Email tracking pixels: what the Italian Garante requires (and how to comply without touching your website)

The invisible pixel inside your newsletters

Almost every email marketing platform embeds an invisible one-pixel image in its messages, different for each recipient: when you open the email the pixel is downloaded and the sender knows that you — you specifically — opened it, when and on which device. The same goes for clicks: links are rewritten to pass through a counter before taking you to their destination. These are tracking pixels, for years the foundation of newsletter open statistics.

With its guidelines of 17 April 2026 (measure no. 284, published in the Italian Official Journal on 29 April 2026) the Italian Data Protection Authority (Garante) put the rules for using them in black and white. The legal basis is Article 122 of the Italian Privacy Code — the pixel “accesses” the recipient's device, like a cookie — together with the GDPR. The deadline to comply was six months: from 29 October 2026 whoever sends tracked emails must be compliant, and checks have entered the Authority's inspection plan.

What the guidelines say

• Prior consent is required to measure the behaviour of the individual recipient (opens and clicks). For marketing emails, consent can be folded into the general consent to commercial communications, provided the request is transparent and the user knows about the pixels.
• Without consent, aggregate statistics only: an identical pixel for all recipients of the campaign and anonymised IP addresses. No individual measurement.
• Easy, granular revocation: recipients must be able to choose between no longer receiving the emails or continuing to receive them without being tracked. Every email must carry a recognisable link or icon to an area where the choice can be managed, and refusing tracking must not penalise the service.
• Choices must be recorded: the sender must be able to prove consents and revocations, as with any GDPR consent.
• Information always: recipients must be informed of the pixels and their purposes; for contacts already on the list, the first useful send is enough.
• Privacy by design: tracking identifiers that are neither intelligible nor sequential, and never the email address in clear text in the pixel URL.

Why it affects (almost) everyone

You don't need to be a big company: a monthly newsletter sent with any email marketing platform with open statistics switched on is enough. If today your report says “Mary opened, Luke didn't”, you are carrying out an individual measurement that requires consent and granular revocation. And the deadline isn't approaching: it has already passed.

Complying on your own is not trivial: you need a tracking preference for each contact, a page to manage it, sends that respect the choice — no pixel and original links for whoever revoked — statistics recalculated on tracked contacts only (otherwise open rates collapse artificially) and a record of choices you can produce. Many platforms don't offer all of this yet.

Our solution: SocialFlow handles it, without touching your website

We chose the cleanest path: our clients' newsletters are all sent from A126 SocialFlow, the platform we use to manage newsletters, automated emails and social channels, which we adapted to the guidelines on every point.

• Every contact has their own tracking preference: every email carries a notice with a link to a page where they can unsubscribe or keep receiving emails without being tracked.
• Whoever turns tracking off receives emails with no pixel and with the original links, not rewritten. No individual measurement, not even a disguised one.
• Every choice is recorded with date and origin, ready to be demonstrated.
• Statistics stay true: opens and clicks are calculated only on tracked contacts, so reports don't collapse and remain comparable over time.
• Only the contact can re-enable tracking, from their own page: a revocation is never switched back on by an import or a new subscription.

And above all: your website doesn't need to change. The site keeps doing the only thing it already did — collecting subscriptions, with an updated privacy notice — while sends, preferences, management pages, the record of choices and statistics all live inside SocialFlow. Complying with a complex rule becomes a configuration, not a project.

In short

With measure no. 284 of 17 April 2026 the Italian Garante set the rules on tracking pixels in emails, in force since 29 October 2026: prior consent to measure the individual recipient's opens and clicks, aggregate statistics only without consent, easy and granular revocation (stop receiving or receive without tracking), recorded choices, clear information and unintelligible identifiers. Whoever sends newsletters must already be compliant. The simplest way is to entrust sending to a compliant platform: with A126 SocialFlow the tracking preference, the management pages, the record of choices and correct statistics are already in place — and your website stays untouched.

Frequently asked questions

Can I still see who opens my newsletter?

Yes, for contacts who gave their consent to tracking and haven't revoked it. For the others only aggregate statistics are allowed, with an identical pixel for everyone and anonymised IPs.

Does turning tracking off mean no more emails?

No, that's precisely the point of granular revocation: they keep receiving the emails, without pixels and with the original links. Unsubscribing remains a separate, always available choice.

Do I have to rebuild my website or e-commerce?

No. If emails are sent from a compliant platform, your site only keeps collecting subscriptions with an updated privacy notice: preferences, public pages and the record of choices live in the sending platform.

What's the risk of not complying?

Checks on tracking pixels entered the Garante's inspection plan for late 2026. Tracking opens without consent is unlawful processing, with GDPR penalties — plus the loss of trust of your subscribers.

At A126 we support companies through digital transformation: websites and e-commerce, custom management software, vertical micro-applications and strategic consulting. If you want to see how to apply all of this to your business, get in touch for a free consultation.

A126 Corporate Advisors — digital transformation for businesses and professionals.