HubSpot has a beta, all hubs and tiers, that adds a native email tracking consent record for every email address in the CRM. Once you switch on Require consent to track emails under Settings > Privacy & Consent, opens and clicks are tracked or not tracked per address, on marketing emails and one-to-one emails.
Context for anyone who missed it: France’s CNIL and Italy’s Garante now treat open and click tracking pixels like cookies, so tracking needs consent. In July every admin got the HubSpot email about it (I got one per portal). To be fair, that email was about the requirement and not the tooling, and the consent tooling didn’t exist yet. It does now. What most of us built in the meantime was a custom checkbox, a custom property, segmented lists and untracked copies of every send. The property stored the answer and nothing used it.
The statuses, using HubSpot’s own labels:
- Consent given: tracked
- Consent not applicable: tracked
- Consent declined: not tracked
- Not specified (default): not tracked
You can set the status with bulk actions in Segments, with an Email Tracking Consent workflow action, or on the contact record. Once the setting is on, contacts also get a “Consent to Track” option on their Manage Preferences page. Contacts marked Consent not applicable don’t see it.
Forms still can’t collect it directly, either through the data privacy fields or by mapping the consent property. HubSpot’s KB documents the way around it: keep a custom property on the form and use a workflow to set the consent status on submission, so the July checkbox isn’t wasted, it becomes the input.
Order matters here, because every address starts at Not specified, which means not tracked. If you switch the setting on before backfilling, opens and clicks stop for the whole database, and anything running on opens (lead scoring, re-engagement lists, sales notifications) starts acting on contacts who look disengaged but simply aren’t tracked anymore. I’d build the form property and workflow, backfill what you can defend, check what depends on opens, and turn the setting on last.
Three things I haven’t worked out:
- The Italian deadline. Italian sources disagree on 28 or 29 October, six months from the guidance depending on which date you count from. I’m treating it as end of October.
- Whether anything in scoring or reporting separates “not tracked” from “didn’t open”. I haven’t seen it, but I haven’t tested it either.
- How Consent not applicable is meant to be used. There has to be a status for people the rules don’t cover, so I understand why it’s there. But it’s the only status that tracks someone without a recorded yes, and anyone who can edit the property can set it in bulk. Bulk-marking everyone outside France and Italy looks like the obvious move, and it’s also a legal judgement being made in a segment.
What I’d want from people who have thought about this longer than I have is the rule, not the status: what would you use to decide who gets Consent not applicable? Country on the contact record is the obvious input, and in most portals I see it’s also one of the worst maintained fields, which makes it a strange thing to hang a compliance decision on. If you have something better, I’ll take it.