France and Italy set pixel-tracking consent deadlines, and Klaviyo is shipping controls now

Two European data regulators moved in the same month, April 2026, to extend consent requirements inside the inbox itself. France's CNIL published a formal recommendation on tracking pixels in email on April 14; Italy's Garante followed on April 29 with its own guidelines. Both documents reach the same core conclusion: a tiny invisible image used to record whether a recipient opened an email is a tracking technology, and deploying one for most marketing purposes requires the recipient's prior consent, separate from any consent already given to receive the email itself.

For marketing and CRM operations teams managing large EU lists, the practical implications are immediate. The French deadline for handling existing contacts has already passed. The Italian window closes in October. And Klaviyo, one of the larger email platforms serving mid-market and enterprise brands, has begun shipping controls specifically designed to let senders act on their privacy team's guidance without waiting for a future platform release.

What the two regulators actually require

The CNIL's recommendation, available in an official English translation, draws a sharp line at July 14, 2026. Contacts collected before April 14 fell under a transitional opt-out regime: senders had until July 14 to inform them of pixel tracking and give them a simple way to object. Contacts who received that notice and did not object can continue to be tracked. Those who did object must not be. Senders who missed the July 14 deadline cannot rely on the transitional mechanism for those contacts.

For contacts collected between April 14 and July 14, the CNIL requires affirmative consent before tracking begins. The recommended path is a dedicated, tracker-free email inviting the recipient to opt in through a positive action, such as clicking through to a landing page. Recipients who do not respond are treated as having declined, and the CNIL advises against re-soliciting them for at least six months. Going forward, contacts collected after July 14 should give tracking consent at the point of sign-up, before any tracked email reaches them, according to the CNIL's recommendation.

Italy's Garante takes a structurally similar approach with a later enforcement horizon. The transitional window runs through October 28, 2026, six months from publication. For contacts collected before April 29, senders can continue tracking during the window provided they inform each contact at the next meaningful interaction and offer a withdrawal mechanism. That notice can appear in a regular marketing email rather than a standalone message. The withdrawal mechanism must give two options at equal prominence: stop tracking only while continuing to receive emails, or unsubscribe from emails entirely.

One notable difference between the two frameworks concerns how consent can be bundled at the point of collection. The CNIL appears to require that tracking consent be collected separately from marketing email consent in all cases. The Garante's guidance is somewhat more flexible: it appears to permit combined consent where the processing purposes are identical, but requires separate consent where purposes differ. Privacy teams reviewing both frameworks will want to assess which scenario applies to their programs.

Klaviyo's current controls and what's still coming

Klaviyo disclosed in a July 2026 post on its blog that it has shipped two controls to help senders manage open-tracking consent now, ahead of native sign-up form functionality. The first is an account-level toggle, found under Settings > Email > Tracking, that stops the platform from recording opens across every email the account sends. The second is a per-recipient consent status for open tracking, separate from the existing marketing-consent field, that can be set individually or in bulk via CSV import, SFTP, data-warehouse sync, or the API.

When a recipient's status is set to opted out, Klaviyo stops recording their opens immediately and going forward, including for messages already delivered to their inbox, according to the company's published guidance. Recipients without an explicit status continue to be tracked under the existing default. The platform does not yet offer native consent collection for transitional emails, though Klaviyo indicates that senders can use a third-party form or hosted landing page to collect responses and then store the results in Klaviyo's consent management system via the controls above.

Later in 2026, Klaviyo has said it plans to build pixel-tracking consent collection directly into sign-up forms and the preference center, using the same interaction patterns subscribers already recognize from marketing-email opt-ins, and to add a direct in-email mechanism for recipients to withdraw tracking consent without unsubscribing. That work is described as ongoing and will affect how both the French and Italian post-transition requirements are met for new contacts at the point of sign-up.

Operational steps for CRM and marketing teams

The regulations place the determination of which requirements apply squarely on the sender, not the platform. Which contacts fall into which cohort, what the transitional notice must contain, and when consent solicitations should go out are all questions for internal privacy counsel or an external legal advisor. The CNIL and Garante documents themselves, both linked in Klaviyo's guidance, are the appropriate starting reference for those conversations.

For Italian programs, the October 28 window means there is still time to build a compliant notice into the regular send calendar for pre-existing contacts, provided the notice meets the Garante's equal-prominence standard for withdrawal options. For contacts collected in the April 29 to October 28 window, tracking should already be suppressed while consent is solicited through a tracker-free message.

Klaviyo's bulk-import path, via CSV or data-warehouse sync, is the most practical mechanism for operations teams managing large lists across multiple cohorts. Teams that have already segmented their lists by collection date are in the best position to apply the right status to each group once their privacy team has confirmed the approach.

What this means for your team

• Confirm with your privacy team whether your EU contact lists are in scope for the CNIL recommendation, the Garante guidelines, or both, and which cohort each segment falls into based on collection date.
• If you are on Klaviyo, audit your current open-tracking setting (Settings > Email > Tracking) and assess whether a bulk status update via CSV or API is needed before the Italian October 28 deadline.
• For contacts collected between April 14 and July 14 (France) or April 29 and October 28 (Italy) without tracking consent, build a tracker-free consent-solicitation flow now; waiting until native form functionality ships later in 2026 may not leave enough runway for the Italian window.
• Evaluate whether your current sign-up forms collect tracking consent separately from marketing consent, as the CNIL requires this separation in all cases and the Garante requires it where processing purposes differ.