Open Pixel Tracking Consent (CNIL Compliance)

Applies to: Campaigns (ZMP)
Status: Generally available from July 14, 2026

Overview

To help you comply with the French data protection authority (CNIL) guidance on email open-tracking pixels, Zeta has introduced open pixel tracking consent controls in Campaigns. When enabled, the platform automatically checks each recipient's location and consent status at send time and, for in-scope recipients who have not opted in, suppresses the open-tracking pixel and disables link (click) tracking for that message.

This means you stay compliant without having to manually build or maintain separate "tracked" and "untracked" versions of your campaigns. Your job is to make sure the underlying profile data is in place; the platform handles the suppression logic.

This article explains how the feature works, what data it relies on, and the actions you need to take.

Background: what CNIL expects

CNIL guidance treats the email open-tracking pixel as tracking technology that requires recipient consent for individuals in scope (currently France, with other EU countries expected to follow). In practice, this means:

• Open tracking should be suppressed for in-scope recipients who have not consented.

• The obligation is primarily forward-looking: stop using the pixel going forward for recipients who have not consented or who have withdrawn consent.

• Based on current CNIL direction, there is no requirement to retroactively purge historical open data that was lawfully collected, provided it stays within your normal retention and data-minimization rules. (You should confirm your own retention approach with your legal team.)

This article describes how the Campaigns feature works. It is not legal advice. You are responsible for determining, with your own legal and privacy teams, which recipients fall in scope and what consent posture is appropriate for your business.

How it works

The feature relies on two pieces of profile data and a simple decision made when each message is built.

1. The consent field

A new user (profile) property records whether a recipient has consented to open tracking via pixel:

The field name is published so you can begin loading your collected consent data against it now.

2. The location field

The platform determines whether a recipient falls under the requirement by reading the profile's country golden record, z_country. Only z_country is checked for the location decision, so it's important to understand how that field gets populated.

How z_country is set. For each profile, the platform makes a single decision based on whether you have supplied geo data:

• You send geo data → we use yours. If your uploaded or ingested data contains any of the geo fields (city, state, zip, country, latitude, longitude), the platform treats your data as the preferred source: it uses your supplied values and stops falling back to its own IP-inferred values for that profile's geo fields. Customer-supplied data always takes precedence over inference.

• You send nothing → we infer. If you provide no geo data, the platform falls back to a location inferred from IP address and user-agent signals across the profile's web and email activity.

This same logic applies to the whole geo group (city, state, zip, country, latitude, longitude) — country is not treated differently.

Two things to watch out for:

1. It's all-or-nothing across the geo group, not field-by-field. As soon as you provide any geo field, the platform switches entirely to your data for all of them. So if you upload only a city but no country, z_country comes out blank — and the inferred country is discarded rather than kept as a fallback. To have a reliable z_country, include country in your geo uploads.

2. A custom country field replaces the standard one. By default, the platform reads the country from the standard country field. If your account is configured to read from a different field (for example, customer_designated_country), it reads from that field only — uploading a plain Country column will no longer populate z_country. It is one or the other, not both.

If you store country in a non-standard field, it must be mapped so the platform knows to read from it. This is a one-time, per-account configuration change handled on the back end by your Zeta implementation/account team. Standard fields are recommended during integration; non-standard fields require this mapping to work. For more on standard attributes, see Standardization of Attributes. If you're unsure how your country data maps to z_country, contact your Zeta account team before go-live.

3. The suppression logic

When the feature is enabled for your account, at the moment each campaign message is built the platform:

1. Compares the profile's z_country against the list of countries where consent is required (currently France).

2. If the recipient is not in an in-scope country → the email is built normally, with open tracking intact.

3. If the recipient is in an in-scope country, it checks open_tracking_pixel_opt_in:

   • yes → the email is built normally and tracking continues.

   • no or null → the open-tracking pixel is not inserted, and both open (pixel) tracking and link (click) tracking are disabled for that send.

In short: for recipients in a covered country, tracking only happens when consent is explicitly yes. Anything else (an explicit no, or no value at all) is treated as "do not track," and both open and click tracking are turned off for that message.

What you need to do

To get the benefit of the feature and stay compliant, take the following actions.

1. Load your consent data into open_tracking_pixel_opt_in.
Populate this field on your user profiles using your standard data loads, based on the consent you have collected. Set yes for recipients who have opted in to open tracking, and no for those who have opted out. Profiles you leave blank (null) will be treated as "not consented" for in-scope countries.

2. Make sure country data reliably lands in z_country.
The location check reads only z_country, so confirm it is populated correctly for your profiles:

• If you upload geo data, include the country in the same upload. Because geo is handled as all-or-nothing, sending other geo fields (like city) without country will leave z_country blank.

• If you store country in a non-standard field, have your Zeta account team map your account to read from that field. This is a one-time back-end configuration change, and it replaces the standard country field rather than adding to it.

• If you supply no address data at all, z_country is automatically calculated from IP-based geo-inference, so it will still be populated (though inference is less precise than a declared country).

Profiles with a missing or incorrect country may not be evaluated the way you expect.

3. Keep collecting and updating consent going forward.
Continue to gather consent through your normal opt-in mechanisms and keep the field current, including honoring withdrawals of consent (set the field to no). This keeps you aligned with the forward-looking nature of the requirement.

4. Plan for transactional / event-triggered sends.
For event-driven or transactional programs, be aware of timing: if a flow writes the consent property to a profile and then immediately sends in the same event, the value may not be persisted before the message is built, which can cause it to be read as empty. Set consent on the profile ahead of the triggering event rather than trying to write and send in the same step. If you have a transactional use case that depends on same-moment updates, contact your Zeta account team to review options.

What happens to your metrics

For recipients whose tracking is suppressed, neither opens nor clicks will be recorded for those sends, so open- and click-based metrics, reporting, and any segmentation or logic that depends on that data will not reflect those recipients. This is expected behavior and is the mechanism that keeps you compliant. Recipients with consent set to yes and recipients outside covered countries are unaffected and continue to be tracked normally.

Historical data

You are generally not required to delete open data that was already collected. CNIL's current guidance is forward-looking: the goal is to stop using the pixel for non-consented, in-scope recipients from this point on. Historical opens that were lawfully collected may remain available for reporting, subject to your own retention and data-minimization policies. Confirm your specific approach with your legal team.

Coverage today and what's next

• Countries in scope today: France. The country list is designed to expand as additional countries adopt comparable requirements (Italy and Germany are expected to follow). When a country is added, in-scope recipients there will be evaluated in the same way.

• The feature is being rolled out across Campaigns (ZMP) accounts to minimize the chance that an affected recipient is missed.

Frequently asked questions

Which recipients are affected right now?
Recipients whose z_country is France and whose open_tracking_pixel_opt_in value is not yes (i.e., no or blank). Recipients in other countries are not affected today.

What if I don't collect country data?
z_country is a calculated field, so in most cases it will still be populated even if you don't send country data. It prefers the country value you supply and falls back to a country inferred from IP and user-agent activity when you haven't provided one. The one case to watch: if you send some address fields (for example, city and state) but omit country, the fallback is skipped, and z_country stays blank. So either include the country whenever you send address data, or send no address data and rely on inference. A declared country is more accurate than inference, so provide it where you can.

Do I need to set the consent date field?
open_tracking_pixel_opt_in_date is optional. You can record it if it's useful for your own audit purposes, but it is not required for the suppression logic to work.

Can I turn tracking back on for a recipient?
Yes. Set open_tracking_pixel_opt_in to yes for that profile (for in-scope countries), and open tracking resumes on subsequent sends.

Is this legal advice?
No. This describes platform functionality. Decisions about which recipients are in scope and what consent posture to adopt should be made with your own legal and privacy teams.