What disclosures are required for tracking pixels?

If your email contains a tracking pixel (and most marketing emails do), privacy law requires you to tell subscribers about it. The specifics vary by jurisdiction, but the general rule is: disclose what you collect, why you collect it, and what you do with it.

Under GDPR (European Union): Tracking pixel data is personal data when it's linked to an identifiable person, which it usually is. You need a lawful basis for processing it, either consent or legitimate interest (with a proper Legitimate Interest Assessment). Your privacy policy must describe the tracking, what data you collect (IP address, device type, open timestamp, click behavior), the retention period, and your lawful basis.

Under CCPA (California): If you're selling or sharing tracking data with third parties (for example, passing click behavior to an ad platform), you need to disclose that and offer opt-out. Internal analytics use is generally less restricted.

Under ePrivacy Directive: Some interpretations require explicit consent for tracking pixels in email, similar to cookie consent for websites. This is actively debated and not uniformly enforced, but EU-facing senders should get a privacy lawyer's view rather than assume it doesn't apply.

In practice, most email programs handle this through a clear, accessible privacy policy that describes email tracking, linked from every email footer. What the disclosure actually says matters: "we use tracking technologies to measure email performance including open rates and click rates" is more honest than burying it in a generic "we may collect data" clause.

For how privacy laws affect email tracking more broadly, that gives the full picture. And if you're wondering whether your unsubscribe link also constitutes consent withdrawal, that's a separate question worth reading.