> This page is part of the [Customer.io documentation](https://docs-customerio.netlify.app). For the complete index, see [llms.txt](https://docs-customerio.netlify.app/llms.txt).
> Last updated: July 12, 2026

# Consent for open-tracking

Email open tracking lets you see when someone opens an email. This is useful for understanding how your emails are performing and for targeting your emails to the right people.

Some regions now require recipient consent before you can track open activity on emails. France’s data privacy authority, the Commission Nationale de l’Informatique et des Libertés (CNIL), instituted a [rule](https://www.cnil.fr/fr/recommandation-pixel-suivi-courriels) that takes effect **July 14, 2026**; Italy’s follows later in 2026, and more of the EU may follow over time.

This guide covers the Customer.io tools to help you honor tracking consent. **It is not legal advice.** You’re responsible for determining which laws apply to your audience and what consent you need. Customer.io provides the mechanisms, but it’s your responsibility to implement them faithfully.

## How it works

Email open tracking works by adding an invisible pixel to your emails. When someone opens the email, the pixel loads, effectively telling us that someone opened the email. However, some regions require recipient consent before you can track open activity on emails.

You control open tracking consent with a setting and an [attributeA key-value pair that you associate with a person or an object—like a person’s name, the date they were created in your workspace, or a company’s billing date etc. Use attributes to target people and personalize messages.](/journeys/people/manage/attributes/):

*   **The setting**: A workspace enforcement mode that determines the default consent behavior (off, opted in, or opted out).
*   **The attribute**: A per-contact `cio_email_tracking_consent` attribute that records whether an individual has consented as a boolean value (where `true` means consented, `false` means objected).

When Customer.io withholds tracking for a send, the recipient still receives your email. You just won’t be able to determine whether they opened or clicked a link in your message, protecting your audience’s right to privacy.

### Consent-based tracking keeps metrics accurate

When Customer.io withholds open tracking for a send, we consider the email **untracked** and exclude it from your open- and click-rate calculations. This keeps withheld sends from skewing your engagement rates, so you can continue to measure engagement for the people you’re allowed to measure.

*   Open rate = opened / (delivered − untracked)
*   Click rate = clicked / (delivered − untracked)

How many sends count as untracked depends on your mode. In **Opt-out**, only the contacts you’ve explicitly marked `false` are untracked—usually a small group. In **Opt-in**, everyone whose consent is unset or `false` is untracked.

### You can disable open tracking for everyone

If you’re worried about accidentally sending emails to users in regions that require open-tracking consent, you can [disable open tracking for emails all together](/accounts/workspaces/overview/#disable-open-tracking).

However, this means you won’t be able to track email engagement, which can make it difficult to measure the effectiveness of your emails.

## Set the open-tracking consent “enforcement mode”

Go to **[Settings > Workspace Settings > General Workspace Settings](https://fly.customer.io/workspaces/last/settings/edit)**. Under **Do you need consent to track email opens?**, choose a mode:

[![email-tracking-consent-mode.png](https://docs.customer.io/images/email-tracking-consent-mode.png)](#201e0b64e3d7bdf96853741beb166d90-lightbox)

*   **Off** enables open tracking for everyone. This setting is useful if you don’t send messages to users in regions that require open-tracking consent. (e.g. you’re a US-based company and your users are all in the US.)
*   **Opt-in** limits open-tracking to people who have explicitly consented—their `cio_email_tracking_consent` attribute is `true`. Anyone whose consent attribute is unset or `false` is not tracked. Use this mode when you must have affirmative consent before tracking anyone.
*   **Opt-out** tracks everyone *except* people who have explicitly objected (`false`). Contacts who are unset or `true` are tracked. Use this when you only need to honor the specific people who withdraw consent.

 Backfill consent before turning on *Opt-in*

If you haven’t recorded your audience’s `cio_email_tracking_consent` attributes, switching to opt-in tracking can sharply drop your open and click metrics because anybody without a consent attribute is excluded from tracking. If you need affirmative consent for open-tracking, you should attempt to backfill your audience’s consent status *before* you enable opt-in tracking.

## Set a profile’s consent attribute

Customer.io records tracking consent in a reserved attribute called `cio_email_tracking_consent`. The attribute takes a boolean value:

*   `true` means the person has consented to open tracking, and
*   `false` means they’ve objected.
*   A contact with no value reverts to the [enforcement mode’s default behavior](#set-the-open-tracking-consent-enforcement-mode).

You can set this attribute anywhere you set profile [attributesA key-value pair that you associate with a person or an object—like a person’s name, the date they were created in your workspace, or a company’s billing date etc. Use attributes to target people and personalize messages.](/journeys/people/manage/attributes/)—on the People page (individually or in bulk), through our API, integrations like our JavaScript client, CSV uploads, and so on. You can also let [recipients set it themselves](#let-recipients-manage-their-own-consent).

We recommend that you capture consent when you identify someone—like when they sign up for your email list—and backfill your existing audience so you’re ready before you change modes. Here are some examples of identify calls that set the `cio_email_tracking_consent` attribute:

#### JavaScript client (signup / custom subscription management)

```javascript
_cio.identify({
  userId: '019mr8mf4r',
  email: 'customer@example.com',
  cio_email_tracking_consent: true
});
```

#### Pipelines API (Node.js backfill / signup)

```javascript
const axios = require('axios');
let data = JSON.stringify({
  "userId": "customer@example.com",
  "traits": {
    "email": "customer@example.com",
    "cio_email_tracking_consent": true
  }
});

let config = {
  method: 'post',
  maxBodyLength: Infinity,
  url: 'https://cdp.customer.io/v1/identify',
  headers: {
    'Content-Type': 'application/json',
    'Authorization': 'Basic <yourApiKey>:'
  },
  data : data
};

axios.request(config)
.then((response) => {
  console.log(JSON.stringify(response.data));
})
.catch((error) => {
  console.log(error);
});
```

#### Pipelines API (Python backfill / signup)

```python
import requests
import json

url = "https://cdp.customer.io/v1/identify"
headers = {
  'Content-Type': 'application/json',
  'Authorization': 'Basic <yourApiKey>:'
}

data = {
  "userId": "customer@example.com",
  "traits": {
    "email": "customer@example.com",
    "cio_email_tracking_consent": True
  }
}

response = requests.request("POST", url, headers=headers, data=json.dumps(data))

print(response.text)
```

## Let recipients manage their own consent

Add the `{% tracking_consent_url %}` Liquid tag to an email to give recipients a hosted, no-login page where they can grant or withdraw tracking consent—similar to an unsubscribe link. When a recipient updates their choice on that page, Customer.io sets their `cio_email_tracking_consent` attribute automatically (`true` when they grant consent, `false` when they withdraw it).

```fallback
<a href="{% tracking_consent_url %}">Manage your tracking preferences</a>
```

## Bring your audience into compliance

An email address doesn’t tell you where a recipient lives, so applying consent rules only to the people you *think* are in a particular region is unreliable and hard to maintain. We recommend picking one approach and applying it to your whole audience. Your setup stays simple, and you avoid gaps when someone’s location isn’t what you assumed.

While we’ve offered some approaches below, **it’s up to you to determine what you need to do to comply with regional regulations.**

 Require consent from everyone (Opt-in)

#### Require consent from everyone (Opt-in)

This is the strictest approach, and the one that satisfies regulations that require consent *before* tracking, such as France’s CNIL rule. Customer.io only engages open/click tracking for a person after they’ve affirmatively consented (their `cio_email_tracking_consent` is `true`).

1.  Set up a flow to capture consent when you collect an email address—at signup, in a preference center, or through the [hosted consent page](#let-recipients-manage-their-own-consent).
2.  Backfill consent for the contacts you already have, so you don’t lose tracking for your existing audience. You can do this by notifying recipients and giving them a clear way to opt in or out.
3.  After enough time has passed that you’re confident you’ve backfilled consent for your existing audience, set the workspace mode to **Opt-in**.

Contacts you haven’t recorded consent for aren’t tracked, so backfill *before* you switch modes to avoid a sudden drop in your open and click metrics.

 Track until someone objects (Opt-out)

#### Track until someone objects (Opt-out)

This is a lighter-touch approach that keeps tracking everyone while honoring the people who explicitly withdraw consent. It suits regulations that let you track until a recipient objects, but it does *not* satisfy rules that require consent up front.

1.  Set the workspace mode to **Opt-out**.
2.  Give recipients a way to withdraw consent—typically the [hosted consent page](#let-recipients-manage-their-own-consent).
3.  Customer.io keeps tracking everyone whose consent is unset or `true`, and withholds tracking only for the people marked `false`.

### Complying with France’s CNIL rule

France’s CNIL rule is the first major regulation of its kind, and it includes a transitional window that changes how you handle *existing* contacts versus new ones. Other regions may adopt similar patterns as their own rules take effect.

*   **Profiles identified before April 14, 2026**: You may treat these users as opted-in by default, but you must inform them and give them a clear way to opt out **before July 14, 2026**. For example, you may want to send them an email explaining the change and provide a prominent link to the [hosted consent page](#let-recipients-manage-their-own-consent).
*   **Profiles identified on or after April 14, 2026**: You should capture consent for open tracking wherever you capture your audience’s email addresses—e.g. at signup, in a preference center, or through the [hosted consent page](#let-recipients-manage-their-own-consent) rather than assuming consent and offering opt-out preferences in a later welcome email.
*   **On July 14, 2026**: Set your workspace mode to **Opt-in** so Customer.io tracks only the contacts who have consented.

*   *   [How it works](#how-it-works)
        *   [Consent-based tracking keeps metrics accurate](#consent-based-tracking-keeps-metrics-accurate)
        *   [You can disable open tracking for everyone](#you-can-disable-open-tracking-for-everyone)
    *   [Set the open-tracking consent “enforcement mode”](#set-the-open-tracking-consent-enforcement-mode)
    *   [Set a profile’s consent attribute](#set-a-profiles-consent-attribute)
    *   [Let recipients manage their own consent](#let-recipients-manage-their-own-consent)
    *   [Bring your audience into compliance](#bring-your-audience-into-compliance)
        *   [Complying with France’s CNIL rule](#complying-with-frances-cnil-rule)

Copy page

Copy page [Download .md](/messaging/channels/email/open-tracking-consent.md)

Is this page helpful?

![](https://docs.customer.io/images/export-success.png) ![](https://docs.customer.io/images/export-failure.png)

# How can we make it better?

Close

Do you need help from Customer.io support?  No  
 Yes

What part of Customer.io do you need help with? 

How can we improve this page?

Email (optional):  Please provide a valid email address

 I am not a bot

 

We appreciate your feedback!

Our support team will contact you as soon as possible