--- title: "Email Tracking Consent" slug: "engage-email-tracking-consent" description: "How Email Tracking Consent works in Mapp Engage: the tracking_consent attribute, Tracking Type options and which UTM parameters stay on links." status: "update" updated: 2026-10-30T14:57:15Z published: 2026-10-30T14:57:15Z canonical: "docs.mapp.com/engage-email-tracking-consent" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.mapp.com/llms.txt > Use this file to discover all available pages before exploring further. # Email Tracking Consent ## Purpose and Scope Email Tracking Consent records whether a contact has agreed to have their email opens and clicks tracked. Engage then applies or suppresses tracking for that contact. The value is stored as a profile attribute on the contact. Engage evaluates it at send-out, when it decides whether to include open and click tracking in the message for that recipient. --- ## Background Email tracking relies on two mechanisms: a pixel that registers an open, and rewritten links that register a click. Some markets treat both more strictly than others. In France and Italy, the supervisory authorities hold that this kind of tracking can require the recipient's prior consent, much like cookies. Whether that applies to your sending depends on who you send to and on the legal basis you rely on. This page describes the tooling Mapp provides. Assessing your own obligations is your responsibility as the data controller. --- ## Prerequisite: Activation Email Tracking Consent only takes effect when it is active for your account. Mapp activates it on request. Contact your CSM to check whether it is active for your account or to request activation. > [!WARNING] > Warning > > As long as Email Tracking Consent is not active for your account, Engage does not evaluate consent at all. All contacts are tracked, regardless of the value in the `tracking_consent` attribute and regardless of the Tracking Type of a message. The interface does not show whether Email Tracking Consent is active for your account. --- ## Control Mechanism: the tracking_consent Attribute The processing of email tracking for a contact is determined by the `tracking_consent` profile attribute. It supports four states. | State | Meaning | | --- | --- | | Granted | The contact has consented. Email opens and clicks are tracked normally and attributed to the contact profile. | | Denied | The contact has declined. By default, no tracking pixel is injected and opens and clicks are not tracked. The links in the message still function normally for the recipient. The message-level **Tracking Type** setting can change this, either by tracking the contact in full or by tracking them anonymously. | | Withdrawn | The contact has withdrawn a previously given consent. Processed the same way as Denied. | | Unknown | No consent value is stored on the profile. An empty or `null` value counts as Unknown. Tracking remains on by default. Your CSM can switch that default off for your account. | --- ## Behaviour For messages already sent before a contact declines, the links in those messages cannot be rewritten retroactively. However, when the contact clicks, if their consent is Denied or Withdrawn, the tracking is ignored, unless the message was sent with a Tracking Type that overrides consent handling. --- ## Tracking Type **Tracking Type** is a per-message setting in the message's sendout configuration, available on create and edit. When you send to a group, it sits under **Advanced Options**; when you save a prepared message, it sits directly in the configuration step. It determines how each recipient's tracking consent is applied to that message. The default is **Normal Tracking**, so existing messages and integrations behave exactly as before. | Option | Contacts who granted consent | Contacts who denied or withdrew consent | | --- | --- | --- | | Normal Tracking | Tracked normally and attributed to the contact profile. | Not tracked. No tracking pixel is injected and links are not tracked. The links still work normally for the recipient. | | Force Full Tracking | Tracked normally and attributed to the contact profile. | Tracked with their real contact identifier and attributed to the contact profile, regardless of their consent state. | | Force Anonymized when denied or withdrawn | Tracked normally and attributed to the contact profile. | The tracking pixel and tracked links are delivered, but the URLs carry an anonymous placeholder instead of the contact identifier. Opens and clicks count towards aggregate statistics only and are not attributed to the contact. | With all three options, the standard UTM parameters stay on the links. See [UTM and Other Link Parameters](/docs/engage-email-tracking-consent#utm-and-other-link-parameters). > [!WARNING] > Warning > > Tracking Type only takes effect when Email Tracking Consent is active for your account. See [Prerequisite: Activation](/docs/engage-email-tracking-consent#prerequisite-activation). If you are unsure, check with your CSM before relying on the anonymized option. Selecting **Force Full Tracking** or **Force Anonymized when denied or withdrawn** is your decision, and you are responsible for having a lawful basis for it. Engage does not ask you to confirm that basis and does not assess it. ### When to choose the anonymized option Choose **Force Anonymized when denied or withdrawn** when you need campaign-level open and click statistics for your whole audience, but no recipient-specific identifier may leave the email. This is the situation Italian compliance requirements describe. Choose **Force Full Tracking** only where you have a lawful basis for tracking every recipient individually and you need contact-level reporting, automations, or raw data events for those recipients. The anonymized option does not provide any of these for contacts who denied or withdrew consent. Where a stricter reading applies, as with the CNIL recommendation in France, Mapp recommends keeping **Normal Tracking**. Normal Tracking keeps the standard UTM parameters on the links as well. See [UTM and Other Link Parameters](/docs/engage-email-tracking-consent#utm-and-other-link-parameters). ### Limits of the anonymized option For contacts who denied or withdrew consent, an anonymized open or click: - counts only towards aggregate message and campaign statistics and is not attributed to a contact - does not appear in raw data events - does not trigger automations - is not available for DMP or Intelligence matching - does not store the real contact identifier, the email address, or any stable per-contact identifier. Clicks are redirected as usual, so the recipient experience is unchanged. > [!NOTE] > Note > > Tracking Type can also be set through the API when you create or update a prepared message. See the API reference for the field name and values. --- ## UTM and Other Link Parameters Engage keeps the five standard UTM parameters on email links for every contact, whatever their consent state and whatever Tracking Type the message uses: - `utm_source` - `utm_medium` - `utm_campaign` - `utm_term` - `utm_content` This applies to UTM parameters you define in the group settings under *Tracking & Links > Link Parameters* and to UTM parameters that are already part of a link. Your web analytics therefore keeps campaign attribution for contacts who denied or withdrew consent. Standard UTM parameters describe the campaign or the link, not the recipient. Only your website tracking evaluates them, and it is subject to the consent the visitor gives on your website. All other link parameters from the group settings, for example `uid`, `gid` or `uc701`, are not added for contacts who denied or withdrew consent when the message uses **Normal Tracking** or **Force Anonymized when denied or withdrawn**. > [!WARNING] > Warning > > UTM parameters reach every contact, including contacts who denied or withdrew consent. Engage does not check their values. It is your responsibility to make sure they contain no personal data, such as contact IDs, email addresses, hashes, per-recipient tokens, placeholders that insert contact data, or values that reveal something about the recipient. ### Safe and unsafe UTM values | Value | Example | Safe | | --- | --- | --- | | Static value that describes the campaign | `utm_campaign=spring_sale_2026` | Yes | | Channel or medium | `utm_medium=email` | Yes | | Placeholder for message or group data | `utm_campaign=<%message.name%>` | Yes, if your message and group names contain no personal data | | Placeholder for contact data | `utm_content=<%user.id%>` or `utm_term=<%user.Email%>` | No | | Hashed or encoded contact data | A hashed email address | No | | Token or code that is unique per recipient | A personal voucher code | No | | Value that reveals something about the recipient | `utm_content=overdue_payment_reminder` in a message sent only to contacts with unpaid invoices | No | > [!NOTE] > Note > > There is no setting that removes the standard UTM parameters for contacts who denied or withdrew consent, and Normal Tracking does not remove them either. If you do not want UTM parameters on links for these contacts, remove them from the group settings and from the links. They are then missing for all contacts. --- ## Responsibilities Mapp provides the tooling: Engage stores the consent value you send and applies or suppresses tracking based on it. You own the data and the legal basis: Mapp stores exactly what you send and does not validate it, so the accuracy of the consent data and the lawfulness of any tracking you carry out are your responsibility as the data controller. Selecting a Tracking Type that overrides consent is a decision you make on your own; Engage does not ask you to confirm a lawful basis for it and does not assess one. The same applies to the values of your UTM parameters: Engage keeps them on the links for every contact and does not check them for personal data. If you are unsure whether or how this applies to your sending, consult your own data protection adviser. --- ## Relationship to Anonymized Email Tracking Engage also offers Anonymized Email Tracking, controlled by the `DoNotTrack` contact attribute. It serves a different purpose from `tracking_consent`: `tracking_consent` determines whether open and click tracking is included at all, while `DoNotTrack` determines whether that tracking, when it happens, is anonymized. To track a contact anonymously this way, set `tracking_consent` to `granted` and `DoNotTrack` to `true`. For how anonymization is processed, see [Email Tracking – Identifiability Model](https://docs.mapp.com/docs/email-tracking-identifiability-model). Engage therefore has two different ways of anonymizing email tracking, and the difference between them matters: | Mechanism | What it does | | --- | --- | | `DoNotTrack` | Set per contact. The delivered pixel and links still carry the recipient's real identifier; the response is anonymized after it reaches Engage. | | Tracking Type, Force Anonymized | Set per message. The identifier never leaves the email in the first place, because the delivered pixel and links carry an anonymous placeholder for contacts who denied or withdrew consent. | Where a requirement is that no recipient-specific identifier may be contained in the tracking URLs delivered inside the email, only the message-level anonymized option meets it. This also requires that your UTM parameters contain no recipient-specific values. See [UTM and Other Link Parameters](/docs/engage-email-tracking-consent#utm-and-other-link-parameters). If `tracking_consent` is `denied` and the message uses Normal Tracking, no tracking takes place, regardless of the `DoNotTrack` setting. --- ## Data Retention Email open and click tracking data is retained for three calendar years from the point of collection. This is an existing, Engage-wide retention property and is not specific to this feature. Withdrawing consent stops future tracking; it does not delete tracking data already collected, which is retained under the standard retention policy. If a contact exercises a data subject right such as deletion or anonymization, that is handled separately from consent withdrawal. --- ## Related articles - [Email Tracking – Identifiability Model](https://docs.mapp.com/docs/email-tracking-identifiability-model) - [Opt-out Methods](https://docs.mapp.com/docs/opt-out-methods) - [How-to: setting the tracking_consent attribute](/v1/docs/engage-setting-the-tracking-consent-attribute) - [API reference: /contact/update](https://docs.mapp.com/apidocs/engage-api-setting-a-contact-s-tracking-consent) - [URL Parameters in Email Links](https://docs.mapp.com/docs/engage-emails-url-parameters-in-email-links)