Tracking consent

Privacy protection laws are interpreted more and more strictly, and some web players even take their own initiatives to go further (for example, Apple's "Mail Privacy Protection").

In France in particular, the "Informatique et Libertés" law states that consent is required to place or read information on a profile's device.

Actito allows to manage the "tracking consent"(trackingConsent), which defines whether or not a profile's behavior can be tracked for marketing purposes, following the sending of a message (for example: recording the opening or a click in a campaign).

Recommendation on tracking pixels

On April 14th 2026, the CNIL (Commission Nationale de l'Informatique et des Libertés — France's data protection authority) published its recommendation on tracking pixels.

Good news: consent to trackers already makes it possible to comply with this recommendation!

Understanding the tracking consent

The tracking consent is broadly defined as the consent to track the behavior of a profile for marketing purposes.

Practically, the tracking consent regulates the following actions:

• recording the opening of an e-mail, WhatsApp message, Push and In-App
• recording a click in an e-mail, SMS message, WhatsApp message, Push and In-App
• recording a website visit or transaction goal
• recording the device and the user-agent used by the profile

By default, all channels are enabled. This means that for a profile with a "no" setting for tracking consent, none of the above actions will be stored in its interactions. However, the license administrator can precisely define the scope of tracking consent in the license settings.

Difference with Marketing consent

In terms of how it works, tracking consent is similar to marketing consent (marketingConsent), which governs the consent given by a profile to be targeted by marketing communications.

A profile may very well agree to receive marketing communications (positive marketing consent) but refuse to allow its behavior in response to these communications to be stored and used to influence the messages it receives (negative consent to trackers).

These are therefore two complementary concepts.

Set up the tracking consent

Your profiles' consent, whether positive or negative, is stored in your profile table using the predefined "trackingConsent" attribute (provided that the attribute exists in your profile table).

If your profile table was created without this attribute, you can add it via the interface (using no-code or JSON) or via the API with no default value.

note

The default value of the trackingConsent attribute cannot be changed after it is created via the interface (however, this is still possible via the API or JSON).

CNIL recommendation

If you add this field to your table, be sure not to set a default value. Reminder:

• Profiles created after April 14, 2026 must have consent set to "FALSE" by default
• Profiles created before April 14, 2026 must have consent set to "TRUE" (it is deemed to have been given), but users must be notified via an information campaign containing a withdrawal form

info

If no value is specified for this attribute in a profile, it will be considered to have the value TRUE.

Applying the consent

In practice, applying a negative tracking consent will have an impact on reporting and profile interactions.

Profile interactions

If a profile refuses to have its behavior tracked, none of the interactions listed above will appear in the profile's interactions.

This means that:

• these interactions are excluded from the campaign event export
• this profile cannot be targeted based on this interaction (a profile with negative consent will always be considered a "non-opener" of a campaign in targeting)
• no scenario can be triggered by this interaction. Similarly, an "open" or "click in a campaign" wait block will always send a profile with negative consent to the exit branch, since the action is not recorded.

In addition, the profile technical attributes "lastDevice" and "lastUseragent" will no longer be updated.

CNIL Recency Exception

To allow you to clean up your profile table, Actito will update the recency attributes (e.g., date of last open) with the date only, without the time. This anonymized recency date may under no circumstances be used for standard marketing targeting. It must be used exclusively to reduce targeting frequency or to clean up inactive profiles. You must set up a cleanup segmentation yourself to benefit from the exemption provided by the CNIL and protect yourself in the event of an audit.

A negative tracking consent means that the interaction is not stored. From a practical point of view, the technical means developed by Actito to collect the information (such as the tracking pixel or the links redirection) remain in the e-mail campaigns. But any ensuing interaction will not be recorded nor stored in the license.

Reporting

To balance privacy and data reliability, Actito handles opt-out consent as follows:

• Campaign interactions (by profile): Opens, clicks, and conversions do not appear for profiles that have opted out of tracking, making it impossible to identify or analyze the behavior of a specific profile

• Overall campaign reports (anonymized): Interactions continue to contribute to the campaign's overall data (open rates, click-through rates) without being linked to any individual profile. This allows you to maintain accurate performance statistics without violating your profiles' opt-out consent.

Similarly, no transactional goal will be attached to the campaign, nor will it appear in the Revenue module.

note

This distinction may result in discrepancies between certain reports:

• Detailed interaction reports (for example, email reports showing opens or clicks by profile) will display data only for profiles that have consented to tracking.
• Aggregate (anonymized) reports also include interactions from profiles that have not consented to tracking.

You may therefore notice differences between interactions and campaign reports.

Obtaining and viewing the tracking consent

The consent (or non-consent) of a profile can be gathered upstream in your system and fed into Actito via import, synchronization or API call.

It can also be collected directly via Actito forms:

• By creating a collection form, and link it to an (e-mail or SMS) campaign.
• By create a preference center, to be used as scenario to unsubscribe an e-mail campaign.

tip

For more information about the creation of those forms, please refer to "subscriptions".

::: info If your profile table is synchronized with an external system (CRM, ERP, e-commerce, CDP, etc.) that serves as your data source of record, we recommend that you first update the consent information in that system and then synchronize it with Actito. Creating or modifying a consent attribute directly in Actito without taking your source system into account could lead to inconsistencies between the two platforms. :::

Multi-country consent management

In some countries, explicitly obtaining consent for trackers is not required. As a result, some of your profiles may not have a value for the trackingConsent field.

info

The trackingConsent attribute is not a required field and may therefore be left blank. In this case, the absence of a value will be interpreted as TRUE.

If your profile table contains profiles from multiple countries, we still recommend that you follow the CNIL's guidelines.

Although these guidelines apply specifically to the French context, they were developed based on European regulations. It is therefore recommended that you follow them for all your profiles, not just those based in France.

warning

For multi-country databases, be sure to take this logic into account when creating segments or reports based on the trackingConsent field. Profiles for which no value is specified will be treated as profiles with the value TRUE.

View the tracking consent

The collected consent is stored in the profile, under the "Interactions" tab.

The update of the tracking consent of a profile can exported through the module Exports, thanks to the incremental export on "Profile changes" with the type "Consent changes" (which contains both the acceptation and refusal of marketing consent and tracking consent).

Good to know

The action of removing one's consent will impact future interactions, which will not be recorded, but does not delete the opening, clicks, etc information collected previously, when the consent was positive. Historical data therefore remain available.

Recommendations Regarding Tracking Pixels

On July 7th 2026, it will be updated to align precisely with the exceptions outlined in the recommendation:

• retention of anonymized statistics and the date of last opening
• granularity of the scope of application

You don't have to wait until July 7 to take action. The Actito update is required only to qualify for the exemptions provided, not to implement the collection and tracking of tracking consent.

To do immediately

• Enable the trackingConsent attribute in your profile table without assigning a default value to it or to existing profiles.
  • Profiles without values are treated as TRUE and will therefore not cause any change in behavior.
• Update all data collection forms to include tracking consent and populate the trackingConsent

New profiles → created on or after April 14

The CNIL has not provided a transition period for new registrants. Therefore, you must:

• Collect tracking consent upon registration.
• Set trackingConsent = FALSE when consent has not been obtained.
• Plan dedicated campaigns to collect consent from the relevant contacts.

Existing profile table → profiles created before April 14

Consent for the existing profile table as of the publication date is deemed to have been obtained, however you must inform subscribers about email tracking practices and their right to opt out:

• Launch an informational campaign with a link to an opt-out form.
• Define the target audience: for deliverability reasons, we recommend not contacting the entire profile table but using this opportunity to clean out inactive contacts.
• Before sending, set trackingConsent = TRUE for the contacts covered by this mechanism by specifying the campaign name/date as the method and time of collection.
• Send the campaign between July 8 and 14.
  • If the target exceeds your usual volumes, you can send the campaign in several waves to preserve your deliverability.

Disclaimer

The tools provided by Actito help you ensure technical compliance. However, you remain fully responsible for configuring your campaigns, adhering to legal deadlines, and ensuring the legal validity of the consent you collect.