Skip to main content

FluentCRM

#Feature Request

CNIL compliance: managing consent for email open and link tracking

Hello :)

The French Data Protection Authority (CNIL) recently published its final recommendation regarding tracking pixels and tracked links in emails. (As Italy by the way)

According to this recommendation, consent to receive marketing emails does not automatically constitute consent to the individual tracking of email opens and link clicks, particularly when this data is used for profiling, segmentation or marketing automations.

I currently use FluentCRM together with Fluent Forms, and I need to adapt my setup to comply with these requirements.

Could you please explain how this should be managed within FluentCRM?

More specifically:

  1. Can I store a contact’s consent to email tracking separately from their subscription status?
  2. Can FluentCRM dynamically disable both the open-tracking pixel and link tracking for contacts who have not consented, while still sending them the email normally?
  3. Can contacts withdraw only their consent to tracking without unsubscribing from the mailing list?
  4. Does FluentCRM keep sufficient proof of this consent and its withdrawal, including the date and source of the consent?
  5. How should automations based on email opens or link clicks behave for contacts who have not consented to tracking?
  6. Is there a recommended procedure for managing existing subscribers and collecting or recording their tracking preferences?

If these features are not currently available natively, could you please let me know whether there is a recommended workaround or whether support for consent-based tracking is planned?

Here is the CNIL recommendation for reference:
https://www.cnil.fr/fr/recommandation-pixel-suivi-courriels

Thank you for your help.

  • 9 comments

Karl Emil Nikka
  1. No. WPManageNinja recommends using FluentForms Pro for detailed subscription info (it’s necessary anyways since FluentCRM doesn’t offer double opt-in for unauthenticated, existing contacts).
  2. No, you need to create separate campaigns. You can use tags to select which contacts should be part of which campaigns.
  3. No.
  4. No.
  5. I haven’t looked into it.
  6. Not that I know of. The easiest way going forward is to just disable regular tracking and instead rely on anonymous tracking, introduced in FluentCRM 3.0.

WPManageNinja has confirmed that do not intend to fix the double opt-in compliance issue, but I haven’t asked about the other issues you bring up. They are worth submitting as feature requests. WPManangeNinja has addressed all compliance issues I’ve reported except for the mentioned double opt-in issue.  

David Churchill

Agree with Karl Emil Nikka, you would need to use a custom form for registration to collect consent, FluentForms Pro can do this and integrate with FluentCRM. Worth also checking how your email service works, if you use something like Brevo.com, they also add link tracking in emails unless you turn it off. toSend.com currently don't track clicks.

Claire Négrier

Thank guys ! I have FF Pro! So I'm gonna investigate on that - or if you have any lead to follow, I'm all ears! :D

Karl Emil Nikka

Claire Négrier If you receive an official answer through email or support ticket, please share it with us.

André Daus

Is that valid in France only, or is this EU stuff? Further, does this affect providers outside France but inside EU?

Claire Négrier

Hi André Daus - Right now it's for France - But EU has already prepared something similar...

Claire Négrier

Hi everyone! 😊

As promised, I contacted WPManageNinja Support directly, and they’ve already replied (even on a Sunday! 😅).

In the meantime, here's the workaround I've implemented to comply with the CNIL recommendations.

I've divided my subscribers into two separate lists:

  • Tracking consent: subscribers who have explicitly agreed to email open and click tracking.
  • NoTrack: subscribers who still want to receive my emails but haven't consented to tracking.

For each newsletter, I now create two campaigns with exactly the same content, targeting each list separately.

Important: The open and click tracking options are located in FluentCRM → Settings → Compliance Settings, and they apply globally, not per campaign.

For both open and click tracking, FluentCRM offers three options:

  • Track: regular tracking.
  • Anonymous: anonymous reporting, but individual identifiers are still used internally.
  • Untrack: tracking disabled.

So, before sending my NoTrack campaign, I manually select Untrack for both settings, send the campaign, wait until all emails have been sent, and then restore my usual tracking settings.

It's not ideal, especially with automations running in the background, but it's the most reliable built-in workaround for now.

The support team also confirmed that Anonymous Tracking is not equivalent to disabling tracking, which is particularly important regarding CNIL compliance.

Here's their full official response:

At the moment, FluentCRM’s supported controls for open tracking and click tracking are global. The filters fluentcrm_disable_email_open_tracking and fluent_crm/track_click do not receive the current contact, list, or custom field, so there isn’t a supported hook that enables tracking for some recipients and disables it for others within the same campaign.

Your current two-campaign approach is therefore the reliable built-in solution: one campaign for contacts who consented to tracking, and another with tracking disabled for the remaining contacts.

Regarding Anonymous Tracking, I would not describe it as completely untracked. FluentCRM uses per-email identifiers for the open pixel and tracked links so that activity can be associated with the relevant campaign email and contact. Anonymized IP data or anonymous/aggregated reporting is different from avoiding individual tracking from the moment the email is generated.

A single campaign with contact-level tracking preferences would require custom development and careful testing. The customization would need to prevent both the tracking pixel and link rewriting for non-consenting contacts, including campaign emails, automations, and footer links. 

Also, there is no confirmed public roadmap or release date for native contact-level tracking preferences.

Let us know if you have any further queries.

Thank you.
- - - - -

Thanks again to everyone who contributed to the discussion! 😊

David Churchill

Thanks Claire Négrier this is really useful.

Karl Emil Nikka

Claire Négrier Thanks! Shahjahan Jewel While I understand it’s hard to give a target release date, it would be great to know if a compliance update is in the works or if FluentCRM isn’t planned to support subscriber logs and/or contact-level tracking (like e.g., list-based double opt-in isn’t planned).