Abandoned cart emails, cart pixels and the consent each needs

Abandoned cart emails are allowed under the GDPR when the shopper gave their email address during checkout, the email promotes only the items they left or similar products of yours, and they could opt out when you collected the address and in every email. That "soft opt-in" covers the email. It does not cover the tracking behind it: the cart pixel, the analytics cookie and the open-tracking pixel inside the email each need the visitor's consent first.

Many online retailers assume that because a shopper typed an email address at checkout, all later tracking and emailing is fair game. It is not, and the reason is that two different laws answer two different questions.

Two legal frameworks govern abandoned cart tracking

Cart abandonment recovery sits where two privacy regimes overlap. The ePrivacy Directive, specifically Article 5(3), controls whether you can place tracking cookies and pixels on a visitor's device. The GDPR governs what you do with the personal data those trackers collect, including sending remarketing emails, and email marketing has rules of its own on top. Cookie consent is not email consent, and neither one stands in for the other.

The cookie that records a visitor's browsing session, the pixel that fires when they add a product to the cart and the email that lands in their inbox an hour later each carry their own legal requirements. Treating them as a single question is a shortcut that regularly attracts regulatory attention.

Which cookies cart abandonment tracking involves

A typical cart recovery setup relies on several types of cookies and trackers working together. Some are strictly necessary, others are not.

The session cookie that holds a visitor's basket is exempt from consent under Article 5(3) of the ePrivacy Directive because the user explicitly requested the service. Every other tracker in the table above requires prior consent before it fires.

Article 5(3) and the consent trigger

Article 5(3) of the ePrivacy Directive is not limited to cookies. The EDPB's guidelines on the technical scope of Article 5(3), adopted in final form in October 2024, confirmed that tracking pixels, tracking links, device fingerprinting and any mechanism that stores or accesses information on a user's device all fall within scope.

For cart abandonment, this means the Meta Pixel, TikTok Pixel and any similar remarketing tag must not fire until the visitor has given consent through a valid cookie banner.

A cart recovery platform that drops its own cookie to match a browsing session to an email address is performing non-essential tracking. That cookie requires consent too.

The soft opt-in exception for emails

The ePrivacy Directive includes a narrow exception often called the "soft opt-in": Article 13(2), as transposed into national law. In the UK it is regulation 22 of the Privacy and Electronic Communications Regulations (PECR). It allows you to send direct marketing emails to existing customers without explicit consent, provided three conditions are met:

• The customer's email address was collected in the course of a sale, or in the UK also of negotiations for a sale
• The emails promote only your own similar products or services
• The customer could refuse when the address was collected, and every email offers a free way to opt out

Cart abandonment emails can fall under this exception. The shopper began a transaction by adding items and entering their email at checkout, and the email reminds them about those specific products.

But the soft opt-in has limits, and its wording differs by country. PECR's "negotiations for the sale" is the widest reading and fits an abandoned checkout well. The Directive itself says "in the context of the sale", and some national laws ask for a completed sale, so an abandoned checkout may not qualify outside the UK. If the visitor only browsed without reaching checkout, no sale was in progress anywhere and the exception does not apply: a "you left something behind" email then needs opt-in consent.

Legitimate interest is not a free pass

Some retailers rely on legitimate interest as their GDPR legal basis for processing personal data in cart recovery. A legitimate interest assessment (LIA) can work here, but it does not override the ePrivacy Directive's cookie consent requirement.

Even if your LIA concludes that sending a cart reminder email serves a legitimate business interest, you still need consent before placing the tracking cookies that power the system. These are two separate legal questions answered by two separate laws.

The CNIL, France's data protection authority, enforces the cookie side hard. On 1 September 2025 alone it fined Google EUR 325 million and Shein EUR 150 million for cookie breaches under Article 82 of the French Data Protection Act, the French version of Article 5(3).

Building a cart recovery flow that keeps consent separate

A cart recovery system that holds up separates the cookie consent layer from the email permission layer. Here is a practical breakdown.

Step 1: cookie consent before tracking

Before any marketing or analytics cookies fire, show a cookie banner with equal accept and reject choices. Block scripts for your cart recovery platform, analytics and advertising pixels until the visitor grants consent. Use a consent management platform to handle conditional script loading so that tags only execute after a positive signal.

Step 2: email permission at checkout

At the checkout stage, collect email permission separately. If you plan to rely on the soft opt-in, make sure the email field is part of an active purchase flow. Add an unticked checkbox or a clear notice telling the shopper that their email may be used for cart reminders, and offer the opt-out at the point of collection, not just in later emails.

Step 3: respect consent signals in your email platform

Sync your ecommerce platform's consent records with your email service provider. If a visitor rejected marketing cookies, do not send them pixel-tracked emails. If they opted out of emails at checkout, suppress them from cart recovery workflows immediately.

Step 4: keep the sequence short and on topic

No law sets a number of reminders. Keep the sequence short, stop it at the first opt-out, and keep content on the abandoned items: cross-selling unrelated products goes beyond the "similar products" condition of the soft opt-in.

Jurisdiction-specific differences

The rules vary depending on where your customers are located.

Canada's Anti-Spam Legislation (CASL) counts an existing business relationship from a purchase within the past two years, but from an inquiry or application only within the past six months. An abandoned cart sits closer to an inquiry, so the shorter window is the safer one to use.

Under US law, the picture is different. The CAN-SPAM Act does not require prior consent for commercial emails but does mandate an opt-out mechanism and accurate sender information. California's CCPA opt-out rules apply to the sale or sharing of personal information collected through cookies, but the email itself follows CAN-SPAM rules.

Mistakes regulators keep finding

The same patterns come up again and again in cart abandonment set-ups.

• Pre-loading tracking scripts. Firing the cart recovery pixel before cookie consent is granted breaches Article 5(3). By January 2025 the ICO had written to 134 of the UK's 200 most visited websites about their cookie banners, and it extended the review to the top 1,000.
• Treating cart emails as transactional. No purchase was completed, so these emails are direct marketing under both the GDPR and PECR. Classifying them as "service messages" to avoid consent rules does not hold up.
• No opt-out at collection. The soft opt-in requires an opt-out opportunity when the email address is first collected, not only in the follow-up email.
• Emailing visitors who only browsed. If no sale or negotiation of a sale occurred, the soft opt-in does not apply. Matching a logged-in user's browsing history to their account email and sending a remarketing message without consent breaches the rules.
• Ignoring opt-outs between emails. A sequence that keeps sending after the shopper unsubscribed from the first reminder ignores the objection the soft opt-in depends on.

Tracking pixels inside emails need consent too

Email tracking pixels, the tiny transparent images that report when a recipient opens a message, fall under Article 5(3) of the ePrivacy Directive. Loading one tells the sender that this recipient opened this email, with their IP address, email client and the time.

France has turned this into a written rule. The CNIL adopted its recommendation on tracking pixels in emails on 12 March 2026 and published it on 14 April 2026, after a public consultation in June 2025. Measuring opens for audience or personalisation needs consent. The one exemption covers measuring deliverability for emails linked to a service the recipient asked for, such as order confirmations, or emails they already consented to. For addresses collected before publication, senders had three months to tell recipients about pixels and let them object, and the CNIL says it will check the rules in future inspections.

If your cart recovery emails contain open-tracking pixels and you have no consent for that tracking, the email can be lawful under the soft opt-in while the pixel is not. Consider click-based conversion tracking instead, or strip tracking pixels from cart recovery emails and measure success by redemption rates.

Questions about cart emails and consent

Hold back cart pixels until shoppers choose

If your store runs a cart recovery tool, its pixel is one of the scripts the banner has to hold. Kukie.io scans your store for the cookies it sets, blocks marketing and analytics scripts until the visitor accepts their category, and logs each choice as proof.

Start free