What it does

Covers how to configure the Tracking consent purpose so open tracking, link tracking, UTM parameters, form prefill and web interaction recording only happen for recipients who have opted in. Microsoft frames this as general information, not legal advice.

Key facts

• Set the Tracking purpose to the Restrictive enforcement model where law or policy warrants it. Nothing is tracked unless the recipient explicitly opts in.
• For region-specific behaviour, create a new compliance profile for the chosen countries or regions without Use previously captured consent. With that option on, the new profile shares the source profile's tracking purpose and an enforcement change applies globally.
• You decide global versus regional at creation. A tracking purpose can't be linked to another profile later, and there's no standard way to unlink it. Because the profile is selected per message and per form, regional separation means regional messages and forms.
• Tracking consent controls email open tracking, link click tracking, UTM parameters and form prefill. Under Restrictive, website interactions aren't recorded unless the visitor accepted your cookie banner and the Tracking purpose.
• Add the purpose to forms and preference centres as its own checkbox, unticked and not bundled with other consents, with a plain-language description.
• Recipients captured before the checkbox existed have no tracking opt-in, so they aren't tracked until they opt in. Review records in the Consent Center, bulk-import where appropriate, or edit a single record from a contact or lead's Communication tab.
• The purpose applies to every channel under the profile: email, SMS, push and custom channels. SMS links are shortened regardless, so a shortened link doesn't prove tracking. Push tracking relies on your mobile app reporting interactions back.
• Consent changes apply to new checks straight away. Form prefill can continue for up to 15 minutes after revocation.
• Expect lower identified opens, clicks, web events, journey triggers, lead scoring and engagement-based segmentation. An interaction after opt-out is recorded without a customer profile reference, and rarely one can still be recorded with a reference shortly after opt-out.

When to use / skip

Use it on any deployment that sends to the EU, UK or other regions with consent-first tracking rules, and wherever your privacy counsel has asked for explicit opt-in.

Skip the Restrictive setting where your counsel confirms it isn't needed, but still use the profile structure so you can tighten it later without a rebuild.

Configuration decisions

• Global or regional enforcement. Settle it before creating profiles, because it can't be reversed cleanly.
• Form and preference centre design. Decide where the Tracking checkbox sits and how it's worded.
• Existing contacts. Choose between a re-permission campaign and accepting reduced tracking until people opt in.
• Channel scope. Confirm the client understands consent covers SMS, push and custom channels too.

Gotchas

• Moving a region from shared to its own tracking purpose later isn't a supported edit. It's a rebuild.
• Engagement-based segments and lead scores will shrink the day you go restrictive. Warn the business before the switch.
• Prefill can outlive a revocation by up to 15 minutes, which matters if someone tests the opt-out live in front of a client.
• A cookie banner alone isn't enough under Restrictive; web tracking needs both the banner and the purpose.

Consultant notes

• Show the sales and marketing leads a before-and-after of expected open and click numbers. The conversation about reduced metrics is easier before go-live than after.
• Test with a seed list of opted-in and opted-out addresses and check the sent message source: no pixel and no tracked links for opt-outs.
• Keep the privacy counsel's sign-off with the compliance profile design. Profiles accumulate and nobody remembers why a region was set up the way it was.
• Rebuild journey triggers that depend on email opens before you restrict tracking, or they will quietly stop firing.

---

Consent behaviour is tied to regulation and product changes — worth revisiting after the next compliance profile update.