CNIL pixels, post-deadline: the cost of the last-minute sprint

News

15 Jul 2026 · Written by Baptiste Guerre

We looked at the campaigns sent through Batch. Here are the numbers, and the first lessons.

July 14, 2026 has come and gone. Since mid-June, your inbox filled up with emails you don't usually get: "Information about your emails," "Our tracking policy is changing," "Your privacy preferences are being updated."

This is the second piece in our series on the CNIL recommendation. The first one broke down the text and showed how to run the campaign. This one tells you what actually happened.

Why your inbox blew up

On April 14, 2026, the CNIL published its recommendation on email tracking pixels. Pixels are now treated as trackers under Article 82 of the French Data Protection Act. Use them for marketing (performance measurement, scoring, targeting, profiling) and you need prior consent.

For addresses collected before April 14, 2026, the CNIL set up a transition regime. No retroactive re-consent. But one obligation: tell recipients you use pixels, and give them an easy way to opt out. The deadline? 3 months. That means before July 14, 2026.

Hence the wave.

One principle frames everything else: sending is what counts as informing (proof of send matters, not the open), and under this now-closed transition regime, any pre-April 14 contact who hasn't yet clicked the opt-out link stays trackable.

The headline number: 1.46% opted out

We analyzed a panel of 23.9 million information emails, sent between May and July 2026 by French brands, on lists ranging from tens of thousands to several million contacts.

Across the panel, the explicit opt-out rate lands at 1.46% of emails sent. The per-campaign median is 1.41%.

Open rate: 32.9% panel aggregate, 38.5% median, 12.1% to 59.4% range.
Opt-out / sent: 1.46% panel aggregate, 1.41% median, 0.05% to 4.90% range.
Opt-out / openers: 4.44% panel aggregate, 4.08% median, 0.19% to 9.16% range.

These figures are as of July 15, 2026. They may still climb: a recipient who hasn't opened the email yet can open it later and opt out then.

So compliance doesn't wreck your base. In aggregate, more than 98% of contacts stayed measurable.

Method note

This panel isn't market-representative. These are brands that ran the campaign on time, so the most advanced on the topic. Industry vertical doesn't stand out as a differentiator: on this panel, two brands in the same sector diverge more from each other than the sector averages diverge among themselves.

What moves the needle: the subject line

None of the 19 campaigns with a subject line went for clickbait. They were plain and transparent. And still, open rates ran from 12% to 59%.

Recipient-centered ("your preferences," "your emails," "your choices," 6 campaigns): 44.9% average open rate, 4.6% opt-out among openers.
Company-centered ("our policy," "our communications," 12 campaigns): 32.4% average open rate, 4.7% opt-out among openers.

Twelve points apart on opens. Near-identical opt-out rate among openers.

The subject line decides how many people see the message. It does not decide how many say no. Once the email is open, the share of people who opt out holds steady near 4.6%.

Second-person possessives work. The most legalistic subject line in the panel, built around the recommendation and its technical wording, capped at 30% opens, below the recipient-centered average.
A deliberately dull subject line won't protect your base. It doesn't lower the opt-out rate, just how many people read you.

What ran short: time

The regime gave 3 months. That's tight for a project that mixes legal, technical and UX work. For comparison, the Garante, Italy's equivalent of the CNIL and so far the only other EU authority to have taken a position on the topic, allowed 6 months.

In the panel, a chunk of senders scheduled their sends just 6 to 10 days before July 14, counting back from the deadline rather than forward from the publication date. Others had campaigns ready and never shipped them. The last-minute sends show that getting these campaigns out was a real challenge for the teams.

Three things weighed in.

The calendar. A July 14 deadline, right before a long weekend and the summer lull, offered a narrow attention window.
Uneven readiness. Batch was ready as soon as the recommendation published on April 14, but not every sending provider was, and the topic forced legal, product and deliverability teams to move in parallel.
The European angle. Some brands that send beyond France walked away entirely. Fragmented country-by-country expectations, plus uncertainty on exactly what to deploy where, made the project too heavy to lock down in time.

What the scramble cost: deliverability

Mailbox providers didn't see this wave coming. None of them set up any special handling to let these regulatory information emails through more easily. If anything, the opposite happened: unusual traffic concentrated into a few days worked against senders. The result: across the 23.85 million emails we tracked at the provider level, aggregate acceptance drops to 95.0%, with wide gaps.

Gmail: 99.3% acceptance, 0.5% soft bounces, 0.0% blocks, 38.7% open rate.
Hotmail / Outlook: 88.2% acceptance, 10.6% soft bounces, 0.9% blocks, 22.9% open rate.
Orange: 81.9% acceptance, 10.2% soft bounces, 7.2% blocks, 30.2% open rate.

Gmail absorbed the volume with no drop in its acceptance rate. Microsoft's inboxes, by contrast, tripped their filters on the unusual traffic: over 10% soft bounces, delivery delays, and a real risk of retries expiring.

Local providers hit back harder. At Orange, nearly 1 email in 5 wasn't accepted, including 7.2% hard blocks. On the heaviest batch, acceptance fell to 78.5%.

Warmup mattered. Senders who spread their ramp-up hit a 32.8% average open rate, versus 24.4% for those who fired everything in a single day. One caveat: a careful warmup won't save a low-quality list.

The final cost lands on the calendar. An email blocked by Microsoft or rejected by Orange informed no one: it has to be resent. But scheduling 6 or 10 days before the deadline leaves no margin. Some of those bounces couldn't be re-contacted before the CNIL deadline.

The other mistake: blind targeting

Some brands emailed their dormant contacts with no filtering, even though a dormant contact doesn't open their emails. Keeping that option under the transitional regime brings no tangible benefit. The trace sits in the hard bounces, which flag dead addresses.

The signal is loudest on legacy mailbox domains: hard bounce rate hits 2.0% at Free and SFR, 1.8% at La Poste, 1.7% at Yahoo, against 0.2% at Gmail. A 10-to-1 gap. Those domains hold the oldest addresses, often dormant, which won't open the email: nobody gets informed, and the bounce chips away at sending reputation.

Blasting the whole base with no targeting is still the reflex most companies will fall back on. It's also what will drive the most spam complaints and deliverability damage over time.

You've likely seen it: over the past few weeks, you got emails from brands you don't remember interacting with. Every send like that pushes the sender's next messages closer to the spam folder.

Phase 2 starts now

The transition regime is closed. Three situations, three rules.

Pre-April 14 contacts you informed stay trackable, minus those who opted out. Keep proof of send for your information campaign, plus the export of opt-out events. That's what the CNIL will ask for in an audit.

Pre-April 14 contacts you didn't inform lose the transition benefit. Marketing tracking on those addresses now needs explicit opt-in, collected through a dedicated pixel-free email that points to a page where the recipient takes a positive action.

Contacts collected since April 14 fall under consent captured at sign-up. If your form doesn't ask for it yet, every new address enters your base without consent and adds to the pile you'll have to rework.

What to take away

Compliance costs less than the fear it inspires. The first read-out comes down to three points.

No opt-out tsunami. Explicit refusals stayed marginal, at 1.46% of emails sent.
A short deadline. Three months, plus expectations fragmented from one country to the next, kept or deterred part of the industry from using the transitional regime.
A likely mid-term deliverability hit. Summer sales and this wave of information emails stack up, putting heavy pressure on the email channel and likely triggering complaints in the coming weeks. Inbox placement could suffer, except for senders who spread their sends out and avoided blasting their entire legacy base, as most brands on Batch did.

The hardest signal to quantify: a lot of recipients had no idea what the email was about. Attention on an email is measured in seconds, and the topic stays technical, little understood by the public. The pixel story still needs telling.

And it doesn't end on July 14. Two fronts to watch. Europe: France and Italy have ruled, other regulators haven't, and nothing guarantees a shared approach. And measurement itself: putting the pixel behind consent slowly erodes the open rate as a metric. Fewer live pixels, less visibility into real engagement.

As with every sensitive topic, we'll keep monitoring it, training our clients, and supporting them on pixels and deliverability.