Italy's New Tracking Pixel Rules: What Email Marketers Need to Know

On April 17, 2026, Italy's Data Protection Authority — the Garante — issued Provision No. 284, a binding set of guidelines on the use of tracking pixels in email. If you send marketing email to anyone in Italy, you have six months from publication in the Official Gazette to comply. The rules are stricter than they look at first glance, but they are not the death of email analytics — and the line the Garante draws is more reasonable than the headlines suggest.

What is a tracking pixel?

A tracking pixel is a tiny, invisible image — typically a 1x1 transparent GIF — embedded in an email. When the recipient opens the message, their client requests the image from the sender's server. That request reveals whether the email was opened, the recipient's IP address, the device and client they used, the time of the open, and how many times they reopened the message.

Almost every commercial email platform uses them. They power open-rate reporting, deliverability monitoring, send-time optimization, frequency capping, and most of the personalization signals marketers rely on day to day.

What the Garante actually said

The Garante grounds its position in Article 122 of Italy's Privacy Code, which transposes the EU's e-Privacy Directive. That law treats access to a user's terminal — including the silent retrieval of a tracking pixel — as something that requires either consent, technical necessity, or a service explicitly requested by the user. The provision itself is published on the Garante's website.

The headline takeaway: transparency is now a hard requirement, regardless of why you are tracking. Recipients must be informed in advance. That can happen in a privacy notice, a pop-up, an onboarding flow, or even the next available message in an existing relationship — but it has to happen.

Beyond transparency, the Garante draws a clear line between two cases.

Consent is not required when:

• You are using standardized, non-individualized pixels to compute aggregate open rates, with IP addresses and other technical data anonymized.
• The pixel is part of a security flow — for example, confirming an account activation or password reset.
• The message is a legally mandated institutional or service communication, such as banking notices, security incident notifications, or regulatory disclosures.

Consent is required when:

• You are tracking opens per recipient to evaluate campaign performance.
• You are adjusting send frequency based on individual behavior.
• You are using opens to profile subscriber preferences or segment audiences.

In other words, the way most marketing automation platforms operate today. The Garante does allow consent for tracking to be bundled with consent to receive promotional communications, provided the request is "neutral and non-coercive." It also requires that withdrawal be granular: a recipient must be able to opt out of tracking while still receiving emails, not just hit unsubscribe.

The case for the Garante's position

There is a real argument that this is good for the industry, not just for recipients.

• Trust compounds. Recipients who know what you measure and choose to stay are higher-quality than the average list contact. Engagement signals from a consented audience are more honest.
• Apple already broke open rates. Apple Mail Privacy Protection has been firing pixels automatically for years, gutting the reliability of individual open data across a large slice of inboxes. Sophisticated marketers have already shifted weight to clicks, conversions, and reply behavior. The Garante is, in a sense, codifying where the industry was already heading.
• Aggregate metrics are still legal. You can keep measuring overall open rate without consent. That is the metric most marketers actually report up the chain.
• Operational email is exempt. Receipts, password resets, and legally required notices are not affected. The rule targets marketing tracking, not the email channel itself.

Where the rule is harder to defend

It is not all upside. There are real costs and real ambiguities.

• "Standardized pixel" is undefined. The exemption for aggregate measurement requires non-individualized pixels. Most email service providers generate per-recipient pixel URLs by default, because that is how you compute who opened what. Re-engineering that is non-trivial, and the Garante has not published a technical reference.
• Six months is short. Mass-mail infrastructure, consent capture, preference centers, and downstream segmentation logic all touch the same wires. Any change ripples.
• It pushes data collection elsewhere. If marketers cannot measure individual opens, expect more aggressive use of click tracking, server-side event capture, and pixel-free behavioral signals. The privacy gain may be smaller than it looks on paper.
• Consent fatigue is already a problem. Bundling pixel consent with promotional consent helps, but the cookie-banner dynamic is not a model anyone wants extended further into the inbox.
• Regulatory inconsistency. Legal commentators have noted that the Garante issued a separate ruling weeks earlier granting former employees broad access to their corporate inboxes — a stance that prioritizes data subject rights in a way that arguably under-weighs the same balance the pixel guidelines try to strike.

What to do now

If you operate a marketing program that touches Italian recipients, whether you are based there or not, here is the short list:

1. Map your email flows. Identify every campaign, every transactional message, every automation, and label which use individual pixel tracking.
2. Update your privacy notice and consent capture. Add a specific, granular option for tracking that is separable from the marketing opt-in. Make sure withdrawal is one click.
3. Talk to your email service provider. Ask whether they support a no-pixel send mode for users who decline tracking, and whether they offer aggregate-only measurement that meets the Garante's anonymization bar.
4. Audit your reporting. Identify every dashboard, segment, and automation that depends on individual open data. Build a fallback that uses clicks, conversions, and explicit responses.
5. Do not wait six months. Mass-mail infrastructure is the slowest thing in your stack to change.

The bottom line

Italy's new rules are a real shift, but they are not the end of email marketing. The aggregate measurement exemption preserves the metric most marketers care about most. The transactional and security exemptions protect the operational backbone of email. And the parts that now require consent — per-recipient open tracking and behavioral profiling — are exactly the parts that have been on a privacy collision course for years.

The right read is not "Italy is hostile to email." It is "the Garante is telling you to do the work everyone else in the EU is going to ask you to do eventually." Marketers who get ahead of this — with cleaner consent flows, better fallback metrics, and a more honest relationship with their lists — will come out stronger. Marketers who wait will spend the next six months doing it under pressure.

DailyStory is built around the kind of consent-aware, integration-driven marketing automation this rule pushes the industry toward. The platform pairs email marketing with SMS marketing and hundreds of native integrations so consent and preferences flow cleanly through your existing systems. To see how granular consent and tracking controls work in practice, the user documentation is the right place to start.