Italy requires consent to track who opens your emails, with a 29 October 2026 deadline

If your product sends a welcome email, an onboarding sequence or a newsletter, the open rate in your email tool comes from a tracking pixel: a tiny image, usually with an address unique to each recipient, that logs when that person opened the email. Italy's data protection authority, the Garante, has published guidelines on these pixels, and senders have until Thursday, 29 October 2026 to comply 1 2. Recipients must be told the pixel is there. Tracking each recipient's opens needs their prior consent, unless the pixel serves one of a few narrow purposes, and in my reading welcome and onboarding emails are not among them. Anyone who consents must be able to switch off the tracking while still receiving the email 1. For a B2B product, the simplest setup that complies is to switch per-recipient open tracking off everywhere except marketing email to people who said yes.

The law behind this already applied before the guidelines were published in April. They explain how Italy's cookie rule covers email, and the six months were a grace period to adjust systems 1. When the Garante inspected an email provider and a marketing automation platform while preparing the guidelines, it found tracking pixels used in almost all cases 1. It has said that checking compliance is part of its inspection plan for the second half of 2026 2, and Italian law puts a breach of that cookie rule in the GDPR's higher tier of fines 5: up to 20 million euros or 4% of worldwide annual turnover, whichever is higher 6.

Does this apply if you are not based in Italy?

Probably, though nobody has settled it. The guidelines are addressed to online service providers, email providers, operators of bulk email platforms, and "any other party" that uses tracking pixels, with no test of where the sender is based 1.

The consent rule is Italy's version of the EU ePrivacy Directive's rule on storing and reading information on a device, which is the law behind cookie banners everywhere in the EU 1. The European Data Protection Board (EDPB), the body of all EU data protection authorities, reads that rule as covering pixels in email 3. The GDPR's one-stop-shop, which lets a company deal mainly with the regulator of the EU country where it is established, does not apply to ePrivacy rules 4. So a company in Denmark or the US cannot count on its home regulator for the consent rule.

My reading is that any company that emails people in Italy should plan as if the guidelines apply to it. In B2B you usually cannot tell who is in Italy from an address like jane@company.com, so in practice that means applying the changes to everyone.

Which emails can keep a tracking pixel without consent?

The Garante gives three examples of pixels that need no consent, and leaves it to each sender to assess its own case 1:

1. A campaign-wide open count. The data has to be anonymised so that nobody is measured individually. The Garante suggests one pixel, identical for every recipient of the same campaign, with the IP address and email client data anonymised. The count gives the overall open rate, which the Garante accepts is needed to keep email deliverable and to fight spam 1.
2. Sign-in and account security emails. Account activation, a password change, or the reply to a data protection request such as data portability. The pixel checks that the email was opened on a device known to belong to the user 1.
3. Messages the sender is legally required to send, where it matters that the recipient read them. The Garante's examples include security incident notices, phishing warnings, changes to a contract or to terms of service, updates to the privacy notice, and reminders of contractual deadlines 1.

Every email with a pixel, these three included, still needs the notice. The Garante treats a hidden pixel the recipient was never told about as unfair processing under the GDPR, whatever the email is for 1.

The Garante also names the uses that need consent: measuring each recipient's opens to improve a campaign (a new subject line after a low open rate, for example), sending less often or stopping altogether for people who do not open, and inferring tastes and interests from opens to build profiles 1.

For a software product, that leaves two common emails outside the exemptions.

• Welcome and onboarding emails. The Garante sorts pixels by what they are for, and a per-recipient open count in a welcome email serves none of the three purposes. The law also exempts what is strictly necessary for a service the user explicitly asked for 1, but the Garante does not say an open count in a welcome email meets that bar, and I do not think it does. I would treat that pixel as needing consent, or replace it with an anonymised campaign count.
• Emails sent to clean the list. Dropping subscribers who have not opened in months is on the Garante's consent list. Per-recipient opens are also a weak signal for this: Apple's Mail Privacy Protection downloads remote content in the background whether or not the person opens the message.

What must a sender put in place?

For a new address, ask for consent when you collect it, after telling the person about the pixel 1. The guidelines then ask for the following:

• A notice. The Garante accepts layers: a short line on the sign-up form with a link to the full detail, which can sit in your cookie policy 1.
• One consent for the email and the pixel, if you like. Consent to the pixel may be part of the consent to receive promotional email, so the person ticks once. The request has to be neutral, with no pressure to accept 1.
• A way to stop only the tracking. Anyone who consented must be able to withdraw easily, either from everything or from the tracking alone, and keep receiving the email without pixels. The Garante suggests a footer link, or a standard icon, in every email, leading to a page where the person makes that choice 1. In practice your sending setup needs a per-person flag that removes the pixel from everything you send them.
• Full service for people who refuse. Someone who refuses tracking must keep full use of the service 1.
• A record of every choice. Log each one, because the GDPR makes the sender prove consent 1.
• A pixel address that does not contain the email address. The Garante suggests a random, non-sequential ID per recipient, mapped to the email address in a separate internal layer 1. Leaking the address is common: a 2018 Princeton study of mailing-list email found that about 30% of emails passed the recipient's address to third parties when opened.

Existing lists get a transitional route, but only for commercial email that you already send lawfully, on consent or another legal basis. Tell those people about the pixel in your next email and give them the way to stop only the tracking; you do not need fresh consent from them 1. Welcome and onboarding emails get no such route. The plain step for those is to remove the per-person pixel, or switch to an anonymised campaign count.

What if you also email people in France?

France's data protection authority, the CNIL, has its own pixel rules, which I covered in our post on email tracking pixels in France. Two differences change what you build. France lets you keep each recipient's last-open date to drop inactive addresses without consent, which Italy does not allow. Italy exempts an anonymised campaign open count, which France does not, unless the count is built from pixels that were exempt anyway 7 1. If you send to both, the setup that works in each is per-recipient tracking only for people who consented.

What should you change if you email people in Italy?

The deadline is 29 October 2026. In order of how much risk each step removes:

1. Switch off per-recipient open tracking in your sending tools for every email except marketing to people who consented and the sign-in, security and legally required emails above. If you cannot tell which recipients are in Italy, do it for everyone.
2. Add a line about pixels to your sign-up forms and your privacy notice, and put it in the next email to your existing list.
3. Ask your email vendor two questions. Can open tracking be switched off for one person rather than one campaign, and does its pixel address contain the recipient's email address? Steps 1 and 2 are usually settings; per-person suppression and a new pixel address may be work for the vendor or your engineers.
4. Add the opt-out page with a "stop tracking only" choice, link it from your marketing email, and check that it removes the pixel from everything sent to that person afterwards.
5. Log consents and withdrawals with the date, so you can show them if the Garante asks.