Short answer: the ICO's guidance on storage and access technologies names two techniques nearly every email programme uses, tracking pixels and link decoration such as UTM parameters. It says regulation 6 of PECR applies where either one stores information on a person's device or accesses information stored there. What matters is what the technique does and why you use it.
The ICO says it finalised this guidance on 29 April 2026, after consultation on both a December 2024 draft and a July 2025 update reflecting the Data (Use and Access) Act. This article summarises what it says about email. It is not legal advice.
Key terms
- Tracking pixel: per the ICO, a small piece of code, usually an image file, embedded in a web page or email that lets a server identify information such as when an email was opened.
- Link decoration: adding extra information to a link's URL, without changing the destination, so more data reaches the destination site than it needs to load the page.
- UTM parameters: the common form of link decoration in email, such as a source or campaign label added to a URL.
- Navigational tracking: the ICO's term for using link decoration to recognise the same person across sites, for instance with a user ID in the URL.
- Regulation 6 (PECR): the rule on storing or accessing information on a person's device.
- Regulation 22 (PECR): the rule on electronic mail marketing.
What the ICO says about tracking pixels
The ICO's worked example is an organisation that puts a tracking pixel in its marketing emails to record the time, location and operating system of the device used to read the email. Its position:
- the majority of electronic mail marketing is governed by regulation 22,
- but where tracking pixels store information on a device, or gain access to information stored there, regulation 6 applies to that processing.
The guidance also includes a chapter on exceptions to the general rule on storing or accessing information on devices. Read it before deciding what needs consent in your own set-up. In its overview of the Data (Use and Access) Act, the ICO says the law now allows some types of cookies without consent, such as those used to collect information for statistical purposes. Whether a specific email technique qualifies is a question to check against the guidance rather than assume.
What the ICO says about link decoration
The ICO's first example is the one marketers know well: a link such as https://www.example.com/article?referrer_source=emailnewsletter. It notes that online services often use this to identify the origin of inbound traffic, such as a specific email campaign.
It then separates that from navigational tracking, where decoration identifies a user across sites, for example by adding a user ID to a URL that is also held in a cookie or local storage. The ICO says regulation 6 applies where link decoration involves storage of, or access to, information on a device, and that the key consideration is the purpose.
In practice, a campaign label describes the email. A subscriber ID identifies a person. The two sit at very different ends of the privacy spectrum.
| Technique |
What it records |
Question to ask |
| Open pixel |
That a message was loaded, plus device details such as time, location and operating system |
Do we use per-person open data, and on what basis? |
| Campaign UTM labels |
Which campaign or channel sent a visit |
Does anything join this label to a stored profile? |
| Subscriber ID in the URL |
Which person clicked |
Is this necessary, and who receives it? |
| Third-party pixels |
Data shared with another provider |
Who gets the data, and what do they do with it? |
Why this fits the measurement problem
If you already know how email tracking actually works, you know the open is the weakest signal. Apple Mail Privacy Protection loads pixels automatically, so open rate is unreliable, and security scanners can inflate clicks too, as bot clicks are lying to you explains. A compliance review and a measurement review therefore point the same way: depend on fewer, better signals.
European readers should also read CNIL and email tracking pixels, and email tracking laws in Europe for the wider picture. The ICO guidance is the UK reference to read alongside them.
A 30-minute tracking audit
- List every tracker in a typical email. Open pixel, link-click redirects, per-recipient IDs in URLs and third-party pixels from other tools.
- Separate labels from identifiers.
utm_source=newsletter describes a campaign. A parameter holding a subscriber ID or email address identifies a person.
- Trace where parameters go. Do your analytics, CRM or advertising tools match the parameter to a stored profile or send it to another company?
- Ask what you actually use. If no one acts on per-person open data, consider switching the pixel off.
- Review your privacy notice. It should describe email tracking in plain language.
- Document the decision. Write down what you track, why, and the basis you rely on, then check it with your data protection lead.
Metrics that survive a tracking cut
If you reduce pixels or per-person identifiers, you still have dependable measures:
Key takeaways
- The ICO names tracking pixels in emails and link decoration as technologies that regulation 6 of PECR can cover.
- The key consideration is the purpose and whether information is stored on, or accessed from, a person's device.
- Campaign labels and per-person identifiers are different things. Audit which one you use.
- Clicks, conversions and revenue per delivered email remain strong signals without heavy per-person tracking.
Sources
This article is general information, not legal advice.
Related articles
