The Week the Question Stopped Being Where Your Data Sits
Picture a re-engagement journey running for an Italian retailer on the thirtieth of October. Live for two years, and it works. Anyone who has not opened an email in ninety days enters, gets a three-message sequence, and either comes back or gets suppressed. It has never thrown an error.
On the thirtieth of October it will still not throw an error. It will simply stop admitting a growing share of Italian recipients, silently and permanently, because they will no longer generate the event the entry condition waits for. Entry volumes will drift down, which is what entry volumes do when a list matures, so nobody will look twice. The first person to notice will be whoever asks, months later, why the Italian programme stopped producing revenue.
This is not a hypothetical about a rule that might arrive. Italy’s Garante adopted guidelines on email tracking pixels in April, with six months to comply, which puts the date at the twenty-ninth of October. France’s CNIL got there first, by a different route. And this week, for the first time on my watchlist, a customer engagement platform shipped the mechanism rather than a blog post about the regulation.
TL;DR
- The open-tracking pixel stopped being a platform setting and became a per-recipient profile attribute. MoEngage shipped the first native open-tracking consent management on my watchlist: held separately from subscription status, settable from outside the platform, country-scoped, timestamped and audited. Schema changes belong in the customer data platform, not the email tool.
- What breaks on the twenty-ninth of October is the trigger, not the metric. Entry conditions keyed on Email Opened do not error when the event stops being generated. They stop admitting a growing cohort of French and Italian recipients, permanently, while every model trained on open recency scores those people as disengaged.
- Zeotap put the entire composable CDP inside the customer’s own Snowflake account. Not reverse ETL and not a zero-copy read, but identity resolution, segmentation, orchestration and activation running as containerised services on Snowpark, inside a perimeter the customer already owns.
- Three vendors, three objects, one move. Each gave up custody of something and kept the decision about it. What discriminates in a platform selection is no longer where the data lives, but which states the platform holds, which it defers to you on, and which of your rules it enforces on surfaces it did not build.
The platform is where your logic runs, not where your state lives
Three unrelated things happened in the last seven days, and read separately they are a compliance feature, a packaging decision and a channel enhancement. Read together, they are the same move performed on three different objects: the vendor stops being the place a thing is held and becomes the place a thing is decided. It is the instinct behind the four gravities that shape MarTech decisions and what makes the CDP and CEP architecture patterns worth arguing about. Three clean instances in a row is usually where a suspicion earns the right to be called a pattern.
Start with the one that has a deadline.
What the regulators actually require, and when
Most summaries of this go wrong, including an earlier draft of mine, because the two instruments are not the same kind of thing and the dates do not mean what they are reported to mean.
France. The CNIL adopted deliberation n° 2026-042 on the twelfth of March and published it on the fourteenth of April. It is a recommendation and does not create the obligation: that already existed in Article 82 of the Loi Informatique et Libertés. So you cannot dismiss it as optional, because the rule beneath it is statutory, nor treat it as the statute, because the exemptions live in the recommendation.
The fourteenth of July was not the day consent became mandatory there. It ended a three-month accommodation for addresses already in your database. Miss the window and you lose the accommodation, not the obligation.
Italy. The Garante adopted its guidelines on the seventeenth of April and published them on the twenty-ninth. The compliance term is six months from publication, which is the twenty-ninth of October 2026. Vendor documentation, including the release below, often says the twenty-eighth. Work to the earlier of the two.
Italy goes further on two points that land on your preference centre. Withdrawal has to be possible granularly, not as one all-or-nothing switch. And privacy by design is named as an obligation in its own right, aimed at reducing the identifiability of the recipient. The addressee list names operators of bulk email sending platforms, so your ESP is not a bystander. Neither are you.
Both regimes carry real exemptions, wider than “narrow”, for security, strictly necessary technical requirements and service communications. The CNIL’s question-and-answer document of the twenty-second of July, which I have not seen referenced in the trade coverage, settles the scoping questions your team will actually hit: whether tracking links are in scope, what counts as transactional, what falls on the sending platform rather than on you. Start there, not with a law firm’s summary.
What survives the nuance should worry an architect. Consent is required where the pixel profiles the individual recipient, and the profiling the regulators describe is analysing opening behaviour to personalise subject lines, content and send frequency, and feeding marketing automation. That is the default configuration of every engagement platform I have implemented.
The pixel becomes a profile attribute, not a platform setting
Plenty of guidance has been published about the French recommendation, and guidance is useful. None of it is a mechanism, which is why MoEngage’s July release is the artefact of the week. The shape of it is the argument, not the feature list.
Consent is stored in a new system attribute, moe_email_open_tracking_consent, held separately from subscription status and settable through user import, the SDK or the data API, which means the platform is explicitly not claiming to be the source of truth. A country selector scopes which markets it applies to, with a configurable fallback for recipients whose country attribute is empty. Every change is logged with the new state, the previous state, the timestamp and the source. Non-consented recipients get no pixel, including in mail already sent, and a separate preferences link sits in every footer.
Open tracking used to be a property of the sending platform: one switch in a settings pane, applied to everything. It is now a per-recipient, per-country, timestamped, auditable attribute of the customer profile with its own lifecycle and its own consent surface.
The pixel stops being a platform setting and becomes an attribute of the customer profile, which is a schema change rather than a compliance toggle.
That is not a compliance toggle but a schema change, and it belongs in the customer data platform rather than the email tool, which is the case I made for the CDP as an architectural category. If your open-tracking consent lives only in your ESP, you will find its limits the first time you run a second sending platform, or migrate, or answer a subject access request spanning both. I have no brief for the vendor; what matters is that the mechanism now has a reference implementation.
One caveat, since I am praising it. Country-scoped enforcement is pragmatic and also fragile, because it makes your compliance posture depend on a country attribute that, in every profile store I have audited, is somewhere between incomplete and imaginative. The fallback for missing country data decides what happens to the part of your database you know least about, and it will get less discussion in the design review than it deserves.
What breaks is the trigger, not the metric
The consequence most commentary reaches for is that open rates will fall. That is true, and it is the least interesting thing about this.
MoEngage states the real one plainly in its own release note: flows using Email Opened as a trigger or entry condition may need review. That sentence does a lot of quiet work, because an open-based entry condition does not fail loudly when the event stops being generated. It does not error, it does not warn, and it appears in no monitoring you have configured, because from the platform’s point of view nothing has gone wrong. A population simply stops qualifying. Every re-engagement programme, every win-back sequence, and every wait-for-event node that pauses until someone opens, will hold a growing cohort of French and Italian recipients in permanent suspension.
Then there is everything trained on the event rather than triggered by it. Send-time optimisation learns from open timestamps, engagement scores decay on open recency, and deliverability heuristics watch open trends, which is why deliverability starts long before the send. A model that stops receiving opens from two markets does not know it is missing data. It concludes those recipients are disengaged, so your consent-respecting French customers get downgraded for exercising a right.
Falling open rates are the least interesting consequence. The silent one is a journey entry condition that stops admitting people and never says so.
And there is measurement. Open rate becomes a metric with a hole in it, and the shape of the hole is your consent coverage in two countries. No time series crossing the twenty-ninth of October is comparable with itself unless you carry a consent-coverage dimension alongside it, and Italy next to Spain now compares two different instruments. So the work is not legal review, which is the easy part. It is finding every journey that keys off an open, deciding what each falls back to, and giving consent coverage a permanent place in the measurement framework.
Zeotap ran the whole CDP inside someone else’s Snowflake account
The second instance is more dramatic and has no deadline, which is probably why it will get less attention.
On the fifth of August, Zeotap made its complete Composable CDP available as a Snowflake Native App. Identity resolution, profile unification, segmentation, journey orchestration, the agentic components and activation to over two hundred and fifty destinations, all running as containerised services on Snowpark Container Services inside the customer’s own Snowflake account. The data does not leave the perimeter, because the application came to the data.
Be careful about what this is not. Not reverse ETL, where the vendor pulls from the warehouse. Not a zero-copy read, where the vendor queries in place but the logic still executes on its own infrastructure. This is the whole application executing inside a boundary the customer already owns.
That is where the commercial force is. Data residency stops being a contract clause and becomes a Snowflake region you already chose. Egress control stops being a vendor questionnaire and becomes an account policy somebody already wrote. The security conversation collapses into arguments your organisation has already won, which makes it much shorter and, for the vendor, a much shorter sales cycle.
Four days earlier, Monetate acquired Simon AI for explicitly this reason, pairing its personalisation layer with Simon’s warehouse-native composable CDP. Databricks CustomerLake has made the same argument from the other direction since June. This does not settle the composable-versus-packaged debate, which was always more about operating models than architecture. It changes the question you ask a vendor. Not whose CDP, but whose perimeter.
One question I would put to anyone pitching this shape, in writing. When you say the agentic components run inside my account, do you mean all of them? “The data never leaves” and “the data never leaves except when the model is invoked” are different sentences with the same first eight words. I want the network diagram, not the marketing one.
Adobe turned channel coverage into configuration
The third instance shipped on the thirty-first of July with a Limited Availability badge and no fanfare, which is why almost nobody has written about it.
Adobe Journey Optimizer now supports custom outbound channels: any HTTP-based messaging channel, built through a no-code Channel Builder. Adobe’s examples are WeChat, Kakao Talk and Messenger, and the honest translation is whatever regional carrier gateway your business has been quietly bolting on for years.
The capability is unremarkable. What matters is what the channel inherits, and Adobe lists it explicitly: personalisation through the expression editor, content experimentation, preview and proof, out-of-the-box reporting, and consent and governance enforcement. The full native feature set, not a reduced one.
Custom actions worked only inside journeys and had no channel capabilities of their own. I have built that workaround more than once: a custom action firing at a regional messaging API, outside the frequency cap, outside the consent check, outside the reporting model, with a spreadsheet somewhere trying to reconstruct what was sent. It works until an auditor asks how many messages a customer received last week and the truthful answer begins “across which systems”.
Moving that traffic inside the perimeter turns channel coverage from a licensing question into a configuration question, and makes the consent perimeter coextensive with the sending surface. A frequency cap that governs four channels out of six is not a frequency cap. It is a suggestion with good intentions.
That is the third governance surface to move this week, alongside Adobe’s firewall allowlisting for landing pages, MoEngage’s IP allowlisting on its data APIs, and Bloomreach validating authorisation before its experiments editor opens. None are features anyone will demo. All decide whether a platform survives a security review.
Logic runs here, state lives there
Consent state moves into the profile. Customer data state stays in the warehouse. Channel definitions become configuration that inherits the platform’s rules rather than escaping them. In each case the platform gave up custody of something and kept the decision about it. MoEngage does not claim to own your consent record and tells you to set it from wherever your source of truth actually is. Zeotap does not hold your customer data at all. Adobe does not want to be your WeChat gateway, it wants to be the thing that decides whether a WeChat message may be sent to this person right now.
Three vendors, three objects, seven days. Each gave up custody of something and kept the decision about it.
This is the move I described when Adobe took loyalty’s motivation layer and left the points ledger alone last week, and the move the customer engagement platform has been making against the email service provider for a decade. What is new is the speed.
If you are running a platform selection this half, this changes the scorecard. “Where does the data live” has been the first question in every CDP evaluation I have run for fifteen years, and it is becoming a question with a boring answer. The ones that discriminate now: which states does this platform hold, which does it defer to me on, what happens when the two sides disagree, and which of my rules does it enforce on surfaces it did not build?
That last one is the test I would apply to every governance claim from here on. Not what the platform can do, but what it will refuse to do on your behalf, on a channel you added yourself, to a recipient who said no.
Twelve weeks
The Italian deadline is genuine work and it is not primarily legal work, so here is the plan. Read the CNIL question-and-answer document first, then:
- Inventory the triggers. Every journey, campaign and segment where an open is an entry condition, wait-for-event, split criterion or recency filter. That list is longer than anyone expects and will not be in one place.
- Decide the fallback for each. Some to clicks, some to site behaviour, some to a time-based path, and some should not run in France and Italy at all. The wrong answer is to leave it and hope.
- Decide where consent lives. If the answer is “in the ESP”, say so deliberately. If it is the CDP, it needs a schema, an ingestion path, an export path and a retention rule before October.
- Instrument coverage. Consent coverage by market has to become a reported number, or your open-rate trend after October is uninterpretable.
- Check the models. Anything trained on open events needs a consent-coverage feature or a market exclusion. A propensity model never told about this will not tell you it is confused. It will just be confident and mistaken.
- Fix the country attribute, or decide what happens without it. The enforcement is only as good as the data behind it.
Twelve weeks is enough time for all of that. It is not enough time to start it in October.
Also this week
- ADA acquired Algonomy, folding retail personalisation into its growth platform. The same consolidation, on the experience side rather than the custody side.
- Bloomreach shipped release 1.315, including the authorisation validation mentioned above.
- Treasure AI published its August release note, worth a scan if the warehouse-native question is live for you.
Back to the Italian retailer
The journey I opened with will not break on the thirtieth of October. That is the whole problem. Systems that fail loudly get fixed in an afternoon. Systems that fail silently get found in a quarterly review by someone who was not in the room when the decision was made.
This week’s three items belong together because all of them shift where a thing is kept without changing where it is used, which is exactly the class of change that produces silent failure. A consent flag in a different system, a profile in a different perimeter, a channel defined outside the tool that enforces the rules. Every one works perfectly until two components hold different beliefs about the same customer and neither is designed to notice.
The architecture question is no longer where your data sits. It is which system is allowed to be wrong about it without anyone finding out.
Sources
CNIL, the French recommendation
- Délibération n° 2026-042 du 12 mars 2026 portant adoption d’une recommandation relative aux pixels de suivi dans les courriers électroniques
- Pixels de suivi dans les courriers électroniques: la CNIL publie ses recommandations
- Questions-réponses sur la recommandation relative aux pixels dans les courriers électroniques
Garante, the Italian guidelines
- Provvedimento del 17 aprile 2026, Linee guida in materia di utilizzo di tracking pixel nelle comunicazioni di posta elettronica
- Comunicato stampa, consenso obbligatorio e sei mesi per l’adeguamento
MoEngage open-tracking consent management
Zeotap on Snowflake
- Zeotap launches end-to-end Composable CDP Native App on Snowflake Marketplace
- The Zeotap Composable CDP is live on the Snowflake Marketplace
Adobe custom outbound channels
Other vendor releases this week
Acquisitions
Industry coverage
The digest behind each weekly article is produced through a structured AI-assisted scan of official release notes and product update sources. I review the output, verify the relevant signals and write the architectural interpretation.
This article draws from the Martech Weekly Digest scans run on August 6, 2026, covering release notes and product updates across several CEP platforms and vendors. The dated record behind it is in MarTech Watch, Week 32.
If you find errors or gaps in coverage, I want to know. The process improves when the output is challenged.
