This website uses cookies

Read our Privacy policy and Terms of use for more information.

Italy's Email Tracking-Pixel Rules Bite on 29 October

The Italian Garante's guidelines on tracking pixels in emails (adopted 17 April 2026) become enforceable on 29 October 2026 — 16 days out. Individual-level open-tracking now needs prior consent, and every pixel needs advance disclosure. Some advisers cite 28 October; confirm against the Garante's provvedimento.

Why It Matters

The Garante treats an email tracking pixel as access to information on the recipient's device, so Article 122 of the Italian Privacy Code (the ePrivacy rule) applies. Pixels used for individual-level open-tracking — to optimise campaigns, adjust content or frequency, or build commercial profiles — need prior consent. Disclosure in advance is required for every pixel, whatever the purpose or sender; a layered notice is acceptable.

Not everything needs consent. Aggregate, anonymised open-rate counting with identical non-individualised pixels, authentication-security measures, and mandatory service messages (phishing alerts, contractual changes, breach notices, deadline reminders) are exempt. Consent can sit inside one neutral promotional consent, but withdrawal must be easy and granular, and refusing tracking must not degrade the service.

This reaches any organisation, and its email-service providers, sending to recipients in Italy. It is also the first time most marketing teams will have to separate their email streams into 'consent-required' and 'exempt'.

Action Items

  1. Inventory your pixels — list every email stream that reaches Italian recipients and whether it tracks opens per individual or in aggregate. Do this before 29 October.

  2. Add advance disclosure — put a clear (layered) pixel notice in your privacy information and email templates for Italian recipients.

  3. Build granular withdrawal — a footer link or icon that lets people revoke pixel tracking alone, or all consent, without losing the service.

Also Today

EU Digital Omnibus: Council still has no mandate. Coreper met on 7 October without a vote, and no agreed position had been reported as of 13 October. The latest Council text (doc 13886/26, 2 October) would cut the cookie re-prompt wait after a refusal from six months to four and leaves out the browser-level consent signal (Art. 88b). Nothing is adopted — stage options, don't re-engineer cookie flows yet.

EDPB fining guidelines open for comment until 13 November. Guidelines 04/2026 set a five-step methodology for choosing between fines and other corrective powers. If your fine-exposure models rest on national practice, review the draft and consider commenting.

Get the full analysis. Pro subscribers receive the complete deep dive, all 5 action items, source documents, and jurisdiction-specific compliance checklists.

logo

Subscribe to Pro to read the rest.

Become a paying subscriber of Pro to get access to this post and other subscriber-only content.

Upgrade

A subscription gets you:

  • Deep dives of each updated regulation
  • Source verification documents
  • Extended jurisdiction-specific analysis
  • Compliance deadline tracker
  • Regulation crosswalk