Newsletter Tracking—What’s Allowed?
Management Summary
What happens during newsletter tracking?
The most common tracking methods in email marketing are:
-
01
Pixel counter
A 1×1-pixel image in the newsletter. When the email is opened, the image loads from the server, and the sender knows when the email was opened—often including the IP address and device information.
-
02
Tracking Links
Custom links that contain UTM parameters, which can include various types of information.
-
03
Profile Creation
Combining this data to create recipient profiles, for example, to identify interests and personalize future newsletters.
All of this involves two aspects: access to the recipients’ devices and the processing of personal data. That is precisely why several laws intersect here.
Data Protection in Email Marketing: The Three Relevant Sets of Regulations
Anyone who sends and tracks newsletters operates within the interplay of three laws.
- GDPR
- UWG (Section 7)
- TDDDG (Section 25)
The key point: Tracking requires its own consent
This is where things get tricky for many senders. It’s not enough to obtain consent “for the newsletter” and then quietly let tracking run in the background. Legally speaking, tracking is a separate measure:
- At the terminal device level (Section 25 of the TDDDG)
- In terms of data protection (GDPR)
Why “Legitimate Interest” Usually Fails When It Comes to Tracking
Many senders would like to rely on legitimate interests (Art. 6(1)(f) GDPR), reasoning, “We need to know whether our newsletter is reaching its recipients.” In practice, this approach hardly works when it comes to tracking. Most recipients are completely unaware that they are being tracked. Furthermore, the Swiss Unfair Competition Act (UWG) requires consent for email advertising anyway, which has implications for the data protection assessment. Even pseudonymizing the tracking data does not alter the requirement for consent.
The existing customer exception does not cover tracking
A common misunderstanding concerns the exception for existing customers under Section 7(3) of the German Unfair Competition Act (UWG), which, under strict conditions, permits the sending of promotional emails to existing customers without separate consent. However, this exception applies only to the sending of the emails themselves, not to tracking. For measuring open rates and click-through rates, consent remains mandatory, even for existing customers.
Consent Management: How to Obtain Consent the Right Way
Effective consent management means obtaining consent in a way that is legally valid and verifiable at any time. For consent to be valid, the following four criteria must be met:
-
01
Voluntary
It must not be linked to any other service that has nothing to do with the newsletter.
-
02
Informed
Recipients must understand what they are consenting to (including tracking of the newsletter).
-
03
Specific
Vague statements such as “I would like to receive information” are not sufficient. It is helpful to provide details regarding the content, frequency, and purpose.
-
04
Clearly through active action
A checkmark or button click made intentionally. Pre-selected checkboxes or consent via the Terms and Conditions are invalid.
Image: Example of a website form with a consent checkbox that clearly indicates the purpose for which consent is being obtained. Source: e-dialog
Legally Compliant Measurement: Double Opt-In as the Standard
Although the double opt-in process is not explicitly required, it is considered best practice and the most secure method for verifying consent. The following procedure is recommended:
- The user enters their email address in the registration form.
- The user receives a confirmation email.
- The user clicks on the confirmation link.
- Only then is the registration valid and documented.
As a general rule, the only required field on the registration form should be the email address. All other fields should be optional.
Properly Implement Tracking Consent
Consent to tracking can be combined with consent to receive the newsletter, but it must be clearly identified and transparently explained.
If you want to make the process granular and particularly privacy-friendly, separate consent for delivery and tracking using distinct checkboxes. This allows users to opt in to the newsletter while opting out of tracking.
Information and Easy Cancellation
Transparent communication includes a privacy policy that discloses what data is collected, for what purpose, and through what means. It is also important to note that unsubscribing must be just as easy as subscribing to the newsletter. Therefore, every newsletter should include a clearly visible and straightforward unsubscribe link.
What Are the Consequences of Violations?
Even though the authorities have rarely taken active measures to prosecute such violations in the past, the legal and financial risks must be taken seriously today.
- Fines Imposed by Data Protection Authorities
- Warning Letters and Injunctions
- Claims for damages by the affected parties
- Government Orders (Suspension of Tracking and Deletion of Data)
Conclusion
Newsletter tracking is allowed, but there are rules to follow. You shouldn’t lump newsletter distribution and tracking together. You always need the recipients’ consent for tracking. This consent must be entirely voluntary, and the user must be fully informed. If this is handled honestly and transparently from the start, you’re on the safe side legally. At the same time, you build trust with your users. And trust is a key factor in marketing.
