Is Email Tracking Legal? GDPR, CAN-SPAM and UK Rules in 2026

Is email tracking legal? In most countries, yes, as long as you track your own outgoing email for a real business reason and you are honest about it. The rules tighten quickly when the message is a marketing campaign and the recipient lives in the European Union or the United Kingdom, because there the tracking pixel itself needs prior consent. One-to-one messages, such as a proposal, an invoice or a follow-up, sit at the low-risk end almost everywhere, which is exactly the use a Gmail add-on like Mail Tracker is built for.

This guide covers what the law actually says in the United States, the EU, France, the UK and Canada, where the line between a business email and a campaign falls, and a short checklist for tracking emails in Gmail without crossing it. It is general information, not legal advice. If you send large campaigns, check with counsel in the recipient’s country.

Key Takeaways

• No country bans email tracking outright. What changes by region is whether the pixel needs consent or only disclosure.
• In the US, CAN-SPAM regulates the email, not the pixel, and a 2025 California federal ruling found a sender cannot wiretap its own marketing emails.
• In the EU and UK, a tracking pixel in a marketing email is treated like a cookie: it needs prior consent unless a narrow exception applies.
• France’s CNIL adopted a dedicated recommendation on email pixels in March 2026, with exemptions for deliverability checks and transactional emails.
• The safest setup for everyday Gmail use is one-to-one tracking with a visible notice, which is how the Mail Tracker free plan works by default.

The short answer, region by region

Email tracking law has two layers. The first layer governs the email: who you may send to, what it must contain, and how people opt out. The second layer governs the tracking pixel inside it: a tiny image that reports back when it is loaded. Most confusion comes from mixing the two, so the table below keeps them apart.

If you only remember one thing, remember this: a pixel in a one-to-one email you were already entitled to send is a disclosure question. A pixel in a campaign to European or British inboxes is a consent question.

What a tracking pixel collects, and what Gmail already hides

An email tracking pixel is a 1x1 image hosted on the tracker’s server. When the recipient’s mail client loads it, the server logs the request, which tells the sender the message was opened, when, and how many times. Our email tracking pixel guide explains the mechanics in detail. The UK regulator describes the same thing from the recipient’s side: many marketing emails include pixels that record “the time a user opened an email, their location and their device’s operating system”, according to the ICO’s direct marketing guidance.

What mail clients already block

Mail clients have been narrowing what a pixel can see. Gmail loads images through Google’s own servers after scanning them, and its help page on images states that “senders can’t use image loading to get information about your computer or location”, while admitting that “sometimes, senders may know whether you’ve opened an email that has an image”. Apple goes further. According to the iPhone User Guide, Mail Privacy Protection “hides your IP address so senders can’t link it to your other online activity or determine your exact location” and “prevents senders from seeing if you’ve opened the email message they sent you”.

So the realistic data set behind an open notification is small: an open event, a timestamp, an open count, and on some clients a rough device or location. That is still personal data when it is tied to a named person, which is why the regional rules below apply.

United States: CAN-SPAM covers the email, not the pixel

There is no federal US law written specifically about email tracking pixels. The law people reach for, CAN-SPAM, is about the commercial message itself. The FTC’s compliance guide lists seven requirements:

• Honest headers: the From, To and Reply-To fields must identify who sent the message.
• Honest subject lines: the subject must reflect the content.
• Ad disclosure: the message must say it is an advertisement.
• Postal address: include a valid physical postal address.
• Opt-out method: explain how to stop future marketing email.
• Timely opt-outs: honor a request within 10 business days.
• Vendor responsibility: you cannot contract away compliance to the agency that sends for you.

The guide puts the penalty at up to $53,088 per separate email in violation, and it does not mention tracking pixels at all. If you run cold outreach from Gmail, our B2B email list guide covers the CAN-SPAM side of that in more depth.

Pixel legality in the US has instead been tested under state wiretap statutes, mostly the California Invasion of Privacy Act. The most-cited case went the sender’s way. In Ramos v. Gap, Inc., the federal court for the Northern District of California dismissed wiretapping claims over pixels in The Gap’s marketing emails on July 29, 2025, without leave to amend, according to Inside Class Actions. As Klein Moynihan Turco summarized the ruling, “The Gap cannot, by definition, wiretap its own communications”, and open rates are not the contents of a communication. Plaintiffs keep filing variations of these suits against retailers, so the practical US position is: tracking your own email is lawful, disclose it in your privacy policy, collect no more than you need, and keep an opt-out that works.

European Union: GDPR plus ePrivacy means consent for marketing pixels

Two European rules stack on top of each other. The GDPR applies because “this named person opened this email at 14:02” is information about an identifiable individual, so you need a lawful basis, a privacy notice and a way for people to object. The ePrivacy Directive applies because a pixel stores or reads information on the recipient’s device. Article 5(3) of that directive requires consent for storing or accessing information on a user’s device unless it is strictly necessary for a service the user asked for. The European Data Protection Board’s Guidelines 2/2023 on the technical scope of Article 5(3), issued as a final version 2.0 on 16 October 2024, set out how broadly regulators read that provision.

France: the CNIL’s 2026 recommendation on email pixels

France turned the principle into a concrete rulebook. On 14 April 2026 the CNIL published the final version of its recommendation on tracking pixels in emails, adopted by deliberation no. 2026-042 of 12 March 2026 under Article 82 of the French Data Protection Act. The main points for senders:

1. Consent is the rule for pixels used to personalize content, measure audiences or build profiles. The recommendation specifies the cases where consent is required.
2. Deliverability checks are exempt, but only for emails tied to a service the recipient requested, only to spot addresses that no longer open anything, and with data “limited to what is strictly necessary”.
3. Transactional emails qualify as requested services: order confirmations, invoices, shipping notices, password resets and security alerts.
4. Existing lists get three months: senders using addresses collected before publication must clearly inform recipients that pixels are used and make objecting easy.
5. Inspections will follow: the CNIL says it will check compliance in future audits.

For a solo sender, the lesson is less about campaigns and more about habit. The law on paper does not carve out one-to-one email. What lowers your risk on an individual message is telling the recipient, which is why a visible tracking notice matters more in Europe than anywhere else.

United Kingdom: PECR treats a pixel like a cookie

The UK kept the European structure after Brexit. The ICO’s position in its direct marketing guidance is unusually clear: “The electronic mail marketing rules in PECR apply to the email itself, not to the tracking pixels. Tracking pixels are covered by PECR’s separate rules on storage and access technologies, so if the email includes tracking pixels, you must comply with those rules.”

In plain terms, being allowed to send the marketing email, whether through consent or the soft opt-in for existing customers, does not cover the pixel inside it. The pixel is assessed under regulation 6, the same rule that governs cookies, and in most marketing scenarios that means prior consent unless a narrow exception applies. A marketer in Manchester therefore needs two things: permission to email, and permission to track.

Canada: CASL is about the message, and consent comes first

Canadian searches for “is email tracking legal in Canada” usually land on CASL, the anti-spam law. Like CAN-SPAM, it regulates the commercial message rather than the pixel, but it is stricter about permission. According to Innovation, Science and Economic Development Canada, businesses are “required to obtain consent from customers before sending them commercial electronic messages”. Express consent means someone agreed, verbally or in writing. Implied consent is recognized only in certain circumstances, such as an existing business relationship, and is generally time-limited.

The same page requires every message to identify the business and anyone on whose behalf it is sent, and says “every unsubscribe request must be actioned within 10 business days or less and at no cost to the recipient”. Open data tied to a named contact is personal information under Canada’s general privacy law, PIPEDA, so the usual principles of transparency and limited collection apply to what your tracker stores.

Where the line falls: one-to-one email versus campaigns

Every regime above gets stricter as volume goes up and the relationship gets thinner. A tracked proposal to a client you spoke with yesterday is a different legal object from a tracked newsletter to 40,000 subscribers, even if both use the same pixel. The US cases that have reached court so far all involve retailers’ bulk marketing, the CNIL’s exemptions are written around requested emails, and the ICO’s wording is aimed at marketing campaigns.

Use the three rows as a quick test before you insert a tracker:

• One-to-one business email: a message you would have sent anyway, to a person who expects to hear from you. Track it, disclose it, and keep the data to opens and timestamps.
• Marketing email to US recipients: follow CAN-SPAM for the message and describe open tracking in your privacy policy. Expect no federal consent requirement, but avoid building profiles from the data.
• Marketing email to EU or UK recipients: obtain prior consent for the pixel, separate from permission to email, unless you fall squarely inside an exemption such as the CNIL’s deliverability check.

If your work is mostly the first row, the compliance effort is small and a Gmail tracker is the right tool. If it is mostly the third row, you need a consent record before the first send, and a bulk platform that stores it.

How to track emails in Gmail legally: a six-step checklist

The steps below assume Gmail and a tracker that works inside it. They are designed to keep you in the low-risk category in every region covered above.

1. Track one-to-one messages, not lists. Insert a tracker in proposals, invoices, applications and follow-ups. Keep newsletters and cold sequences on a platform that manages consent.
2. Tell the recipient. The Mail Tracker pricing page is explicit that the free plan “adds a small visible signature that lets your recipients know the email is tracked”. Premium unlocks an invisible tracker, and you can switch at any time in the settings. For European and British recipients, keep the visible notice on.
3. Put a sentence in your privacy policy. Say that you use open tracking on business email, what it records and how long you keep it. This is the single step that settles most US questions.
4. Collect only what you need. Opens, counts and timestamps are enough to time a follow-up. Do not export open data into profiles or share it with third parties.
5. Honor objections instantly. If someone asks you not to track them, stop inserting trackers for that contact and delete what you hold if they ask.
6. Use consent-based receipts where they exist. On a Google Workspace domain, an admin can turn on Gmail read receipts, and can require recipients to approve each receipt before it is sent back. Google notes they do not work with personal gmail.com accounts, are not sent to groups, and should not be relied on to verify delivery, which is why most senders pair them with a tracker. Our Gmail read receipts guide compares the two approaches.

Try Mail Tracker

Read receipts, open counts and real-time notifications inside Gmail, free and unlimited. The free plan tells recipients the email is tracked, so your one-to-one follow-ups stay transparent by default.

Get Started →

Mail Tracker installs from the Google Workspace Marketplace rather than as a browser extension, which means it runs inside Gmail on the web and in the Gmail app on iOS and Android. You insert the tracker from the compose window, and opens show up as green double checkmarks in your sent mail.

Why your open data will never be complete, and why that is fine

Recipients have real controls, and a lawful tracker respects them rather than working around them. In Gmail, the “Ask before displaying external images” setting keeps every image, including a pixel, hidden until the reader clicks to show them. On an iPhone, Mail Privacy Protection is a single switch under Settings, Apps, Mail, Privacy Protection, and once it is on, Apple says senders cannot see whether the message was opened. Corporate security gateways also pre-fetch images, which can register an open before any human reads the message.

Treat an open as a hint about timing, not as proof. Our guide on how to know if someone read your email covers how to combine opens with replies and other signals so a missing pixel load never changes your judgment.

FAQ

Track emails with a clear conscience

So, is email tracking legal? For the everyday case, a tracked follow-up from Gmail to someone who expects your email, the answer in the US, Canada, the EU and the UK is yes, as long as you are transparent, keep the data minimal and respect anyone who objects. The answer only turns into “with prior consent” when the email is a marketing campaign aimed at European or British inboxes, and that is a job for a bulk platform with a consent record, not a Gmail add-on.

Set yourself up on the right side of that line: keep the tracker on one-to-one messages, leave the visible notice on for international contacts, and add one sentence about open tracking to your privacy policy. Mail Tracker gives you unlimited read receipts and open notifications inside Gmail for free, with the recipient notice switched on from the first message. For a comparison of the tools that do this well, see our roundup of the best email tracker for Gmail.