A client opens his sending tool for me. Segment “opened in the last ninety days”: four thousand one hundred people. We cross it with clicks over the same period: three hundred and eighty. With orders: forty-one. The segment he had been steering his follow-ups on for a year held ten times more people than reality.
His tool is not lying. The open is simply no longer a behaviour.
An open no longer proves that a person read your email. It proves that a machine loaded an image.
Behavioural segmentation means segmenting on acts. So the work starts with sorting: what still counts as an act, and what stopped counting. Here is how I do it, and what I wire in instead.
1. The open is no longer an act
Apple documents the mechanism in plain language on its own page. When Protect Mail Activity is on, remote content is downloaded in the background on receipt, whether or not the recipient engages with the message, and the IP address travels through two separate relays so that no single party can identify both the person and the content received. Your tracking pixel is loaded by a server, not by a reader.
Sending platforms say the same thing in writing. Mailchimp states that emails present in Apple Mail are reported as opened regardless of the contact’s activity, and lists what breaks downstream: automations triggered on an open reach a larger audience than intended, automations triggered on a non-open reach a smaller one, A/B tests decided on open rate lose their validity, location-based segments shrink because the IP address is hidden, and contact engagement ratings drift upward for no reason.
So I no longer build a single segment on opens. Not as an inclusion, not as an exclusion. The exclusion is by far the worse of the two: a “did not open” segment quietly drops Apple Mail recipients first. You are no longer re-sending to a random slice of your base. You are re-sending to everyone except iPhone users, who are often your best customers.
2. In France, this stopped being only a reliability question
Since the spring, the open pixel also has a legal status. The CNIL, the French data protection authority, adopted deliberation no. 2026-042 on 12 March 2026 and published its recommendation on tracking pixels in emails on 14 April. The reasoning is straightforward: loading a pixel asks the recipient’s device to send information back, which is a read operation on that device. Article 82 of the French Data Protection Act applies, and with it prior consent, unless an exemption covers the case.
The exemption exists and it is narrow. It covers individual deliverability measurement, meaning spotting recipients who no longer open in order to cut frequency or remove them from the base. Two conditions are worth memorising. The email must relate to a service the person asked for: a transactional message, or a newsletter they signed up to. And collection must stay strictly necessary, the CNIL specifying in its questions and answers that the only data needed is, in principle, the date of the last open. A pixel that also captures the time of the open falls outside the exemption, even if that data is anonymised moments later.
Two points to know before you touch any settings. An abandoned cart email is not transactional: the CNIL places it among promotional emails, so its pixel is not exempt. And the aggregate open rate of a campaign, once anonymised, remains usable without additional consent.
Engineering and law are saying the same thing here, which does not happen often. The open is there to clean a base. It is no longer there to target one.
3. The signals that remain, and they are enough
The good news sits in one line of that same Mailchimp page: clicks and purchases are not affected by Apple’s protection. Everything a serious targeting setup needs is still on the table.
| Signal | What it actually proves | What I do with it |
|---|---|---|
| Open | That an image was loaded, often by a server | Spot inactive contacts, nothing more |
| Click | That a person acted inside the message | Engagement segment, flow trigger |
| Product page viewed | A dated interest, on a named product | Targeted follow-up, if the event reaches the tool |
| Order | What can be counted in euros | Exclusion, cross-sell, customer value |
One clarification that avoids false comfort: the tracking link is not neutral ground either. The CNIL notes that tracking links are not directly covered by this recommendation, while reminding everyone that they also involve read or write operations on the device and therefore fall under article 82, to be assessed case by case against the purpose pursued. Technically reliable does not mean out of scope.
4. The data already exists, it just never reaches the sending tool
This is the real blocker, and it is almost never where people look for it. A sending tool knows four things by default: what it sent, what was loaded, what was clicked, who unsubscribed. It knows nothing about product pages viewed, carts left behind, orders paid. Those events live in the shop, and someone has to go and fetch them.
On the accounts I take over, the integration between the shop and the sending tool sits right there in the connector catalogue and nobody has switched it on. This is not a development project, it is a box nobody was given the mandate to tick. Three events are enough to start, in this order: order placed, cart abandoned, product page viewed. With the amount and the category attached to each one, otherwise you will know that somebody bought without knowing what.
Wiring those events belongs to the same job as the rest of your measurement, which I cover on the analytics side: a signal collected badly upstream is never recovered downstream.
5. Segment or list, the distinction that decides everything
The two words get used as synonyms and they describe two different objects. Klaviyo documents it clearly: a list is static and only grows as people subscribe, while a segment is defined by conditions and recalculates continuously, gaining profiles when they meet the conditions and losing them when they stop.
Hence a rule I keep repeating: a file exported on Monday is wrong by Tuesday. A behavioural segment is only worth having because it moves on its own. The moment it passes through an export, it becomes a photograph, and you start following up with people who ordered in the meantime.
The reverse trap is a serious one. Per the same documentation, a segment draws from every profile in the account, including people who never consented to marketing: “viewed a product page in the last thirty days” will also sweep in people who arrived through an order or a contact form. Confine it to your subscriber list before sending anything. Otherwise your elegant targeting machine sends prospecting to someone who never asked for it, and you have created a compliance problem out of good intentions.
6. The three segments I set up first
Three, not fifty: targeting nobody ever reviews stops being targeting.
Recent buyers, over ninety days. Excluded from acquisition campaigns and welcome codes, spoken to about using the product and what goes with it. It is the most profitable segment and it is nearly always the missing one.
Clickers who never bought, over one hundred and eighty days. People who raised their hand and were not convinced by anything. That is the seam worth mining. If they clicked on a specific category, the follow-up covers that category, not the general newsletter.
Dormant contacts: no click, no visit, no order in twelve months. Reduced frequency, then removal. This is the only place where the date of last open still belongs, and it is exactly the use the CNIL recommendation reserves for that signal.
This third segment also protects your sender reputation, covered in detail in the article on deliverability when you have no IP to warm up. Cleaning and targeting are not two projects: the same clean base serves both.
The most expensive mistake
The automatic re-send to “non-openers”, forty-eight hours after the campaign. It used to be good practice, it is now a shot in the wrong direction: the platform will not re-send to Apple-protected contacts, which it believes have opened, and will re-send to the people who genuinely saw the message and ignored it. If you want that second send, target the people who did not click. Same answer for A/B tests: decide on clicks, not on opens.
What I watch once it is running
Three numbers a month, and no open rate among them. Click rate by segment, which tells you whether the targeting holds. Revenue per recipient, segment by segment, which tells you whether it pays. And the share of the base that has produced no signal at all in six months, which tells you whether you are paying to send into the void.
The last one is the most useful in a meeting: it converts into platform fees on one side and sender reputation on the other. A base of forty thousand addresses with twelve thousand silent for a year is not a base of forty thousand addresses.
In the crucible: telling the signal from the reflection
The pixel now returns nothing but a reflection: a server loading an image in an empty room. Clicks, visits and orders are signals, someone moved. The whole craft of segmentation sits in that distinction, and whoever draws it now will be a year ahead of those waiting for their platform to pull the number off the screen.
What disappears here is not a metric. It is a comfortable habit that technology emptied of meaning and that the law has just put a frame around.
Are your segments still built on opens?
Send me your list of active segments and the name of your sending tool. I will tell you which ones rest on opens, which ones rest on a stale export, and which signal to replace each with. Worst case you confirm your targeting holds, best case you recover half a base you had filed away as dead.