How do I collect open tracking consent?

When the open tracking consent policy is active, only contacts who have given explicit permission are tracked. This guide explains how to collect that consent: for new subscriptions, through the profile page, through your own systems and for contacts moving over from another platform.

For more details on the consent policy itself, see Tracking settings.

Why separate consent for open tracking?

People who subscribe to your emails give permission to receive emails. Open tracking is a separate purpose: keeping track of whether and when someone opens an email. In some countries, such as France and Italy, separate consent is required for this. You decide whether to activate the open tracking consent policy yourself, based on the countries where you operate and your own legal assessment. See Tracking settings.

If you activate the policy, a contact gets the option to receive emails without a tracking pixel. That is a valid choice. Those contacts will still receive your campaigns. If you still want to measure how well your emails perform, ask for consent using the methods below.

The three values and the source of a choice

Every contact has an open tracking consent field with one of three values: Yes, No or Not set. The consent log on the contact record shows the timestamp (in UTC), the new value, the source of the choice and a short note for each change.

The source of the choice is not the same as the source of the contact itself (see About sources). For consent, Flexmail recognises six fixed sources: opt-in form, campaign, profile page, API, import and manual.

Two rules always apply:

An explicit "No" cannot be overwritten by an import, an API call or another external source. Only the recipient can change it.
An empty value never overwrites an existing "Yes" or "No". An empty value is not a decision.

1. Through the opt-in form (new subscriptions)

As soon as you activate the consent policy, Flexmail automatically adds a tracking consent checkbox to your opt-in forms hosted in Flexmail, on a best-effort basis. Forms you create afterwards get the checkbox right away. You do not need to do anything yourself. The checkbox does not appear while open tracking is disabled, even if the policy is active.

The checkbox is unticked by default, you cannot pre-tick it, and you cannot remove it while the policy is active. The text is provided by Flexmail and cannot be edited:

Let us know when you open our emails We use a small, invisible image in the email (also known as a tracking pixel) to see on what date and time you open it. This helps us understand which emails are useful to you. It is optional: if you do not tick this, you will still receive our emails, but without this tracking.

Anyone who subscribes without ticking the box is added as a regular contact, with open tracking consent set to "No". A ticked box gives "Yes". Both choices get "opt-in form" as their source.

Please note: because Flexmail forms use double opt-in, the choice is only recorded when the contact confirms the confirmation email. A subscription that is never confirmed does not record any consent.

An existing contact subscribing again

If an existing contact subscribes again through an opt-in form, the contact must confirm the subscription again through the confirmation email. Until that confirmation, the current value, the pixel behaviour and the consent log remain unchanged.

The value can change from "Yes" to "No" and from "No" to "Yes". A contact with "Yes" who does not tick the box during a new subscription will therefore get "No".
A new log entry only appears if the value differs from the current value.
The value never reverts to "Not set". A subscription without information about the checkbox leaves the current value unchanged.

A form you copied to your own site

Did you copy the HTML of a form to your own site, separate from the script? Then that is a copy of the form as it was at the moment of copying. The copy does not follow later changes to your policy. If you want the checkbox on that copy, copy the form code again after activating the policy.

Subscriptions through such a copy are processed in the same way as all others: if the subscription contains a value for tracking consent, Flexmail processes it. If it contains no value, a new contact gets "Not set" and an existing contact keeps their current value. No refusal is recorded in that case.

2. Through the profile page (self-management by the recipient)

Emails using the default Flexmail footer, which includes the unsubscribe link or the profile link, contain a link to "Manage tracking preferences". The link opens the recipient's profile page. There, the recipient chooses whether to receive emails with or without open tracking. Refusing has no impact on receiving emails. See The recipient profile page below.

3. Through the API or Zapier (your own systems)

If you manage your contacts in a CRM or your own form, pass the consent through the API:

Contact API: the endpoints for creating, updating and reading support the field with the values Yes, No and Not set. You must provide a timestamp. Flexmail stores this as the claimed original date and separately logs when the request arrived. A timestamp in the future or from before the contact existed is rejected.
Opt-in API: you can pass an optional parameter for tracking consent. Because the call triggers a double opt-in confirmation email, the choice is only recorded and timestamped once the contact confirms. If you omit the parameter, a new contact gets "Not set" rather than "No", because the API offers no guarantee that the contact was ever asked about tracking. Store the form text you showed to the contact yourself.
Rules: a "No" is always applied and counts as an explicit revocation. A "Yes" for a contact with an existing "No" is rejected. Sending "Not set" over an existing "Yes" or "No" is rejected. An invalid request returns a clear error message.
Source: every change via the API gets "API" as its source. You cannot set this source yourself. Zapier integrations are also logged as "API".
Webhooks: on every consent change, Flexmail sends a webhook event with the previous value, the new value, the timestamp and the source.
The API also stores values when the policy is not active or open tracking is off. A "Yes" or "Not set" only takes effect once the policy is active, while an explicit "No" works right away as long as open tracking is enabled.

Please note: Flexmail cannot check the validity of consent received via API or import. You remain responsible. This is also stated in the product documentation.

Existing contacts from another platform

If you import contacts who have already given tracking consent elsewhere, you can include that consent in the import.

What Flexmail can and cannot validate

Flexmail cannot verify the validity of externally collected consent. When you indicate that consent exists, you take responsibility as account admin that this permission is correct and demonstrable. Flexmail logs the import as the source, but cannot verify its content or validity.

When importing a contact file, you can pass tracking consent in two ways. Flexmail always processes the consent field, even when the consent policy is inactive or open tracking is disabled.

Through a consent column in your file.

Map the column to the "Open tracking consent" field during field mapping. You will find it under the contact fields. Here is how processing works per row:

You can use "Yes", "No" and "Not set", in uppercase or lowercase. Spaces before or after the value do not count.
An empty cell is not a value: a new contact starts at "Not set" and an existing contact keeps their consent. You will not receive an error message for this.
A value other than "Yes", "No" or "Not set" rejects the entire row. The contact is not created or updated. The row appears in the import error file, along with the value from your source file. The other rows are imported.
"Yes" or "No" is set for a contact at "Not set". "No" is also set for a contact at "Yes". A value matching the current consent changes nothing.
"Yes" for a contact with an explicit "No", and "Not set" for a contact with "Yes" or "No", are not applied. The consent remains as it was. The rest of the row is imported, and the row counts as imported.
If the same contact appears in multiple rows with different values, "No" wins.

Through the dedicated import step.

If you have not mapped a consent column, Flexmail shows a separate step in the import wizard, after the step for source and language and before the step for interests. The step also appears when the consent policy is inactive. In that case, an extra note explains that the policy is not active yet. You choose one of two options:

Import without tracking consent (default): a new contact starts at "Not set" and an existing contact keeps their consent.
Import with tracking consent: only available if you explicitly confirm that valid, documented consent exists outside Flexmail and that Flexmail cannot validate this. All contacts in the file who do not already have an explicit "No" are set to "Yes". A contact with an explicit "No" keeps it.

Please note: through the dedicated import step you can only set "Yes", not "No". If you want to import contacts with an explicit refusal, use a consent column in your file.

Please note: an explicit "No" set via import permanently deletes the individual open events for that contact, even if the policy is inactive or open tracking is disabled. The analysis screen shows how many contacts have "No" and warns about this deletion before you start the import.

What you see after the import

After the analysis, Flexmail shows how many contacts have an invalid consent value. Those contacts are included in the number of invalid contacts and in the file you can download.

Once the import and the deletion of historical open data are complete, you will receive the report email "Your import is ready". It contains:

in the "Warnings and errors" box: how many rows have an invalid consent value (they are also included in the total rows with invalid data and in "Download all rows with invalid data")
in an "Open tracking consent" box: how many new contacts were created at "Not set", how many contacts were set to "Yes", how many contacts kept their "No" and how many contacts became "No", with permanent deletion of their historical open data

A line only appears if the count is greater than 0.

Every consent change caused by the import gets a line in the consent log with source "Import". The note is "Imported via consent column" for a non-empty value from a mapped column (including "Not set"), "Bulk import confirmation" for "Import with tracking consent" and "Imported without consent confirmation" for an empty cell or when no consent column was mapped.

What do you import for existing contacts: "Yes", "No" or "Not set"?

The choice between "Yes", "No" and "Not set" during import is not neutral. It directly affects how Flexmail handles historical open data and impacts your legal position.

Importing "Yes" means you claim that those contacts demonstrably gave permission for open tracking. That is only defensible if you actually collected, documented and can prove that consent.

Importing "Not set" means there is no consent history. Contacts at "Not set" receive no tracking pixel while the policy is active, but their historical open data is not deleted.

Importing "No" means recording an explicit refusal. Contacts with "No" receive no pixel and their historical open events are permanently deleted. This is the most far-reaching option, but also the most transparent if consent was never requested.

When would you consider importing "No"?

If you have contacts in France or Italy whom you never informed about open tracking, or if the transitional period has expired without you taking action, the historical open data for those contacts rests on weak legal ground. In that case, importing with "No" is the fairest choice: you acknowledge that there was no valid consent, and you delete the data collected without that consent.

That is a significant decision, because the deletion is irreversible.

Support tip: Flexmail provides the technical tools to record consent correctly and manage historical data. Which value is correct for your situation depends on the consent you already had and how transparent you have been with your contacts. Consult your own legal team or DPO before making that choice.

Every contact export automatically includes the open tracking consent field (Yes / No / Not set) and the creation date of the contact in Flexmail. You do not need to configure anything for this. The column names and values match the import file. This allows you to see who gave consent, who refused and whose choice is not yet known.

Checklist: am I ready to be compliant with open tracking consent?

Use this list as a guide. Each step is an action you can take before the deadline.

☐ The open tracking consent policy is activated in Settings > Tracking
☐ My opt-in forms contain the tracking consent checkbox (this happens automatically upon activation for a standard opt-in form, but checking your website afterwards is recommended)
☐ I understand that contacts who do not make a choice remain at "Not set" and receive no tracking pixel
☐ I have verified that contacts added via import are configured correctly

Next steps

How do I read my reports when the consent policy is active?: how open rates, click rates and CTOR change
Tracking settings: overview of settings and their combinations

Background information

Open tracking consent: what changes and why?

How do I do this?

Adding contacts