Edition

This is a permanent edition. It carries the briefing exactly as published on this date and does not change.

EDPB Publishes Draft Guidelines on Anonymisation for Public Consultation

Consultation closes October 30, 2026

On July 7, 2026, the European Data Protection Board (EDPB) adopted draft Guidelines 02/2026 on Anonymisation, updating its 2014 Opinion on Anonymization Techniques. These Guidelines offer a more structured framework for assessing whether information can be considered anonymous, emphasizing that anonymity can be a matter of perspective depending on the assessing entity. The draft Guidelines are open for public consultation until October 30, 2026.

Today's question

A data controller in France uses tracking pixels in marketing emails to measure campaign performance. Under the CNIL's Recommendation, what is the primary legal requirement for deploying these pixels?

  1. The controller must conduct a Data Protection Impact Assessment (DPIA) before deployment.
  2. The recipient's prior consent is generally required, unless an exemption applies.
  3. The controller must provide a clear opt-out mechanism in each email.
  4. The use of pixels is permissible if the processing is based on legitimate interests.

Answer this question on the site

Worth knowing

  1. CNIL Issues FAQs on Tracking Pixels in Emails Requiring Prior Consent

    On July 22, 2026, the French Data Protection Authority (CNIL) published FAQs on its recommendation for tracking pixels in emails, clarifying that prior consent is generally required. The Recommendation, applicable since April 14, 2026, explains how Article 82 of the French Data Protection Act applies to these pixels. Exceptions include security measures linked to user authentication or certain deliverability purposes.

Compiled that morning from regulator, court and authority sources. Primary sources are linked on every story.