Italy requires consent for individual open tracking from 29 October 2026
The Garante published binding guidelines treating tracking pixels under Art. 122 of the Codice Privacy. Measuring opens per recipient requires prior, free, specific and informed consent. Only aggregate statistical counting escapes it, and a recipient who withdraws tracking consent must keep receiving your email without the pixel.
Who this applies to
Anyone emailing recipients in Italy. Compliance is due six months after publication in the Gazzetta Ufficiale, which lands on 29 October 2026.
What to do
- Separate the tracking choice from the subscription choice, and let people revoke tracking alone.
- Build a pixel-free send path now. This is the part most ESP setups cannot do today.
- If you rely on the aggregate exemption, use one undifferentiated pixel across all recipients and do not tie opens back to individuals.
- Generate any tracking identifier as unintelligible and non-sequential.
What is exempt
Purely statistical aggregate counting that measures the global percentage of opens, plus security and authentication flows, and mandatory institutional communications such as fraud notices, contract changes and breach notifications.
What happens if you do not
Not yet enforced, because the deadline has not arrived. Worth noting that the Garante fined Poste Italiane and PostePay a combined 12,501,000 euros in April 2026 for unlawful device tracking under the same Art. 122 hook, so the provision is one the authority actively uses.
Source
- Garante per la protezione dei dati personali, provvedimento n. 284 del 17 aprile 2026, Linee guida in materia di utilizzo di tracking pixelPublished 29 Apr 2026Read it
Related
History of this page
- Added after publication in the Gazzetta Ufficiale.