Edition

This is a permanent edition. It carries the briefing exactly as published on this date and does not change.

EDPB Publishes Draft Guidelines on Anonymisation for Public Consultation

Consultation closes October 30, 2026

On July 7, 2026, the European Data Protection Board (EDPB) adopted draft Guidelines 02/2026 on Anonymisation, updating its 2014 Opinion on Anonymization Techniques. These Guidelines offer a more structured framework for assessing whether information can be considered anonymous, emphasizing that anonymity can be a matter of perspective depending on the assessing entity. The draft Guidelines are open for public consultation until October 30, 2026.

Today's question

A data controller in France uses tracking pixels in marketing emails to measure campaign performance. Under the CNIL's Recommendation, what is the primary legal requirement for deploying these pixels?

  1. The controller must carry out a DPIA before the pixels go live
  2. The controller must obtain each recipient's prior consent to the pixels
  3. The controller must register the pixels with the CNIL before each campaign
  4. The controller must record a legitimate interests test for the pixels

Answer this question on the site

Worth knowing

  1. CNIL Issues FAQs on Tracking Pixels in Emails Requiring Prior Consent

    On July 22, 2026, the French Data Protection Authority (CNIL) published FAQs on its recommendation for tracking pixels in emails, clarifying that prior consent is generally required. The Recommendation, applicable since April 14, 2026, explains how Article 82 of the French Data Protection Act applies to these pixels. Exceptions include security measures linked to user authentication or certain deliverability purposes.

Compiled that morning from regulator, court and authority sources. Primary sources are linked on every story.