As of October 29, 2026, anyone sending emails containing tracking pixels must comply with the Italian Data Protection Authority’s guidelines on personal data protection. This deadline effectively affects the entire Italian email marketing industry, from large companies to professionals managing small newsletters, public bodies, and bulk email platforms. It should be understood neither as another vague warning nor as a ban, but as a specific rule based on a consistent rationale that is worth understanding fully before changing the settings of your email marketing tools.
The Ruling and the Deadline
The guidelines on the use of tracking pixels in email communications were adopted by the Italian Data Protection Authority in Ruling No. 284 of April 17, 2026, subsequently published in the Official Gazette on April 29. They provide for a six-month transition period, granted in recognition of the complexity involved in bringing systems and data processing activities that have been in use for years into compliance. Counting six months from publication brings us to October 29.
This is not merely a formal deadline. The Authority has included compliance checks for these guidelines among its planned inspection activities for the second half of 2026. In early October, it also considered it necessary to draw attention to the issue with a practical guide. Operational guidance remains available on the Authority’s dedicated tracking pixel information page.
What Is a Tracking Pixel, and Why Does the Authority Treat It Like a Cookie?
A tracking pixel is a tiny image, often transparent and just one pixel in size. It is not physically embedded in the email itself, but hosted on a remote server. When the recipient opens the message and their email client downloads images, the pixel loads and sends information back to the sender, including whether the email was opened, when it was opened, which device was used, and, in many cases, the email client and approximate geographic location.
This is the same mechanism behind the open rate that we are all accustomed to seeing in campaign reports. It is enabled by default on almost all email marketing and marketing automation platforms, which is why many companies have been using it for years without ever making a conscious decision to do so.
The Authority’s reasoning starts here and is fairly straightforward: because the pixel is embedded in an email accessed on the user’s device and collects information about their behavior when it loads, its operation constitutes access to the user’s terminal similar to that of a cookie. It therefore falls under Article 122 of the Italian Privacy Code, the provision through which Italy implemented the ePrivacy Directive. This interpretation is consistent with the approach already taken at the European level in the EDPB Guidelines 2/2023 on the technical scope of Article 5(3) of the Directive. This classification determines everything that follows because, just as with cookies, consent becomes the general rule, subject to the exceptions provided by law.
Who Do the Rules Apply To?
The guidelines deliberately have a broad scope. They cover all public and private entities involved in the use of tracking pixels in any capacity, not only those sending communications but also email service providers, operators of bulk messaging platforms, and providers of online services accessible to the public.
The range of messages covered is equally broad. It extends beyond newsletters and direct email marketing campaigns to include automated, transactional, and service-related communications. This means that the nature of a message, whether commercial, informational, institutional, or service-related, affects the applicable legal basis but never removes the obligation to inform the recipient.
Tracking Pixels Are Not Banned: The Two Scenarios Covered by the Guidelines
One of the most widespread misconceptions in recent weeks is that tracking pixels have been banned outright. In reality, the guidelines do not prohibit them. Instead, they distinguish between two substantially different uses of the same tool and establish rules proportionate to the impact each use has on people’s privacy.
Individual Tracking: Consent Is Required
When a pixel is used to understand the behavior of an individual recipient, for example, to profile them, assign them a score in a CRM, or trigger automated workflows based on whether they open a message, prior, freely given, specific, and informed consent is required. This must be accompanied by a privacy notice that clearly explains the presence of the pixel, the type of information collected, and the purposes for which it is used.
The most significant aspect, and probably the one that will change industry practices the most, is that users must be able to disable tracking alone while continuing to receive communications. In other words, the choice can no longer be limited to accepting everything or unsubscribing. Recipients must have the option to receive emails without being tracked, through a setting available in every individual message.
Aggregated and Anonymous Statistics: Consent Is Not Required
The situation is different when the pixel is used exclusively to measure the overall performance of a campaign, using the same pixel for all recipients and generating aggregated data that cannot in any way be traced back to an individual. In this case, consent is not required, although the obligation to be transparent with recipients remains. They must still be informed.
The Myth of Mandatory Double Consent
In the weeks following publication, the idea spread quite widely that signup forms must necessarily contain two separate checkboxes, one for the newsletter and another for the tracking pixel. However, the Authority allows consent to tracking to be included within consent for promotional communications, provided the request is phrased neutrally and the individual is given a genuine opportunity to understand what they are agreeing to. What must never be missing is the ability to withdraw consent for tracking separately.
Why Individual Open Rates Are Less Valuable Than We Think
Beyond the formal obligations, the guidelines raise a broader question about how we measure email marketing effectiveness: how much value is there really in knowing that a particular contact opened a particular email at 9:14 a.m. on a Tuesday?
For a significant number of Italian companies, individual open data ends up in a report and goes no further, without informing any operational decisions. It is also data whose reliability has been compromised for some time. Since Appleintroduced Mail Privacy Protection, images in emails received through the Mail app have been preloaded by Apple’s servers regardless of whether the message is actually read. As a result, a substantial proportion of the opens recorded by email platforms do not correspond to a real read.
The metrics that inform strategic decisions are different: clicks, replies, conversions, and the revenue generated by automated email sequences. This helps explain why, for many businesses, giving up individual open tracking or requesting explicit consent only from those willing to provide it may cost considerably less than expected. In many cases, switching to aggregated tracking can solve much of the problem without losing any genuinely useful information.
The Most Common Compliance Mistakes
The first mistake, as common as it is paradoxical, concerns the email sent to inform contacts that they can now opt out of tracking. That message must be sent without a tracking pixel. Otherwise, the company would be tracking the very people it is informing of their right not to be tracked, turning the first step toward compliance into the first violation.
The second mistake involves communications that nobody remembers are still active. Attention tends to focus almost exclusively on newsletters, while tracking pixels remain embedded in order confirmations, password reset emails, abandoned cart messages, and welcome sequences configured years earlier, perhaps by employees who have since moved into different roles. It is also worth remembering that, as the guidelines themselves emphasize, compliance does not depend on which provider you use, but on the settings actually applied within the platform.
What to Do Before October 29
The starting point is a comprehensive inventory of all outgoing messages containing a tracking pixel. This should cover newsletters, direct email marketing campaigns, automated workflows, transactional messages, and abandoned cart emails. The inventory should be compiled by checking the platform settings directly rather than relying on memory, since open tracking is almost always enabled by default and may never have been consciously disabled.
Once the inventory is complete, determine honestly which data you actually need. If aggregated information is sufficient, switching to anonymous campaign-level tracking may be all that is necessary. If individual-level data feeds processes such as lead scoring or behavioral automation, however, a compliant consent mechanism becomes essential.
Privacy notices and signup forms must also be updated. The privacy notice should disclose the presence of the pixel, the types of data collected, and the purposes of processing. Where consent is required, it must be obtained before the first tracked email is sent, not afterward.
You must then check that your platform allows individual contacts to withdraw consent to tracking without being unsubscribed from communications. Many tools already offer this functionality, but others do not. If yours falls into the latter category, you should contact the provider and request it without further delay.
The final step is to inform your mailing list through a message that contains no tracking pixel, while retaining a copy of the communication and its send date so you can document your compliance if you are audited.
For most companies, compliance will be more a matter of configuration than a complete overhaul of existing processes. Nevertheless, someone needs to open the platform dashboard and carefully check what is happening with every type of outgoing message. With the deadline now just one week away, this is no longer a task worth postponing.
