The CNIL Open-Tracking Deadline Passed on 14 July. Your Customer.io Workspace Is Probably Still on "Off"

On 11 November 1999, the privacy researcher Richard M. Smith published The Web Bug FAQ. A web bug, he explained, is a graphic on a web page or in an email built to monitor who reads it. It's usually invisible, because it's usually one pixel by one pixel, dropped into the HTML as an ordinary image tag. In email the trick was neat: the sender already knows your address, so they bake it into the image's URL and learn the moment you open the message.

Twenty-seven years later, that pixel is still in almost every marketing email you receive, and it's still how your "open rate" gets counted. What's changed is that a regulator has decided the reader should get a say. France's data-protection authority, the CNIL, calls it a pixel espion—a spy pixel. As of 14 July 2026, it expects senders to have told their existing French contacts the pixel is there and given them a clear way to refuse it.

If you send with Customer.io, the tool to handle this is already in your workspace. Most people have never opened the setting.

This post covers what that setting does, the one per-person attribute that overrides it, and the part nobody checks before they panic: what actually happens to your open rate when you switch to consent-based tracking. Short version—it doesn't collapse, because Customer.io leaves untracked sends out of the maths. One caveat before we start. This is operations advice, not legal advice, and Customer.io says the same about its own tools: they're the mechanism, not a compliance guarantee. Whether these rules apply to you, and what consent you need, is a call for you and your legal team.

The setting most senders never opened

Customer.io's open-tracking consent lives in one workspace setting, and its default mode is "Off". Read plainly, "Off" tracks everyone: the consent documentation says it "enables open tracking for everyone." That was the right default for years, and it still is if your whole audience sits in the United States or you have no consent obligation.

The reason to revisit it is regulatory. France's CNIL rule, with Italy close behind, moves open tracking into consent territory for anyone messaging contacts in those countries. The setting is how Customer.io lets you respond.

If you'd rather not deal with consent at all, there's a blunter switch nearby. You can disable open tracking for the whole workspace, pixel and all, which the docs describe as a separate option from the three modes below. You give up open and click measurement, but you also give up the consent question. Whether that's a real loss depends on how much your opens were ever telling you, which we'll get to.

The three modes, in one table

Customer.io gives you three enforcement modes, and they differ only in who gets tracked by default.

Mode	Who gets tracked	Who it's for
Off	Everyone.	US-only audiences, or anyone with no open-tracking consent obligation.
Opt-in	Only people whose consent attribute is true. Anyone unset or false is not tracked.	Teams who need affirmative consent before tracking, the mode that fits France's rule.
Opt-out	Everyone except people explicitly marked false. Unset or true is still tracked.	Teams who only need to honour the people who actively object.

All three read from the same source of truth for the exceptions: a per-person attribute. That's the piece that does the real work, so it's worth understanding on its own.

The attribute that overrides the default: cio_email_tracking_consent

The mode sets the default; the cio_email_tracking_consent attribute sets the exception, one person at a time. It's a reserved boolean with three states, documented as:

• true: the person has consented, so track them.
• false: the person has objected, so don't.
• unset: fall back to whatever the mode's default is.

Under Opt-in, only a true gets tracked. Under Opt-out, only a false is excluded. Unset is where the two modes diverge, which is exactly why an unrecorded audience behaves so differently depending on the mode you pick. You set the attribute like any other: on the People page individually or in bulk, through the API, the JavaScript client, or a CSV import. You can also let people set it themselves, which is the simplest option and has its own section below.

Why opt-in doesn't wreck your open rate

Switching to opt-in shrinks how many opens you can measure. It doesn't drag down your open rate, because Customer.io drops untracked sends from the denominator. The formula the docs give is:

Open rate = opened / (delivered − untracked)

Click rate works the same way: clicked / (delivered − untracked). So when you withhold tracking from someone, they don't sit in the denominator as a permanent non-opener dragging your percentage down. The rate reflects only the people you're allowed to measure. What shrinks is the volume of measurable opens and the reach of any segment built on open behaviour, not the headline percentage.

Here's the part worth sitting with: that percentage was already shaky. Apple's Mail Privacy Protection pre-loads the tracking pixel on Apple Mail, so the open fires whether or not a human ever looked. That's exactly why behaviour triggers built on email_opened quietly broke for most senders. And Apple Mail is no rounding error. Litmus put Apple at 64.66% of tracked opens in May 2026, drawn from over a billion opens, and estimates Mail Privacy Protection now touches roughly 55 to 60% of all opens. A majority of your "opens", in other words, are machines.

Opt-in doesn't blind you to a good metric. It trims a noisy one, the same way a Customer.io in-app "open" only ever meant the message displayed, not that anyone engaged.

The back-fill trap

Flip to opt-in before you've recorded anyone's consent and your measurable audience collapses overnight. Everyone whose attribute is unset counts as "not tracked" under opt-in, so if you haven't captured consent yet, that's most of your list. The docs are blunt about it: back-fill consent before you turn the mode on.

The order that avoids the cliff:

1. Capture consent going forward, at signup, in a preference centre, or through the hosted page below.
2. Back-fill your existing contacts. Notify them, and give them a clear way to opt in or out.
3. Once you're confident the back-fill has run its course, switch the mode to Opt-in.

That sequence mirrors the CNIL's own transitional shape, which the documentation lays out as three dates. Contacts you identified before 14 April 2026 may be treated as opted-in, provided you inform them and offer a way out before 14 July. Contacts from 14 April onward should have consent captured at collection. And on 14 July, you set the workspace to Opt-in so tracking runs only for people who have consented.

Let people choose for themselves

The tidiest way to collect consent is to not collect it yourself. Customer.io gives you a hosted page, no login required, where recipients grant or withdraw tracking consent. You add it to an email with a single Liquid tag, {% tracking_consent_url %}, and when someone updates their choice there, Customer.io sets their cio_email_tracking_consent attribute automatically: true for grant, false for withdraw.

Treat it exactly like an unsubscribe link. Put it in your footer, or drop it into your subscription centre alongside everything else people can control. It runs on the same instinct as per-channel subscription preferences. The more control you give people over what you collect and send, the less often they reach for the blunt instrument of unsubscribing altogether.

What to actually do this week

Pick one mode for your whole list. Don't try to apply consent only to the contacts you think are in the EU. An email address doesn't tell you where someone lives, and the docs warn that applying consent only to the people you think are in a region is unreliable and hard to maintain. One approach, applied to everyone, keeps your setup simple and closes the gaps.

Then, in order:

1. Choose the mode. If you need affirmative consent before tracking, which covers anyone with a French or EU audience, that's Opt-in. Customer.io's own CNIL guidance says to set the workspace to Opt-in on 14 July.
2. Back-fill consent before you flip the switch, so your measurable audience doesn't fall off a cliff.
3. Add the {% tracking_consent_url %} link to your templates.
4. Downgrade the open rate on your dashboard. Lead with the numbers that survive both consent and machine opens: clicks, replies, conversions. Build a scorecard around them.

None of this is a loss if you're honest about what the pixel was measuring. It reported opens whether or not anyone read the message long before the CNIL touched it. Consent just makes you formalise what deliverability people have said for years: the open was never the number to build on.

Frequently asked questions

Does turning on opt-in tracking break my open rate?

No. Customer.io excludes untracked sends from the calculation, so your open rate is opened divided by delivered-minus-untracked, not opened divided by everyone. Withheld sends don't sit in the denominator dragging the percentage down. What shrinks is the number of opens you can measure and the reach of open-based segments, not the rate itself.

What is cio_email_tracking_consent and what values does it accept?

It's the reserved Customer.io attribute that records a person's open-tracking consent, and it takes a boolean. true means they've consented, false means they've objected, and no value at all falls back to your workspace mode's default. You set it like any attribute, through the People page, the API, the JavaScript client, or a CSV import, or you let recipients set it themselves through the hosted consent page.

Do I only need this for my French or EU contacts?

In practice, no. An email address doesn't reveal where someone lives, so filtering consent by the contacts you assume are in the EU is unreliable. Customer.io's docs recommend picking one approach for your whole audience instead. Applying one mode to everyone also spares you a segmentation scheme that breaks the moment someone's location isn't what you guessed.

What happens to a contact who has no consent value set?

They fall back to the workspace mode's default. Under Off, an unset contact is tracked. Under Opt-in, an unset contact is not tracked. Under Opt-out, an unset contact is tracked until they object. This gap is why back-filling matters before you move to opt-in, where unset means untracked.

Does the recipient still receive the email if tracking is withheld?

Yes. Withholding tracking only affects whether Customer.io can tell that the person opened or clicked. The email still sends and still arrives, and the recipient sees no difference. You simply lose the open and click signal for that send.

What should I set the mode to on 14 July?

Customer.io's CNIL guidance says to set the workspace to Opt-in on 14 July 2026, so tracking runs only for contacts who have consented. That assumes you need affirmative consent and have back-filled first. Whether the rule applies to you is a question for your legal team, because the setting is the mechanism, not the compliance decision.

How do recipients manage their own tracking consent?

Add the {% tracking_consent_url %} Liquid tag to an email and it renders a hosted, no-login page where the recipient grants or withdraws consent. When they choose, Customer.io updates their cio_email_tracking_consent attribute automatically. It behaves like an unsubscribe link, which makes your email footer or subscription centre the natural home for it.

What's the difference between Opt-out and leaving it on Off?

Both track the bulk of your list, but Opt-out honours the people who explicitly object. Off "enables open tracking for everyone", while Opt-out tracks everyone except contacts marked false. If you want to keep tracking by default but respect the people who withdraw, Opt-out is the mode. Off is for when you have no obligation to honour objections at all.

Does this affect click tracking too, or just opens?

Both. The setting governs open tracking, and Customer.io applies the same untracked exclusion to your click rate, which the docs give as clicked divided by delivered-minus-untracked. So a withheld send drops out of both your open-rate and click-rate denominators, keeping both metrics honest for the audience you can measure.

Can I just turn off open tracking completely instead?

Yes. Separately from the three consent modes, Customer.io lets you disable open tracking for the entire workspace, so no pixel goes out and there's no consent question to answer. You lose the ability to measure open and click engagement, which is the trade-off. For teams whose opens were mostly machine noise anyway, that's a defensible default rather than a drastic one.

When does Italy's rule take effect?

Italy follows France later in 2026. Customer.io's docs note Italy's rule arrives after France's, and independent analysis pins the practical deadline to 28 October 2026, the end of a six-month window after Italy's Garante published its provision. If you message contacts in Italy as well as France, the same opt-in setup covers both.

Is turning this setting on enough to make me compliant?

No, and Customer.io is explicit that its tools aren't legal advice. The setting gives you the mechanism: the consent modes, the per-person attribute, and the hosted consent page. Determining which laws apply and what consent you need is your responsibility, ideally with your DPO or legal counsel. Treat the feature as the how, not the whether.

Sources

• Consent for open-tracking. Customer.io Docs, 12 July 2026.
• Recommandation « pixel de suivi » dans les courriels. CNIL, 14 April 2026.
• Email Client Market Share. Litmus, May 2026 data.
• Email open tracking now needs consent in France and Italy. Value Gravity, 11 July 2026.
• The Web Bug FAQ. Richard M. Smith, hosted by EFF, 11 November 1999.