If your company sends out newsletters, this article is for you. It will take you four minutes. No legal jargon, no scaremongering.
What happened
On April 17, 2026, the Data Protection Authority published the Order No. 284, a technical document governing the use of “tracking pixels” in emails. Tracking pixels are tiny invisible images—literally one pixel in size—that email marketing platforms (Mailchimp, Brevo, HubSpot, FluentCRM, ActiveCampaign, and all the others) automatically insert into newsletters to detect when the recipient opens the message.
Following two inspections conducted between October 2025 and February 2026, the Data Protection Authority determined that the use of these pixels requires the explicit consent of the recipient. A generic newsletter subscription is no longer enough. The window of opportunity to comply is six months from the date of publication of the regulation in the Official Gazette. Failure to comply may result in penalties of up to 41% of annual revenue.
Who is involved
Anyone who sends emails to European recipients, regardless of where their company is based. Specifically: e-commerce businesses, employment agencies, professional firms, training schools, LMS platforms, associations, B2B companies with commercial newsletters, and B2C companies with periodic promotions. In WebWakeUp’s client portfolio, that’s practically everyone.
The three things you'll need in six months
Leaving aside the technical details, the measure requires three specific adjustments.
1. An updated privacy policy
The website’s Privacy Policy must explicitly mention tracking pixels, explain what data they collect, and for what purposes. If your current policy refers generically to “analytics tools,” that is no longer sufficient.
2. Clear consent to enrollment
Users must be informed, before subscribing, that the newsletter contains tracking pixels. Contrary to what some agencies are suggesting, a separate dual consent checkbox is not required: the Data Protection Authority has explicitly stated that a single request is sufficient, provided that the opt-out (see below) is granular.
3. A settings panel in the footer of every email
This is the most technically challenging part. In addition to the standard “unsubscribe” link, every email must include a link to a page where the user can choose to either unsubscribe completely or continue receiving the newsletter without being tracked. Those who choose “no tracking” must continue to receive exactly the same content as everyone else—you cannot penalize those who refuse tracking.
Most email marketing platforms today don’t offer this feature out of the box. Building it properly is a project, not just a plugin to install.
When consent is not required: the three exceptions
Before you start thinking that every email now requires the recipient’s consent, here’s some good news: the Data Protection Authority has identified three situations in which tracking remains lawful even without explicit consent.
1. Anonymous and aggregated statistics
You can still see how many people in total opened a campaign—for example, “341% of recipients”—without knowing who specifically. The condition is technical: the platform must use an identical pixel for all recipients (not a different one for each) and must not collect data that allows individual users to be identified.
2. Security and Authentication Email
Registration confirmations, password resets, access codes, and responses to GDPR requests. Tracking is permitted in these cases because it helps verify that the message actually reached the intended recipient.
3. Mandatory service announcements
Contract amendments, important notices, data breach notifications, and deadline reminders. Consent is not required in these cases either.
Everything else—and this is the point—requires consent. Everything a corporate newsletter normally does: determining whether the subject line works, adjusting the frequency of emails based on reader behavior, distinguishing active readers from inactive ones, and personalizing the next message. This is exactly how email marketing platforms work by default, without needing to be configured. And this is exactly what needs to be rethought now.
What we're doing for our customers
As soon as the regulation was published, we read it in its entirety (all forty-eight pages) and drew up a compliance plan. WebWakeUp clients are already taking action on three fronts:
- CRM and email platforms. We have established direct communication with the developers of the tools we use to implement native granular opt-out features. At the same time, we are developing custom integrations that allow us to manage tracking consent independently of newsletter subscriptions.
- WordPress sites. We are updating our privacy policies to explicitly mention tracking pixels and are developing preference management pages, which can be accessed via a link in the footer of every email.
- Databases and active campaigns. Individual audits for each client, with a customized compliance plan—including timelines, priorities, and any targeted re-consent campaigns.
The difference between tackling this adjustment now and doing it in five months is the same as the difference between a move planned two months in advance and one pulled off in three days. The end result is different. So are the costs.
If you're not a customer of ours: three things to check this week
- In your current Privacy Policy, the word “email pixel” Does it appear? (If not, the disclosure is inadequate.)
- Your email marketing platform allows you to send the same campaign to both those who have agreed to tracking and those who haven't, without having to do the work manually? (If you don't know, it's almost certainly not.)
- In the footer of your emails, there is a link to a page where the user can handle separately Subscription and tracking? (If there’s only “unsubscribe,” the answer is no.)
Three “no” votes out of three mean that the compliance effort must be planned now, not in August. In our experience, a job done right requires six to twelve weeks of coordinated work—notification, stack, preferences panel, architecture, re-consent campaign, testing. The Data Protection Authority’s six-month timeline isn’t very long.
Let's talk about it
We offer a Free call to assess your situation. No obligation, and we won’t send you a quote by email the next day without discussing it first. We’ll give you an honest assessment of whether you’re already set, if a targeted fix is all you need, or if a more comprehensive solution is required.
This is the kind of assessment you should make now, while you still have options. By October, time will be running out and your options will be limited.
👉 Schedule a free call — We’ll get back to you within 24 business hours.
