EDPB Launches GDPR Crackdown on Email Tracking Disclosures

Every marketing email your organization sends contains invisible tracking code. A tiny pixel — often just one pixel by one pixel — records when recipients open it, logging their IP address, device type, operating system, and approximate location, then transmits that data back to your analytics platform. Most organizations buried this in vague privacy policy language or omitted it entirely. That era is ending. In June 2026, the European Data Protection Board (EDPB) launched its fifth Coordinated Enforcement Framework action — CEF 2026 — directing 25 national data protection authorities across Europe to simultaneously investigate GDPR email marketing compliance, with transparency and information obligations squarely in the crosshairs.

What Is the EDPB's CEF 2026 Action?

The EDPB's Coordinated Enforcement Framework is a mechanism that lets all EU data protection authorities investigate the same topic simultaneously rather than in isolation. The 2026 edition targets GDPR transparency and information obligations — Articles 12, 13, and 14 — which govern what organizations must tell individuals about how their personal data is collected, used, stored, and shared.

Twenty-five DPAs are participating. Rather than waiting for individual complaints, regulators will proactively contact organizations, conduct standardized fact finding surveys, and where appropriate open formal enforcement proceedings. For any company sending marketing emails to EU residents, this fundamentally changes the enforcement calculus. Past CEF actions — covering the right to erasure, AI in HR, and cloud contracts — produced formal investigations in dozens of member states and significant fines. CEF 2026 is the same mechanism applied to transparency, and email marketing is a natural target.

What Does GDPR Transparency Actually Require?

Article 12 mandates that information must be provided in "a concise, transparent, intelligible and easily accessible form, using clear and plain language." Articles 13 and 14 specify exactly what must be disclosed: the identity and contact details of the data controller, the purposes and legal basis for each processing activity, the categories of data collected, how long data is retained, who receives it (by name, not "partners"), and what rights recipients hold.

The key failure regulators cite most often: generic language. A privacy policy that says "we work with trusted third party analytics partners" tells recipients nothing. A compliant disclosure names the vendor — Mailchimp, Klaviyo, HubSpot, Brevo, Constant Contact — and explains precisely what data flows to that vendor and why.

Why Is Email Tracking Under Direct Scrutiny?

Email tracking pixels are unambiguously personal data processing under GDPR. When a marketing email loads a tracking image, it transmits the recipient's IP address (revealing approximate location), device type, operating system, email client, and exact timestamp of opening — all sent back to the sender's analytics platform. That data is personal data. Processing it requires a lawful basis. And informing the recipient about it requires full transparency under Articles 12 to 14.

Consent requirements are doubled: the ePrivacy Directive covers the act of accessing the device to fire the pixel; GDPR separately covers the subsequent processing of that personal data. You cannot satisfy one and ignore the other. France's CNIL already set a July 14 deadline for email tracking consent. Italy's Garante published formal guidelines in April 2026 giving organizations until October 28 to comply. CEF 2026 now places every other EU member state's DPA in coordinated motion around the same underlying obligation.

What Are the Five Most Common Violations?

Regulators consistently find these patterns:

1. Vague third party language — "trusted partners" or "service providers" instead of naming Mailchimp, HubSpot, or Klaviyo specifically
2. Missing legal basis — claiming legitimate interest for individual open tracking, which most DPA guidance now rejects as insufficient
3. Outdated privacy policies — the policy mentions Google Analytics but the actual stack includes Klaviyo, Iterable, and a sales intelligence tool not disclosed anywhere
4. Buried disclosures — relevant information sits in PDFs linked from footers, requiring three clicks to reach
5. Vague retention periods — "we keep data as long as necessary" instead of specifying a concrete timeframe such as 24 or 36 months

Each pattern is a standalone GDPR violation. CEF 2026 means 25 authorities will be looking for exactly these patterns simultaneously, across sectors, throughout 2026.

What Must Email Senders Disclose Now?

Organizations sending marketing emails to EU residents must, at minimum, disclose in plain language:

• The name of every email marketing platform they use — Mailchimp, Klaviyo, Brevo, Constant Contact, HubSpot, Outreach, and others
• Whether individual open tracking is active, and if so, the legal basis for it (consent, not legitimate interest)
• The specific data points collected per open event: IP address, timestamp, device type, operating system, approximate geolocation
• The retention period for tracking data, stated as a specific timeframe
• How recipients can opt out of tracking specifically — separate from unsubscribing from the email list

Bundling tracking consent with subscription consent is explicitly invalid under current guidance. Regulators have documented this violation repeatedly. The CEF 2026 action makes it probable that organizations still doing this will hear from a DPA before year end.

How Can Email Recipients Protect Themselves?

GDPR enforcement helps, but it does not stop tracking before it happens. Even when senders disclose their tracking honestly — and many still won't — the pixel still fires when you open the email, and the data still reaches the sender's analytics platform. Disclosure rules tell you it's happening; they don't prevent it.

The only reliable protection is blocking email tracking pixels before they load. Blocking tools intercept tracking requests at the Gmail level, preventing the pixel from firing regardless of whether the sender is compliant or not. That matters especially as regulators tighten disclosure rules: senders who can't track opens may shift to link tracking — URLs that redirect through analytics servers before reaching the destination. Blocking those redirects requires a different technical approach than image blocking alone.

Whether 25 EU regulators succeed in forcing disclosure, recipients who care about privacy should not have to rely on senders' compliance. Block the pixels now, regardless of what the law eventually requires senders to say.