Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

If they send you an email it means that they obviously have your email address, which I believe is considered personal data.

Now, what additional personal data are collected by tracking pixels?

> these are used to uniquely identify individuals

I would say that this isn't the case. It is to check that the email was read.



> Now, what additional personal data are collected by tracking pixels?

In theory, an IP can be captured, which is considered PII, but most mailbox providers use proxies so this isn't reliable.


You can tracking pixels to track per-user engagement. You can also use tracking links to connect the email address to website activity. As you say, it's possible to use these to track in the aggregate, but many platforms allow tracking by individual.

You are correct that the email was already personal data. But, GDPR requires that each new use of data be transparently communicated and legally justified (which may or may not mean consent), even if it's only using data you already have. The fact that they have already identified the user does not resolve the issue--GDPR still cares when you collect more data about a known user.

Meaning, even though you are justified using the email address to send the newsletter, you may not be in the clear building an engagement profile associated with that email. Which, apparently, some email marketers do.


Not some, all email marketers do.

There's nothing stopping them either, they're entitled to do so, given they obtain consent for that data processing.


Do they? Remember that under the GDPR, a five-page ToS with a "I consent" button at the end is not considered valid. In particular, the user must consent for each use of the PI separately. I don't remember ever seeing a specific consent box for building an engagement profile.


I meant that all marketers are collecting the data, and in the overwhelming number of cases they're doing so without consent.

I'm yet to see a single marketer only do tracking by opt-in, and I work in the industry.

The problem is that we're:

A) Collecting the data without consent

B) In most cases, unable to not collect the data because ESP's do it by default with no option to switch it off


I would argue that pixel trackers for the purpose of checking whether the email is read is covered by the consent to receive marketing by email in the same way as what emails were sent to whom and when will likely also be tracked.


Thats correct. But Tracking or Profiling is Opt-In too


> Now, what additional personal data are collected by tracking pixels?

If I read it, when I read it, where I read it from (location, device, etc)


None of these are personal data if not liked to the email address, which they do not have to.

If linked to email address and considered personal data then the argument is what is covered by consent to receive email marketing? IMHO tracking whether the email was opened is covered (in the same way as agreeing to receive phone marketing should imply they can track whether you answered the phone...). They will also obviously keep track of what emails they sent you and when.


> in the same way as agreeing to receive phone marketing should imply they can track whether you answered the phone.

But agreeing to receive a snail mail does not imply consent to track if it was read. I feel that email is closer to that.


It's impossible to track letter so the point is moot.

The point is that tracking emails, like tracking phone calls, is inherent to that communication medium and there is absolutely nothing wrong with it.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: