Italy's tracking-pixel rules for email take effect after the Garante's six-month grace period

Italy's data protection authority, the Garante per la protezione dei dati personali, adopted guidelines on tracking pixels in email on April 17, 2026 (provvedimento n. 284). They were published in the Gazzetta Ufficiale on April 29, 2026, and gave senders six months from publication to comply, a period that ran to about October 29, 2026. The guidelines apply to every public and private organization that uses tracking pixels in email.

The starting point: pixels read the recipient's device

The Garante treats the pixel request that fires when a message is opened as storing and reading information on the recipient's terminal. That brings it under Article 122 of the Italian Privacy Code, which implements the ePrivacy Directive. The general rule is that this needs consent, unless an exemption applies.

When a pixel needs consent

Consent is required for individual open tracking used to evaluate or improve campaigns. The guidelines give examples: changing subject lines after low open rates, adjusting send frequency, stopping sends to recipients who do not open, and building commercial profiles from reading behaviour. Consent can be collected together with consent to promotional email, as long as the request is neutral and not coercive. Each choice must be recorded.

When it does not

The guidelines list three cases where the consent exemption is available:

• Aggregate statistics: measuring a campaign's overall open rate, which the Garante says can be used, for example, to improve deliverability or fight spam. The pixel should be the same for every recipient of a campaign, and technical data such as IP address and mail client should be anonymised.
• Authentication and security: messages such as account activation or password changes.
• Mandatory or service messages: for example fraud warnings, changes to contract terms and security incident notices.

Two ways to opt out

Recipients must be able to either stop all messages or stop only the tracking and keep receiving email without pixels. Refusing tracking cannot limit access to the service. For lists built before the guidelines, senders must give the new information at the first useful send and then offer this granular opt-out.

What this means for deliverability work

This section is our analysis, not legal advice. Many senders decide whom to stop mailing based on opens. For Italian recipients without tracking consent, that per-person signal is no longer available, and the Garante names stopping sends to non-openers as an example that needs consent. List hygiene for that audience will have to lean on signals other than individual opens, such as replies, hard bounces and complaint data. The guidelines address pixels only, so check how your other tracking is handled before you rely on it. A clear unsubscribe path and low complaints still drive sender reputation at the mailbox providers.