These trackers, which are generally invisible to the user, can, among other things, reveal whether an email has been opened. In its recommendation, the CNIL specifies the framework applicable to tracking pixels in emails, particularly with regard to information, consent, and the right to object. For email addresses collected prior to the publication of the recommendation, it also provides for a phased implementation, with a three-month period to inform recipients about the use of tracking pixels and allow them to easily opt out. 

For an international company, this type of change goes beyond a simple compliance update. It may require reevaluating more fundamental decisions: Should the company adapt only to the specific market in question, or should it align its practices on a global scale? Are CRM platforms, marketing automation tools, consent management systems, and internal teams ready to accommodate this type of change without having to start from scratch? 

When a local regulator issues new guidelines regarding a common practice—such as tracking pixels in emails—how should an international company decide whether to adapt its practices locally or modify its global standard? 

It comes down to understanding whether this is truly a local interpretation or the start of a broader trend that other regulators might follow. If it is specific to a particular market and does not create too much operational complexity, then a well-managed local approach may make more sense. 

But if maintaining different standards across countries becomes difficult or introduces unnecessary risks, it is better to adopt a more global standard. Keeping things simple and consistent is generally easier to manage in the long run. 

Can companies truly prepare for this type of regulatory change, or will privacy and data regulations always require them to react to some extent? 

There will always be some degree of reaction to regulatory changes. That’s simply the nature of the environment in which we operate: things are constantly changing. But companies can certainly prepare for this by building flexibility into their technologies and operating procedures. 

If platforms, data, processes, and work methods are well-designed, responding to new recommendations becomes more a matter of incremental adjustments than a complete overhaul. 

A critical—and often underestimated—factor is having an agile team. Technology is evolving rapidly, regulations are changing quickly, and AI is accelerating this pace even further. Having a team capable of assessing the impact, reprioritizing work, and responding quickly is becoming more valuable than simply having the right technology. 

What foundations need to be in place to respond quickly: consent management, CRM best practices, data governance, documentation, vendor oversight, or shared responsibility among teams? 

All of these foundations matter. Effective consent management, clean CRM data, strong governance, and clear documentation make it much easier to adapt to change. 

If I had to pick one thing, it would be the shared responsibility among teams. Compliance isn’t just a legal or technological issue—it cuts across the entire company. Marketing, Legal, Data, and Technology must work together, with clear responsibilities and effective communication. 

I would also add, as mentioned earlier, organizational agility. The companies that manage change best are those where people, processes, and technology are aligned, and where teams can make decisions and adjust their priorities quickly when circumstances change. 

Does this type of regulation change the way companies need to approach their investments in marketing technologies, data platforms, and AI tools? 

Yes. When a company invests in technology, flexibility becomes just as important as functionality. We need platforms that facilitate consent management, provide good visibility into data, integrate seamlessly with the rest of the ecosystem, and can adapt as regulations change. 

The same logic applies to AI. Governance, transparency, and understanding the source of data are becoming just as important as the AI capabilities themselves. The next area to consider is agent-based AI, where we will need the same level of governance and observability regarding what these agents do on our platforms and with our data. 

We are also entering a world of constant change. Between evolving regulations and the pace of innovation in AI, companies should not expect their current ways of working to remain stable for very long. It makes sense to invest in technologies designed to evolve, rather than assuming that a system will be built once and then left as is. 

For international companies, is the biggest challenge understanding every local regulation, or building systems that are flexible enough to adapt when those regulations change? 

For me, the biggest challenge is building organizations and systems that can adapt. Understanding regulations is obviously important, but that’s something you can research and interpret. The toughest challenge is creating systems, processes, and teams that can respond when those rules change—which will inevitably happen. 

As AI transforms the way businesses operate within an increasingly complex regulatory landscape, adaptability is becoming an essential capability. The organizations that will succeed the most are those that embrace change as a normal part of life and invest in flexible systems, strong governance, and agile teams capable of responding quickly and reprioritizing when necessary. 

What this exchange shows is that compliance can no longer be treated as a last-minute fix. It is becoming an investment criterion in its own right. 

The best-prepared companies will not only be those that follow the new rules as they are introduced, but those that have laid the necessary groundwork to adapt without having to start from scratch. This applies not only to visible tools, but also to everything that ensures their long-term reliability: clean data, well-managed consent, transparent governance, aligned teams, and systems capable of evolving.