Email Tracking Pixels and More: Key Updates from the Italian Garante

In April 2026, the Italian Data protection Authority (Garante per la protezione dei dati personali) adopted guidelines on the use of tracking pixels in email communications with which data controllers are supposed to be compliant by October 2026 (as we also reported here). Italian companies applying such type of technologies in their email communications need to be aware of the Garante´s rules and comply with them – not only for accountability purposes but also to avoid potential sanctions, due to the fact that the authority’s Q1 inspection plan includes specifically the review of the implementation of the guidelines on email tracking pixels.

In this article, we explain what the guidelines require, when consent is needed, and what companies should do now.

What Is a Tracking Pixel?

A tracking pixel is a very small image (often one pixel) placed in the email and hosted on a remote server, that is usually not visible for the email recipient. This pixel collects very valuable information for the controller, despite its size!

When the email is opened, the pixel “tells” the email sender (or the vendor providing this service) that the email was opened and other recipient related information, having an important meaning for the controller, such as IP address, device, time spent on the email, frequency of the email review. The pixel cannot retrieve information on the content of the email, but on the interactions that the recipient had with it. This has of course significant meaning for data controllers, especially for marketing and analytical purposes.

According to the Garante, pixels as a tracking means are more intrusive than many other tools, because they are not identifiable by the recipient. The use of tracking pixels is naturally subject to a lawfulness review from a privacy perspective. The applicable legal basis depends on the specific purpose of use, which may vary and be regulated differently. Examples of purpose are deliverability checks, anti-spam, audience and performance measurement, and sometimes personalization. 

Legal Background: Data Protection Laws and ePrivacy Directive

In its assessment, the Garante also takes into consideration the principles of the ePrivacy Directive, as pixels are related to IT derived identifiers. From this standpoint, placing the pixel in the email and reading the data it returns is considered as an access to the recipient's device. This is the kind of access that, as a general rule, is prohibited, unless specific conditions apply. One condition is the prior consent of the user. Another exception can be where access is strictly necessary for a service the user asked for. On top of the requirements deriving from the ePrivacy Directive, the GDPR is dictating any other compliance aspect related to personal data processing. This includes transparency, accountability and data protection by design and by default. This means, in practice, that data controllers should make sure to comply with both types of legislative requirements, when activating of tracking pixels.

Who Is Involved in the Process?

The guidelines apply to any public or private entity that uses pixels on email communications. They list several roles:

• Sender: decides whether to use pixels and for what purpose. It may delegate the operations to a service provider acting as a data controller.
• Email sending provider: usually a platform that acts on the sender's instructions and acts as a data processor.
• Mailing list provider: sends emails to lists it rents out to the client.
• Tracking technology provider: supplies the tracking tool. It may become a joint controller if it co-determines the processing.
• Content creator: prepares the message.

Roles must be identified case by case, based on accountability. It is very frequent that the roles controller/processor are defined as sender and service provider, respectively, however when several parties decide together on purposes and means, joint controllership under Art. 26 GDPR may apply. 

Information Requirements

As pointed out above, information duty is a must. Data subjects (email recipients) should always be informed about the processing of their personal data performed via this type of tracking. This applies despite the purpose of the email and whoever the sender is.

The information must be clear and complete. The recipient must understand that tracking takes place and why.

The Garante allows some flexibility on providing the information, in particular:

• A layered approach is allowed: for example a short notice can be provided on the sign-up form with a link to the full privacy notice;
• Several channels can be used: pop-ups, videos, chatbots or phone. The controller must make sure that the chosen channel is effective;
• For ongoing processing, the information can be given with the first useful message or at the first meaningful change in the relationship with the data subject.

It is understood that the information should be provided despite of the legal basis for processing.

What Is the Legal Basis?

The answer to this question depends on the purpose of the pixel use. The guidelines differentiate between two groups. We provide some examples below:

• Individual open tracking to optimize campaigns (for example, changing subject lines, adjusting send frequency, stopping emails to people who do not open) as well as profiling based on email-opening data require consent.
• Activities that do not involve measurement of individual behavior, processing of other technical data anonymized or use of the same pixel for all the recipients, may not require necessary consent.
• Pixel tracking activated for security purposes, for example confirming that an account-activation or password-reset message reaches the user's device, may also not require consent, if they are strictly necessary.

Of course, it is the responsibility of the controller to identify the applicable legal basis and implement it in the process of pixel tracking activation. This is an important accountability duty that has many implications, if not correctly assessed.

Conditions of Consent

The Garante provides some guidelines also on the consent requirements, for cases where this is the appropriate legal basis:

• Timing: Consent must be obtained before the pixel is used. For new processing, the Garante recommends asking when the email address is collected, after the privacy information.
• Bundling: For promotional emails, consent to pixels can in principle be part of the general consent to receive promotional messages. But the request must be neutral and free of pressure. Dark patterns are not acceptable.
• Withdrawal: It must be easy and granular. Recipients should be able to stop all emails or keep receiving them without pixels. A link or icon in each email, leading to a preferences area, is one way to do this.
• No penalty: A person who refuses tracking must still get the full service.
• Records: The controller must record the choices, to be able to prove consent.
• Existing processing: It is important to note that for ongoing campaigns, the controller must provide information and a granular withdrawal mechanism. This is a temporary measure; therefore the pixel activation should be designed in a compliant way for future implementation.

What To Do Now

In light of the Garante’s announced inspections, organizations should review their use of email tracking pixels and take the necessary compliance measures. This includes identifying where pixels are used, which providers operate them, what data is collected, and for which purposes. Organizations should assess whether an exemption from consent requirements applies or whether consent must be obtained, review contractual arrangements and the allocation of data protection roles, and ensure that privacy notices provide clear information before tracking begins. Where consent is required, appropriate mechanisms should be implemented to obtain, document, and manage consent and its withdrawal. Privacy by design measures, such as using non-sequential identifiers and keeping identification data separate, should also be considered. Of course, organizations should take note of the applicable compliance deadline and establish an internal plan to complete the necessary measures.

On enforcement: The Garante's inspection program for August to December 2026 provides for at least 35 inspections across eleven areas, with checks on these guidelines listed as one of them. The Garante also reports inspections of an email provider and a marketing automation platform before adopting the guidelines. 

The Garante’s Inspection Plan Until December 2026

On top of the compliance with the guidelines on email tracking pixels, the Garante has announced other priorities for its inspection plan until the end of this year.

Some of the items that the Italian authority will check are related to data protection compliance for the public sector, for example: AI tools used by municipalities and local health authorities or to external DPOs of public entities. In relation to the private sector and companies, the Garante will focus its attention on: 

• processing of personal data in the activities of geo-marketing and neuromarketing;
• processing of health data in the specific health related apps, but also inspections on application; provided by vendors to local authorities for the management of social welfare services;
• investigations on data breaches affecting public databases of particular importance and sensitivity; this involves, in particular, the assessment of the security systems and access profiles of the databases themselves, with a view to curbing unauthorised access and the resale of confidential information;
• processing of personal data within the Visa Information System;
• audit activities concerning the processing of personal data linked to the phenomenon of dynamic pricing.

Very important to note is that the Garante plans to further investigate personal data breaches reported to the authority – especially concerning the most extensive and sensitive cases in both the public and private sectors. Furthermore, the Garante will also conduct ex officio inspection activities in response to situations of particular urgency or in relation to reports or complaints submitted.