Email Tracking Pixels: Italian Compliance Deadline Is 29 October 2026
The deadline for bringing existing data processing operations into line with the Guidelines on the use of tracking pixels in email communications, adopted by the Italian Data Protection Authority on 17 April 2026, is 29 October 2026. This issue is also included in the inspection programme for the second half of 2026.
What the Guidelines Say About Email Tracking Pixels
The Guidelines regulate the use of small, often invisible images that are embedded in emails and which, when loaded, make it possible to detect when the message has been opened and to collect information about the recipient, such as their IP address, the device used and the number of times the message has been opened.
Who Must Comply and Which Communications Are Covered
The rules apply to public and private entities involved in the use of these tools and cover promotional communications as well as informational, institutional, and service-related communications.
When Consent Is Required—and How It Can Be Withdrawn
The Data Protection Authority considers tracking to fall within the scope of Article 122 of the Italian Privacy Code, within the framework of the safeguards provided for by the GDPR. Recipients must therefore be informed and give their consent, unless a specific exception applies, as assessed on a case-by-case basis. . Where tracking is based on consent, it must also be possible to withdraw that consent separately whilst continuing to receive communications.
Steps to Prepare for the 29 October 2026 Deadline
For businesses and organisations, compliance therefore begins with a review of the email platforms and their configurations, to ascertain whether tracking tools are active, what data they collect, and for the purposes for which the data is being used.
Review Email Platforms and Tracking Settings
Based on this review, it is then necessary to verify the roles of the service providers involved, update privacy notices, adapt the mechanisms for obtaining and withdrawing consent, and adopt technical measures that limit the data collected and ensure their protection.
This is a process that requires coordination between data protection, marketing, and IT functions.
Compliance also depends on how these tools work in practice and on the ability to respect recipients’ choices.
