Source: Garante per la Protezione dei Dati Personali
If your company sends marketing emails or newsletters that track when recipients open them, an Italian deadline has just passed that you cannot afford to ignore. On 29 October 2026, the six month transition period for the Italian data protection authority’s guidelines on email tracking pixels expired, and the rules are now fully in force.
What the Garante requires
Adopted as Provision no. 284 on 17 April 2026 and published in Italy’s Official Gazette on 29 April 2026, the guidelines cover those tiny transparent images embedded in emails to detect opens and collect behavioural information. The Garante classifies them under Article 122 of the Italian Privacy Code, which governs technologies that access information on users’ devices or monitor their online behaviour.
The core obligation is simple to state and demanding to implement: before using a tracking pixel that can identify a recipient, the sender must obtain prior consent that is free, specific and informed. Limited exceptions exist, for example for security purposes, strictly necessary technical needs, or institutional and service communications, always under proportionality and data minimisation principles. Recipients must receive a clear privacy notice and must be able to withdraw consent easily, including selectively, while still receiving the emails themselves. The rules apply to service providers, email platforms and bulk sending services, not only to the brands whose names appear in the inbox.
Enforcement is not theoretical
The Garante has explicitly stated that verifying compliance with the tracking pixel guidelines is part of its inspection programme for the second half of 2026. In other words, checks are already scheduled, and any business emailing Italian customers without consent, notices and withdrawal flows in place is exposed to GDPR style sanctions. This reaches beyond Italy: any company, wherever it is based, that sends tracked email to people in Italy falls under these rules.
There is also a practical deliverability dimension. Platforms that fail to adapt their tracking practices risk complaints, blocked sends and damaged sender reputation, on top of regulatory exposure.
What to do now
Audit every email flow that fires a pixel, separate delivery and security tracking from performance tracking, add granular consent capture to your sign-up forms, update your privacy notices, and implement selective withdrawal. If you are not sure where your email stack stands, a structured review now is far cheaper than an inspection finding later.
Need help making your email marketing compliant with Europe’s privacy rules without losing performance? Contact the team at Excello Digital for professional advice and hands-on support.