# WooCommerce Order Emails: The Pixels That Fire After Checkout Consent

Source: https://consentpaladin.com/blog/2026-11-14-woocommerce-order-emails-pixels-after-consent.html

*A shopper buys from your WooCommerce store, declines marketing at checkout, and then opens the order confirmation email. A tracking pixel fires, the open is logged, and the marketing platform knows they opened it. The shopper declined marketing. The email tracked them anyway.*

## The email is a page you do not control

A WooCommerce order email is an HTML email, and HTML emails contain images, links, and tracking pixels. When the shopper opens the email, their mail client loads the images, and each load is a request to a server: yours, or your email platform's, or a third party's. That request carries the shopper's IP address and a unique identifier, and it is logged as an open. The shopper did not click anything. Opening the email was enough.

The problem is that the order email goes to every shopper, including the ones who declined marketing consent at checkout. The order confirmation is a transactional email, and it does not need marketing consent to be sent. But the tracking pixel inside it is marketing measurement, and it fires regardless of what the shopper chose. The consent decision at checkout covered the store. It did not cover the email, because the email was never part of the consent flow.

This is the same defect as the embedded video that phones home before play, and the same defect as the live chat script that loads before the banner is answered. The mechanism is different, but the shape is identical: data leaves before consent, or after a refusal, because the thing doing the collecting was never wired into the consent decision.

## What is actually in the email

WooCommerce order emails contain several things that phone home. The tracking pixel, usually a one-pixel image from the email platform, logs the open. The product images, if they are hosted on a CDN or a third-party server, log a request when they load. The links, if they are wrapped in click tracking, log the click and redirect through the tracking domain. And any embedded content, such as a review request or a social feed, loads from a third party when the email opens.

The fix is to strip the email down to what the order needs. Use plain product images hosted on your own domain, or no images at all in the transactional emails. Remove the tracking pixel from order confirmations and shipping notifications, and keep it only in marketing emails that go to shoppers who consented. Replace click-tracked links with direct links in transactional emails. The order email should confirm the order. It should not also be a measurement instrument.

The WordPress Consent API is the right place to wire this. The API lets plugins check the consent state for a category, such as marketing, before doing something that needs consent. A WooCommerce email customisation that checks the marketing consent state before adding a tracking pixel is a small change, and it is the change that makes the consent decision at checkout mean something in the inbox too. [The WP Consent API at checkout is the same integration point](2026-11-13-wordpress-wp-consent-api-woocommerce-checkout.md): the checkout records the choice, and the email has to respect it.

## The audit to run this week

Open your own order confirmation email in a mail client with images enabled, and watch the network requests. Every request to a domain that is not your own is a third party learning that this shopper opened this email. Then check whether the pixel fires for a test shopper who declined marketing at checkout. If it does, the email is tracking a refusal.

And check the review request emails too, because they are the ones most likely to contain third-party content. [The banner A/B test is the same trade-off at a different scale](2026-11-12-consent-banner-ab-test-reject-button.md): a test that optimises the banner without respecting the choice behind it is a test that optimises the wrong thing. [The consent log is what proves the choice was respected](2026-11-11-wordpress-consent-logs-visitor-changes-mind.md), and a pixel that fires after a refusal is a log entry that contradicts itself.

## Frequently asked questions

### Do transactional order emails need marketing consent?

No, the email itself does not need marketing consent to be sent. But the tracking pixel inside it is marketing measurement, and it should not fire for shoppers who declined marketing consent. Send the email, strip the tracking.

### What in a WooCommerce order email phones home?

The tracking pixel logs the open, product images hosted on a CDN or third party log a request when they load, click-tracked links log the click through a tracking domain, and any embedded third-party content loads when the email opens. Each one is a request the shopper did not agree to.

### How do I fix the tracking pixel in order emails?

Remove it from transactional emails like order confirmations and shipping notifications, and keep it only in marketing emails that go to shoppers who consented. Use the WordPress Consent API to check the marketing consent state before adding tracking to any email.

### Does the consent choice at checkout cover the emails?

Only if the email system checks it. The checkout records the choice, but WooCommerce order emails do not automatically respect it. The email templates and the tracking setup have to be wired into the same consent decision, or the pixel fires regardless of what the shopper chose.