The Garante tracking pixel guidelines (provvedimento n. 284) require notice and, mostly, consent for email pixels. The deadline passed on 29 October 2026. The Italian data protection authority adopted the linee guida (guidelines) on 17 April 2026 and published them in the Gazzetta Ufficiale on 29 April, so every sender who uses a pixel in an email should now have notice, consent and withdrawal in place. We read the full Italian text; this guide sets out what it says, what it leaves out, and where vendor summaries go beyond it.
The Garante tracking pixel rules at a glance
| Item | What the provision says |
|---|---|
| Instrument | Provvedimento n. 284 of 17 April 2026, "Linee guida in materia di utilizzo di tracking pixel nelle comunicazioni di posta elettronica" (doc. web n. 10241943) |
| Publication | Gazzetta Ufficiale, Serie Generale n. 98, 29 April 2026. Press release of 21 April 2026 |
| Legal basis | Article 122 of the Italian Privacy Code (the national version of Article 5(3) of the ePrivacy Directive), with the GDPR filling the gaps |
| Default rule | Prior consent, unless a listed exception applies |
| Exceptions | Aggregate, anonymised open-rate statistics; authentication and account security; legally required institutional or service messages |
| Notice | Required before any use, whatever the purpose or the sender |
| Withdrawal | Easy, and possible for tracking only while still receiving emails |
| Deadline | Six months from Gazzetta publication, which is 29 October 2026 |
| Sanctions | Not set out in the text |
Garante tracking pixel deadline: 29 October, not 28 October
The operative sentence says the Garante considers a term of six months from publication in the Gazzetta Ufficiale appropriate for those concerned to comply ("un termine pari a 6 mesi dal momento della loro pubblicazione in Gazzetta Ufficiale"). Publication was on 29 April 2026, in Gazzetta Ufficiale Serie Generale n. 98. Six calendar months from 29 April runs to 29 October 2026.
The provision does not print the end date, so every date you read is somebody's calculation. Italian legal press and several law firms use 29 October. Guides that say 28 October, including some email vendors, appear to have counted differently, and none we read cited a rule for doing so.
What changed after 29 October
As of 2 November 2026 we found nothing that changes the rules or moves the deadline. Here is what we could check:
- No extension. We found no extension, amendment or new Garante statement on the guidelines after the deadline.
- The vademecum. On 5 October 2026 the Garante published a nine-section summary, "Tracking pixel nelle e-mail: le indicazioni del Garante" (doc. web n. 10303688). We read it. It restates the guidelines and adds no new rule. It does not mention a deadline, sanctions or inspections.
- Inspections. Secondary sources, including Agenda Digitale, report that the Garante's inspection plan for August to December 2026 (deliberation n. 584 of 23 July 2026, at least 35 inspections) covers "il tema del tracking pixel". We could not read the plan itself, so treat this as reported, not confirmed. Do not confuse it with the guidelines: n. 584 is the inspection plan, and one outlet that cites "584" for the guidelines has the number wrong.
- Enforcement. We found no reported sanction or inspection result on pixels yet.
The guidelines grew out of inspections the Garante carried out on 6 to 8 October 2025 and 9 to 11 February 2026, at an email provider and a marketing automation platform. Those found pixels in almost all cases.
What counts as a tracking pixel (pixel di tracciamento)
The Garante describes a tracking pixel as an image, often transparent and a single pixel in size, that is not inside the email but hosted on a remote server. When the recipient opens the message, the mail client fetches the image, and the request tells the sender that the email was opened. The request can also reveal the IP address, the type of device, the time of opening and the number of later openings. The vademecum adds that pixels can also monitor deletion, forwarding or archiving of the message.
The Garante makes a legal point that matters for the rest of the text. Putting the pixel in the email counts as storing information on the recipient's device, and reading the result counts as accessing it. That is why Article 122 applies, rather than the GDPR alone. It cites the EDPB's Guidelines 2/2023 on the technical scope of Article 5(3), which we cover below.
It also notes that pixels are usually unique to each recipient, because the request carries identifiers such as a user ID or message ID. That is why a pixel is treated as tracking a person, not just counting an event.
Who has to comply with the Garante tracking pixel guidelines
The guidelines are addressed to every public or private body that takes part in using pixels in email. The text names these roles:
- the sender, who decides to send and can decide to use pixels, even if a vendor runs the technical side
- the email sending platform, usually software as a service, acting on the sender's instructions
- the list rental provider that sends to its own lists for a client
- the supplier of the tracking technology, if it takes part in decisions about the data
- the content creator who builds promotional messages
- the recipient
The Garante tells these parties to work out their own role case by case under the accountability principle in Article 5(2) GDPR, and mentions joint controllership under Article 26 as a possibility. It does not say that every platform is a processor or that every one is a joint controller. The text does not discuss processor contracts under Article 28 at all, so claims about what the guidelines require of processors are interpretation, not text.
The guidelines cover newsletters, direct email marketing (DEM), automated and transactional messages and service emails. Nothing in them limits the rules to consumers. They speak of recipients and users throughout and do not mention business to business email at all, so we would not assume that B2B senders are outside them.
When you need consent and when you do not
Article 122 sets a general ban on this kind of access unless an exception applies, and the guidelines say the burden of choosing the right basis is on the controller. The Garante then gives three situations, introduced as examples where a controller can do without a specific consent.
- Aggregate open-rate statistics. A count of the overall percentage of messages opened, used to improve deliverability and fight spam, is fine if the information is anonymised so that no personal measurement is possible. The Garante suggests one pixel per campaign, identical for every recipient, and anonymising related technical data such as IP address and mail client.
- Authentication and account security. A pixel can confirm that an account activation, password change or data-rights response was opened on a device known to belong to the user.
- Institutional or service messages the sender must legally send. Examples include phishing warnings, security incident notices, contract changes, privacy notices and deadline reminders, where it matters that the recipient actually saw the message.
Everything else needs prior consent. The Garante's own examples are using individual open rates to judge campaign performance, changing subject lines because opens are low, adjusting or stopping sends based on interest, and inferring tastes to build commercial profiles. In practice, per-person open tracking in a marketing programme needs consent, even when the emails themselves are lawful.
Consent mechanics: bundling, timing and withdrawal
For processing that starts after the guidelines, the Garante prefers that consent is collected when the email address is collected, after the person has been informed. It then accepts something that vendor commentary often gets wrong: consent to pixels can, in principle, sit inside the general consent to receive promotional emails. The reason given is to avoid repeated consent requests and consent fatigue. The condition is that the request is neutral and free of pressure.
The recipient must be able to withdraw easily, and the withdrawal can be granular. A person can end all messages, or stop only the tracking and keep receiving emails without pixels. The Garante suggests a standard icon or a footer link leading to a page where these choices are made. Three further rules apply:
- Anyone who refuses tracking must keep full use of the service, with no limitation for that reason alone.
- The sender must record every choice, so that it can prove consent if challenged, with reference to Article 7(1) GDPR.
- Nobody should be nudged toward a decision that is not freely made.
Existing mailing lists
Where emails with pixels are already being sent, the Garante sets a transitional regime. The controller must give notice with the first suitable message, or at the first natural break in the relationship, and must set up and publicise a way to withdraw consent, including selectively. The text calls this a transitional regime for processing already under way, to be phased out as new processing starts under the rule of prior consent.
One point is open. The text does not define the cut-off between existing and new processing beyond referring to the guidelines coming into force. Some vendor guides state that 29 April 2026 is the line. That is a reasonable reading, but it is their reading, not a stated rule, so confirm it with counsel before relying on it.
What the notice must cover
Notice is required before any use of a pixel, whatever the purpose of the email and whatever kind of sender it is. The Garante bases this on fairness and transparency under Article 5(1)(a) GDPR and Articles 12 and following, and says that without adequate notice the processing cannot be used (the Italian text says "pena la loro inutilizzabilità", which means that unlawfully processed data becomes unusable).
The text asks for notice that is complete, clear and effective, and it does not give a list of fields. The vademecum puts the minimum this way: the person must be able to understand that tracking tools are used in the emails and for what purposes. Sensible additional content is who receives the data and how to refuse or withdraw. The notice can be layered, with a short statement on the email collection form linking to a fuller version, which can sit inside the cookie policy. It can also be delivered through video, pop-ups, voice interaction, chatbots or the telephone. The controller picks the method and has to be able to show it works.
Privacy by design: opaque identifiers
Under Article 25 GDPR, the Garante suggests that the sender generate an unintelligible, non-sequential identifier for each recipient and keep the link to the email address in a separate internal layer of the platform. Pixel requests then carry the identifier, not the address, which reduces the exposure of the address in transit. This is a suggestion, introduced as an appropriate measure, not a hard requirement, but it is the kind of design choice an inspector will probably ask about.
What the linee guida do not cover
Several questions that readers ask are not answered in the text. Treat any firm statement from a third party on these as that party's opinion.
- Link tracking and click tracking. The Garante's text is about pixels. It does not address tracked links or click redirects. The EDPB's Guidelines 2/2023 do: paragraphs 49 to 51 say tracking links work the same way as pixels, with the identifier appended to the address, and that Article 5(3) can apply to both. Expecting Italy to treat click tracking the same way is sensible, but the Garante has not said so here.
- Apple Mail Privacy Protection and other proxies. The text does not mention them. Its only remark on the mail client is that if a user turns off image loading or reads in plain text, the pixel is not downloaded, and that this blocks all images, not only tracking ones, so it is no answer to the legal problem.
- Business to business email. Not addressed, as above.
- Retention periods and DPIAs. The text sets no retention period and does not mention a data protection impact assessment. General GDPR duties still apply, so decide a retention period and consider whether a DPIA is needed for any profiling you do.
- Sanctions. The provision gives no figures. Fines for breaches of Article 122 are set elsewhere in Italian law, and we have not verified the applicable amounts, so we do not quote any. Some commentary quotes the top GDPR tier of EUR 20 million or 4 percent of turnover; we could not confirm that for this provision.
- Soft spam. The guidelines mention the Article 130(4) exception in passing, when describing recipients whose address was obtained during a sale. That exception concerns whether you may send marketing emails to existing customers without consent. The Garante does not say that it also removes the need for consent to pixels, and it does not analyse the point. Do not assume it does.
How the Garante tracking pixel rules compare with the EDPB and the CNIL
EDPB. The Garante builds on the EDPB's Guidelines 2/2023 (version 2.0, adopted 7 October 2024). The EDPB says a tracking pixel in an email is stored on the device, at least through caching, and that collecting its identifier is "gaining of access" under Article 5(3) of the ePrivacy Directive. It also warns that this does not mean consent is always needed, because exemptions have to be assessed case by case. The Garante's text is, in effect, the exemption analysis for email.
CNIL. France's regulator adopted its own recommendation on email pixels as deliberation n. 2026-042 of 12 March 2026 and published the final version on 14 April 2026, based on Article 82 of the French act. Its page gives existing addresses a three-month period to be informed, and describes narrow exemptions for deliverability measurement and for transactional emails. The two authorities agree on the main point, which is that email pixels fall under the cookie-style rules. The details differ, including how long existing lists get and how the deliverability exemption is drawn, so a sender with recipients in both countries should read both texts. For the French rules in more detail, see our guide to email tracking pixels and GDPR compliance.
For wider background, our pieces on Italian cookie guidelines and on why the ePrivacy Regulation was withdrawn explain why Article 5(3) and its national versions, not a new regulation, still govern tracking in 2026. The EU's Digital Omnibus proposal on cookie consent may change this in the longer term.
Compliance checklist
▢ List every email stream that carries a pixel, including transactional, service and automated ones, and the vendor behind each
▢ Record, for each stream, the purpose of the pixel and which exception or consent you rely on
▢ Switch off per-person open tracking for any recipient without valid consent, unless a listed exception clearly applies
▢ Use campaign-level pixels and anonymised technical data for aggregate deliverability statistics
▢ Add pixel tracking to your privacy notice, in a short layered form where you collect addresses
▢ Send existing contacts the notice with your next suitable message
▢ Ask for consent in neutral wording when collecting new addresses, and keep it separate from service access
▢ Add a footer link or icon for withdrawing from tracking only, as well as from all emails
▢ Log each choice with date, wording version and source, so you can prove it
▢ Replace email addresses and sequential IDs in pixel URLs with opaque identifiers, mapped in a separate layer
▢ Check your sending platform contract and settings, and settle each party's role in writing
▢ Decide a retention period for open data and review whether a DPIA is needed for profiling
▢ Keep a short file of the reasoning for each exception, ready for an inspection
For the consent record and withdrawal workflow, our GDPR consent management guide covers the general mechanics, and the guide to automating privacy impact assessments helps with the DPIA question. If you also send cold outreach, remember that the pixel rules sit on top of the marketing consent rules, which our guide to GDPR compliant cold email covers.
This is general information, not legal advice. The primary sources are the Garante's tracking pixel page, the full text of the provision and the 5 October 2026 vademecum.
FAQ
What is the Garante tracking pixel deadline?
The six-month period ended on 29 October 2026. The provision says six months from publication in the Gazzetta Ufficiale, and publication was on 29 April 2026. The text does not print the end date, so 29 October is a calculation, and guides giving 28 October appear to have counted differently.
Do email tracking pixels always need consent in Italy?
No, but in most marketing uses they do. The Garante allows exceptions for aggregate anonymised open-rate statistics, authentication and account security, and legally required service or institutional messages. Individual open tracking, campaign adjustment and profiling need prior consent.
Can I bundle consent for pixels into my newsletter consent?
In principle, yes. The Garante accepts a single consent covering both promotional emails and tracking, provided the request is neutral and not coercive, and provided the person can later withdraw from tracking alone.
Do the guidelines apply to click tracking and Apple Mail Privacy Protection?
The Garante's text covers pixels only and does not mention link tracking or Apple Mail Privacy Protection. The EDPB's Guidelines 2/2023 say tracking links are treated like pixels under Article 5(3), so it is prudent to treat tracked links the same way until the Garante says otherwise.
Do the guidelines apply to business to business email?
The text does not distinguish between consumers and businesses and does not mention B2B senders. It addresses recipients and users generally, so assume that B2B email with pixels is covered, and ask Italian counsel if you rely on a distinction.
What must the notice about pixels say?
It must be given before use, whatever the purpose or sender, and be complete, clear and easy to access. The text does not fix a wording. At a minimum, say that pixels are used, why, and how to refuse. It may be layered, and may be delivered by several channels.
Has anything changed since the deadline, and is there a fine?
We found no extension or amendment as of 2 November 2026. The guidelines set no fine. Secondary sources report that the Garante's inspection plan for August to December 2026 includes pixels, but we could not read the plan and have found no reported sanction yet.
