decision you make. MailSignals provides these:
| Control | What it does | Use it for |
|---|---|---|
| Do-not-track domains | Recipients at listed domains are never tracked; the compose window says so and sends the mail untouched | EU or UK recipients as a blunt instrument, or any organisation that has asked you not to |
| Disclosure footer | An optional one-line notice appended to every tracked message, with text you write | Transparency where you track; it does not substitute for consent where consent is required |
| Per-message switch | A toggle on every compose window | Turning tracking off for one message without changing your defaults |
| Mail to yourself | Never tracked, with no override | Nothing to configure |
| Retention | A window in days after which raw events are deleted; sender view signals and unmatched hits are pruned after seven days regardless | Keeping only what you need |
| Export and delete | Everything out as CSV or JSON; everything gone on request | Access and erasure requests |
| No location | No code path records one, even though a setting for it exists | Nothing to configure |
If you send marketing email into the EU, get consent at the point you collect the address, and record it. That is outside what any tracker can do for you.
- Decide, per recipient region, whether you track at all.
- Put the domains you will not track on the list before you send, not after.
- Turn the disclosure footer on if you track professional contacts; it costs one line.
- Set a retention window; history you no longer need is history you no longer have to protect.
Related: the full privacy page, including what is stored about you · what is never rewritten, including unsubscribe links.