A compliant newsletter: the hands-on checklist for consent and tracking

From the rules to the practice

We have already covered the Italian Garante's guidelines on email tracking pixels: what the rules require and why they affect almost every newsletter. This article is the next step: the hands-on checklist applied over the past weeks to our clients' websites: what to write, where to write it and what to check.

1. The wording of the signup checkbox

Consent to tracking can travel together with the newsletter consent, but only if the request clearly says that the emails measure opens and clicks. Wording that works:

“I consent to the processing of my data for the newsletter. The emails detect opens and clicks to measure interest in the content; tracking alone can be turned off at any time using the link in every email.”

Three rules: the checkbox must be visible immediately (not appear only after typing the email address), never pre-ticked, and the link to the privacy notice must sit right next to it.

The bridge version

The wording above promises the revocation of tracking alone: use it only if your sending system actually allows it. If today the only link in your emails is the unsubscribe, use the bridge version — “…; I can unsubscribe at any time using the link in every email” — and plan the move to a system with granular opt-out, because that is what the Garante requires.

2. The privacy notice

The newsletter section must say four things: that the emails contain an invisible image (the pixel) and tracked links that detect opens and clicks, together with the IP address and device type; what the purpose is (measuring interest in the content and the effectiveness of the sends); how long this data is kept (for example 12 months); and how to revoke the choice. The legal basis is the same consent given at signup.

3. The cookie policy

Email pixels are not website cookies, but the cookie policy is where many people look for this information: add a short paragraph on the “similar technologies” used in email communications, pointing to the newsletter section of the privacy notice.

4. Transactional emails

Order confirmations, shipping notices, password resets: for these emails there is no marketing consent and none is needed — so there should be no tracking either. Check that your platform does not inject the pixel there too: it is the most frequent mistake we find.

5. Unsubscribes

Whoever unsubscribes must be deleted from the list, not simply flagged. And the list must be aligned before every send: if you import contacts from the website or from your management software, the import must never “resurrect” an unsubscribed contact.

What to ask your email provider

• Can the recipient turn off tracking alone while still receiving the emails?
• Do the emails of those who revoked really go out without pixels and with the original links?
• Are choices recorded with date and origin, ready to be produced?
• Are statistics calculated on tracked contacts only?

If even one answer is no, the provider is not ready — and neither is your newsletter.

In short

Making a newsletter compliant after the Garante's pixel guidelines takes five steps: a signup checkbox that is visible and never pre-ticked, clearly declaring that opens and clicks are detected; a privacy notice explaining pixels, collected data (IP and device), purposes, retention periods and how to revoke; a pointer in the cookie policy to the similar technologies used in emails; transactional emails with no tracking at all; and unsubscribes that delete the contact, with the list aligned before every send. The key requirement remains granular opt-out: being able to keep receiving the emails without being tracked.

Frequently asked questions

Can I use a single consent for both the newsletter and tracking?

Yes, as long as the checkbox wording clearly says that the emails detect opens and clicks and points to the privacy notice. A consent that is “silent” about tracking does not cover pixels.

I collected my list with the old wording: do I have to ask everyone again?

For contacts already on the list, the information can travel with the first useful send: an email explaining the tracking and offering the link to turn it off. From then on, each person's choice applies.

My newsletter tool does not allow turning off tracking alone: what do I do?

In the transition use the bridge wording (unsubscribe only) and plan the move to a compliant platform: granular opt-out is not optional, it is one of the explicit points of the guidelines.

At A126 we support companies through digital transformation: websites and e-commerce, custom management software, vertical micro-applications and strategic consulting. If you want to see how to apply all of this to your business, get in touch for a free consultation.

A126 Corporate Advisors — digital transformation for businesses and professionals.