Summary
In March 2026, the CNIL (the French data protection authority) published a recommendation clarifying how existing GDPR and ePrivacy rules apply to email tracking pixels.
It isn't a new law, it's the regulator's interpretation of existing requirements, but it changes what's considered acceptable practice.
Here's what you need to know:
Post-purchase notifications sent via Shipup by ZigZag (shipment updates, delivery confirmations, carrier incident management) are service communications, not marketing communications. They fall under exemptions recognised by the CNIL.
You remain the Data Controller for your communications; Shipup by ZigZag acts as your Data Processor and provides the tools you need to meet your obligations.
If you embed marketing content in transactional notifications (product recommendations, loyalty programme promotions, promotional banners), that content may require separate consent, this is the main area to review.
What did the CNIL publish?
On 12 March 2026, the CNIL published a recommendation explaining how existing GDPR and ePrivacy rules apply to email tracking pixels.
It doesn't create new legislation, it clarifies when a pixel can be used without consent, and when prior consent is expected, depending on the purpose of the tracking.
Core principle: tracking pixels generally require prior consent, unless a specific exemption applies.
The CNIL distinguishes in particular between:
Tracking that serves an exempt purpose: security/authentication, deliverability management (e.g. cleaning inactive contacts, provided only the date, not the time, of last open is stored, overwritten each time), service communications explicitly requested by the customer (order confirmations, shipment/delivery updates), and anonymised, aggregated statistics (provided the anonymisation is effective at the storage level, not just at display).
Tracking used for marketing purposes: campaign performance measurement, behavioural personalisation, profiling, cross-channel targeting, which requires prior consent.
Key nuance: what matters is the purpose of the tracking, not the type of email. A delivery email's tracking pixel can still require consent if it's used for marketing or profiling purposes, not just deliverability.
Who's responsible for what
You (the retailer) | Shipup by ZigZag | |
GDPR role | Data Controller | Data Processor |
Decides | Which communications are sent to your customers, the purpose of tracking, the content displayed, the appropriate legal basis | How to implement your instructions technically |
Responsible for | Collecting and managing your customers' consent, determining the legal basis for each processing activity | Providing the tools and documentation needed to support your compliance |
Does not | Validate individual customer consent, communicate directly with your customers on this topic |
Transactional and marketing communications serve different purposes, which may lead to different compliance requirements. Compliance is a shared effort: Shipup by ZigZag provides the tools and documentation; you decide how to use them.
How Shipup helps you stay compliant
Your post-purchase notifications are service communications.
Notifications sent via Shipup by ZigZag (shipment updates, delivery confirmations, carrier incident management) serve a service your shopper requested. The pixel is also used for deliverability monitoring and customer support. Based on our current interpretation, this core usage falls under the CNIL exemptions. You remain the Data Controller, responsible for the legal basis of your own use.
The area to watch is edge cases: if you embed marketing content in transactional notifications (product recommendations, loyalty programme promotions, promotional banners), or use aggregated metrics for marketing purposes, that content may require separate consent. It's your responsibility to assess whether these communications require consent under the CNIL recommendation.
You can already request that the tracking pixel be disabled
On request to your Customer Success Manager or our Support team, we can fully disable the tracking pixel on your account. This setting applies to the whole account, with no intermediate option.
What's available
Shipup by ZigZag is committed to helping you comply with the CNIL recommendation while preserving the operational value of post-purchase communications. Here's what's available :
Opt-out link in notification email footers: your shoppers can object to their email opens being used for marketing measurement.
Opt-out export: your account admins can export the opt-outs collected through this link, to keep your own systems in sync.
Consent import by CSV, self-serve for admins, in Settings → General → Email tracking.
Email deliverability dashboard: it covers all your shoppers, regardless of consent.
What we recommend you do now
The CNIL set a deadline of 14 July 2026: for existing contact databases, retailers were required to inform recipients and give them the opportunity to opt out. If you haven't done this yet, we recommend you:
Identify whether your transactional notifications include marketing content (product recommendations, promotions, banners), this is the segment most exposed under the CNIL recommendation.
Review your consent and transparency mechanisms for any marketing-related tracking, in coordination with your legal counsel.
Does the recommendation ban tracking pixels?
No. The recommendation recognises that certain tracking activities may benefit from existing exemptions, particularly where they are closely connected to the delivery of a service requested by the customer.
Are shipment and delivery notifications still permitted?
Yes. These communications are among the examples explicitly referenced by the CNIL as potentially falling within the exemption framework.
Does Shipup by ZigZag become the Data Controller?
No. You remain the Data Controller. Shipup by ZigZag acts as your Data Processor.
Does Shipup by ZigZag verify customer consent?
No. You remain responsible for determining the appropriate legal basis for each processing activity.
Can I disable tracking?
Yes, on request. Contact your Customer Success Manager or our Support team. This isn't yet something you can do yourself from your account settings, but we're working on more granular, self-service controls.
What if my notifications contain marketing content?
You should assess whether those communications require consent under the CNIL recommendation. Check with your legal counsel if you're unsure.
Can I personalise post-purchase communications?
Yes, provided the personalisation serves the delivery experience rather than a marketing purpose. Adapting a notification based on the delivery journey, or adding extra reassurance for a high-value shipment, generally aligns with the operational framework. Personalisation used to promote products, segment customers based on behaviour, or optimise marketing performance requires consent.
Is this only relevant in France?
No. This recommendation was published by the CNIL and directly reflects its interpretation of French law. However, it's based on existing ePrivacy and GDPR principles that apply across the EU, and we expect it to influence the broader European interpretation of email tracking practices. If you operate across multiple European countries, we recommend applying a consistent approach wherever practical and seeking local legal advice where country-specific requirements may differ.
What Shipup by ZigZag features are affected?
Primarily features that rely on email open and click tracking: operational post-purchase notifications, marketing content embedded in notifications, email performance dashboards (open rates, click rates, CTOR, conversion metrics), and marketing attribution features such as UTM tracking. Other features aren't directly affected by this recommendation, though they remain subject to applicable data protection rules.
Can the same tracking data be used for different purposes?
Yes. For example, when a customer opens a delivery notification, that tracking event may support both operational purposes (customer support, deliverability) and marketing measurement. Shipup distinguishes these purposes: tracking data continues to be processed for operational purposes covered by the exemption, but is not used for marketing analytics, campaign optimisation, or ROI reporting if the customer hasn't consented.