In late October 2026, Italian banks, phone carriers and online platforms sent emails about "tracking pixels". The reason is a decision by the Garante, Italy's data protection authority, and the deadline to comply ran out on 29 October 2026. Almost none of those emails explain what the people who send email should do: a company with a newsletter, a CRM or business software that writes to customers.
Here is the practical version, without the jargon. At the end there is a checklist to go through with your own sending tool.
What an email pixel is
It is a tiny image, usually invisible, placed inside the email. When the recipient opens the message, their mail program downloads that image from the sender's server. At that moment the server learns that the email was opened, when, and often from which IP address and with which program or device.
If every recipient gets a different pixel, the sender knows who opened, how many times and at what time. That is how open-rate statistics work in almost every newsletter tool. For many businesses it is just a number in the dashboard, and nobody ever decided to switch it on.
What the Garante decided
On 17 April 2026 the Garante adopted its guidelines on the use of tracking pixels in email communications (doc. web no. 10241943, in Italian), published in the Italian Official Journal, General Series no. 98, on 29 April 2026. The deadline to comply was six months from publication: 29 October 2026. The Garante also has a summary page on the topic.
The legal basis is Article 122 of the Italian Privacy Code, the same rule that covers cookies (Article 5(3) of the ePrivacy Directive). The Garante also refers to the European Data Protection Board guidelines 2/2023. The principle is simple: reading or storing information on a person's device requires their consent, with a few exceptions. Without consent and without an exception, the pixel cannot be used.
The rules apply to whoever sends the emails, and also to sending platforms and email service providers.
What is allowed without consent
- Counting opens anonymously and in total. Knowing how many emails in a campaign were opened overall, to check whether they land in the inbox or in spam. The pixel must be the same for the whole campaign, and the IP address and mail client must be anonymised. In practice: one number, not a list of people.
- Security tied to authentication. Account activation emails, password changes, replies to requests about privacy rights.
- Mandatory service communications. Contract changes, data breach notices, phishing warnings, deadlines.
What needs consent
Measuring opens for each individual recipient to improve promotional campaigns, to decide how often to write to them, or to build a profile of them. In other words, the most common use of open statistics in commercial newsletters.
A privacy notice is always required
This is the point many people miss. Any email that contains a pixel, including the ones allowed without consent, needs a privacy notice. It can be layered and it can also sit in the cookie policy. For mailings already under way, it is enough to give it in the first suitable message.
Consent for marketing
For promotional emails, consent to the pixel can be part of the single marketing consent, as long as it is asked in a neutral way. But it must be possible to withdraw it on its own: every email needs a link or icon in the footer that leads to the recipient's preferences. People who refuse the pixel must not be penalised, for example they cannot lose the newsletter. And the choices must be recorded, so you can prove them.
There is also a technical requirement: the pixel address must contain an identifier that is not readable and not sequential, never the recipient's email address.
The grey area: tracked links
Besides the pixel, many tools rewrite every link in the email so it goes through their server first, which tells them who clicked what. The guidelines do not deal with click tracking explicitly. The mechanism is similar, though: an identifier per recipient that tells the sender what that person did. My own cautious view is to treat it with the same criteria as the pixel until there is more guidance. That is an opinion, not something the text says.
The checklist
You do not need to know how to code. You need the dashboard of your sending tool, or half an hour with whoever runs it.
- Find out whether open tracking is on. In many tools it is a dashboard setting, sometimes in the options of each campaign, sometimes on by default. Check your CRM and business software too: if they send emails with open statistics, they use a pixel. If you cannot find the setting, ask the supplier in writing.
- If you do not need it, switch it off. If you only look at the total number of opens, ask whether the tool can give it to you in anonymous, aggregate form, or do without it. It is the simplest route.
- If you need it for marketing, sort out consent. Consent asked in a neutral way, a notice that explains the pixel, a footer link in every email to change one's mind, no penalty for saying no, recorded choices. And check that the tool can exclude people who did not consent from tracking.
- Transactional and service emails: privacy notice. Order confirmations, reminders, invoices, password recovery. Even when the pixel is allowed without consent, the notice is required. Also ask yourself whether you really need the pixel in those emails.
- Check tracked links. Look at a link in one of your emails: if it points to the sending tool's domain instead of your website, clicks are being tracked. Decide whether to keep it and on what basis.
- Update your privacy notice and your record of processing. The notice must say that you use the pixel, for what and on which basis. The record must list the processing, along with the sending platform provider. If a supplier adds the pixel, also check what your contract with them says.
If your tool builds the pixel address with the recipient's email inside it, pass that on to the supplier straight away: the guidelines ask for an identifier that means nothing to whoever reads it.
Why it is worth doing
It is not only about the rules. Per-recipient open statistics are already unreliable: several mail programs download images in advance or block them. Quite often you find out you were collecting personal data for a number nobody used to decide anything.
I wrote about something similar, checking what the software you use actually does, in the post on updates that quietly change your software. If you send newsletters or customer emails from your business software and want to understand what it tracks and what is worth changing, we can look at it together on a free 30-minute call.
This post is a practical reading of the guidelines, not legal advice. For unclear cases, talk to your privacy advisor or DPO.
Originally published at gabrielepieretti.dev. I write about software for small businesses, Laravel, FastAPI and privacy-by-design. More here.
Top comments (0)