Your rights: consent and withdrawal

If a brand wants to track whether you open its emails, in most cases it needs your consent first. This page explains what that consent must look like to be valid, and what should happen when you take it back.

What makes consent valid

Under the GDPR’s definition, which the ePrivacy rules borrow, consent must be:

• Freely given — not a condition of receiving a service you’re entitled to, and not bundled so you can’t refuse tracking separately.
• Specific — tied to a defined purpose. “We may process your data” is not specific; “we measure whether you open our newsletter to build engagement profiles” is.
• Informed — you must know who is tracking, for what, and how to withdraw.
• Unambiguous — given by a clear affirmative action. Pre-ticked boxes and silence do not count.

Consent obtained by dark patterns — a giant “Accept” button next to a buried “Manage” link — is on shaky ground.

Withdrawal must be as easy as consent

This is the principle the CNIL’s 2026 recommendation stresses most. If giving consent took one click, withdrawing it must take about one click too. In concrete terms:

• No re-authentication marathon. You should not have to log in, answer security questions, or “contact support”.
• No email re-entry. You should never be asked to type your address into a form to opt out. The personal link in the email footer already identifies you — asking again would create a new way to probe who is on a list, which is itself a privacy risk.
• One clear action. A single click on the personal link should withdraw consent.

Withdrawal must actually work — even on old emails

Withdrawing consent is meaningless if the pixels already sitting in your inbox keep phoning home. Effective withdrawal means:

• Pixels in already-delivered emails stop registering opens.
• Rewritten links stop recording clicks (or stop existing).
• The sender does not simply “note” your withdrawal for future campaigns while continuing to track the back catalogue.

Achieving this is a server-side responsibility for the sender: the endpoints that serve pixels and process click redirects must check your current preference and stop counting once you’ve withdrawn.

How to exercise the right

1. Open a recent email from the brand and scroll to the footer.
2. Follow the personal preferences / unsubscribe link. It identifies you securely — nothing to type.
3. Withdraw with a single click. It should take effect immediately.

You can also check, before you even click, whether a message supports a clean one-click opt-out using our Unsubscribe & headers checker.

If it doesn’t work

If a sender makes withdrawal hard, ignores it, or keeps tracking old mail after you opt out, that is a compliance failure. You can raise it with the sender, and ultimately complain to your national data-protection authority (in France, the CNIL).