Businesses must now comply fully with Italy’s guidance on email tracking pixels, including clearer consent, easier withdrawal and safeguards for data shared with third-party providers.
Italy’s data protection authority has reached the end of the six-month adjustment period it granted businesses to align email marketing practices with its new rules on tracking pixels. The grace period, which ended on 29 October, followed guidelines adopted by the Garante on 17 April 2026 and marks the point at which companies are expected to comply fully with the regime. According to the authority, the measure is intended to strengthen transparency, consent and control over personal data gathered through email tracking. The Italian watchdog’s guidance places the issue at the intersection of online monitoring, marketing consent and the confidentiality of correspondence.
Tracking pixels are tiny, hidden images embedded in emails that can alert the sender when a message has been opened and, in some cases, reveal how often it has been viewed and provide technical details about the device or connection used. For advertisers and other organisations, that information can be useful for measuring campaign performance, improving delivery rates and tailoring future messages. The Garante argues, however, that the very invisibility of the technology makes it difficult for recipients to understand when they are being tracked and what exactly they have agreed to.
One of the central points in the guidelines is the way consent should be obtained. In many cases, organisations have folded pixel notices into website cookie banners and relied on consent management platforms to capture approval. The authority says that approach may not be sufficiently clear, because a choice made while browsing a website does not necessarily make it obvious to the user that the same consent extends to email communications. It therefore recommends collecting consent alongside the request to receive promotional emails, while recognising that the two permissions can sometimes be gathered together when the purposes are closely connected. The Garante also warns against repeated and fragmented consent requests, noting the risk of so-called consent fatigue.
The authority draws an important distinction between tracking that requires prior consent and pixel use that may fall within exempt, service-related or security-related purposes. It says anonymous or aggregated statistics on opens may be acceptable where they are used to improve deliverability or reduce spam without identifying individual recipients. Similar treatment may apply to pixels used for authentication or other security functions, as well as to messages that must be sent for legal reasons. Even so, the guidelines leave open difficult questions, particularly where a supposedly technical purpose also involves data linked to named recipients rather than anonymous reporting.
The rules become more complex when the same pixel serves several purposes at once, such as statistics, service improvement and personalisation. That is where the six-month transition period mattered, because it gave businesses time to map their data flows and coordinate marketing, legal, privacy and IT teams. It also forced operators to think about revocation in practical terms. The Garante wants recipients to be able to withdraw consent without unnecessary friction, including through a dedicated button or link in the footer of the email. It also expects that choice to be respected across the whole processing chain, including third-party suppliers that place or manage the pixel on behalf of the sender. In that respect, the authority’s approach resembles guidance issued in France by the CNIL, which has also examined how to separate different uses of email tracking and how to manage user preferences.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
