Share This Article
The new tracking pixel rules adopted by the Italian data protection authority become binding on 29 October 2026, requiring prior consent for the invisible images that report when a marketing email is opened, and companies that have not rebuilt their consent, withdrawal and identifier design by that date will be exposed to an authority that can verify the breach from outside the company, simply by receiving one of their emails.
The Guidelines were adopted on 17 April 2026 and published in the Official Gazette at the end of that month, which opened a six-month transition that expires on 29 October, and the authority confirmed in its newsletter of 8 October that compliance checks are planned for the second half of this year, so the end of the transition and the beginning of supervision are arriving together rather than one comfortably after the other. The French data protection authority, the CNIL, moved first, with a recommendation adopted on 12 March 2026 that has already been applicable since the middle of June, and the comparison between the two approaches, which was analysed in detail in our earlier article on the Italian Guidelines and the French recommendation, matters commercially because a company sending into both markets is now exposed in both, under two regimes that do not overlap perfectly.
Why these tracking pixel rules are easier to enforce than almost any other privacy obligation
The point that most businesses have not understood is evidentiary rather than legal. In an ordinary investigation the authority has to ask for documents, inspect systems and reconstruct what happened internally, which is slow and contestable, whereas here the entire violation is visible in the message itself, because anyone who subscribes to a newsletter can open the source of the email and read the address from which the pixel is loaded, see whether a recipient identifier travels in clear, check whether the footer offers a way to stop tracking, and compare all of that against the consent that was actually collected at sign-up. A single complaint from one recipient, or one subscription taken by the authority itself, produces a complete file without anyone setting foot in the company, and in my experience an investigation that begins with the evidence already in the regulator’s hands develops very differently from one that begins with a request for information.
The three tracking pixel rules that will decide an inspection
Three requirements separate a defensible position from an indefensible one, and the first two are the ones that most email platforms do not support out of the box.
- Separate withdrawal of tracking from unsubscription. The Italian approach requires that a recipient be able to stop being tracked while continuing to receive the emails, through a link or an icon in the footer, which is a function that standard marketing platforms were simply not built to provide, since their unsubscribe flow removes the person from the list altogether.
- Identifiers that do not carry the email address. The authority expects a non-sequential and unintelligible identifier assigned to each recipient and kept separate from the address, so that the address itself is never transmitted when the pixel is requested, and this is precisely where most implementations fail, because the address or a simple hash of it is commonly embedded in the pixel URL and is therefore visible to anyone inspecting the message.
- Consent that actually covers the tracking. Silence, inactivity and pre-ticked boxes do not work, and while the Italian approach does allow tracking consent to be bundled with general marketing consent in order to avoid consent fatigue, that concession only helps a company that can show what the subscriber was told at the moment of collection.
Three narrow exemptions remain available, covering aggregated and genuinely anonymous open-rate statistics, measures strictly necessary for authentication and security, and mandatory institutional or service communications, and each of them is narrower in practice than it sounds, particularly the first, because an open rate computed from individual records that remain linkable to a person is not an anonymous statistic merely because it is displayed as a percentage.
Where the French approach makes the Italian tracking pixel rules harder to live with
A company sending into both markets cannot simply pick the friendlier regime, and the two diverge in ways that pull in opposite directions, since the French authority permits individual open-rate measurement for deliverability purposes under strict conditions, retaining only the date of last opening, which Italy does not frame in the same way, while it is stricter on the granularity of consent, requiring separate consents for purposes that are not closely connected, where the Italian approach tolerates bundling. The practical conclusion for a multi-country sender is to build to the stricter requirement on each individual point rather than to adopt one regime wholesale, which costs more to design once and considerably less to defend later.
What to do in the sixteen days that remain
Full compliance by 29 October is unrealistic for the organisations that did not tackle the issue in advance, and the useful question is therefore not how to finish but how to be defensible on the day supervision starts.
- Open one of your own marketing emails today and read the pixel URL, because if the email address or an obvious hash of it is in there, that is the first thing an investigator will see and the first thing to fix.
- Add the tracking withdrawal link to the footer, even as an interim mechanism that suppresses tracking for that recipient, since its absence is visible from outside and its presence is not.
- Re-read the consent text actually shown at sign-up, and record what it said, because the defence of a legacy database depends on evidence of what subscribers were told rather than on what the privacy notice says today.
- Fix the contracts with the platform and the tracking provider, which is the slowest item on the list and the one most often discovered last, since the roles of controller, processor and joint controller have to be allocated before anyone can explain who answers for what.
- Write down what is not finished and why, with dates, because a documented remediation plan in progress is treated very differently from an organisation that discovers the problem when the questions arrive.
Companies that treat the 29 October date as a marketing operations deadline will meet it on paper and fail it in the message, and the message is the only place anybody will look.