{"id":73573,"date":"2026-08-03T11:34:11","date_gmt":"2026-08-03T09:34:11","guid":{"rendered":"https:\/\/www.lexia.it\/2026\/08\/03\/tracking-pixels-emails\/"},"modified":"2026-08-03T12:13:23","modified_gmt":"2026-08-03T10:13:23","slug":"tracking-pixels-emails","status":"publish","type":"post","link":"https:\/\/www.lexia.it\/de\/2026\/08\/03\/tracking-pixels-emails\/","title":{"rendered":"Tracking pixels in e-mails: the Italian Data Protection Authority\u2019s Guidelines define transparency and consent requirements"},"content":{"rendered":"\n

By Measure No. 284 of 17 April 2026 (the \u201cMeasure<\/strong>\u201d), the Italian Data Protection Authority, for the first time, has regulated in a comprehensive manner, through the adoption of Guidelines, the use of tracking pixels in electronic mail communications, with the aim of specifying the proper manner for providing the privacy notice and obtaining data subjects\u2019 consent. The addressees of the measure, including, inter alia, sending service providers, marketing automation platforms and tracking technology providers, have six months from publication in the Official Gazette to comply. The deadline is 29 October 2026.<\/em><\/p>\n\n\n\n

A tracking pixel constitutes access to a terminal device<\/strong><\/h2>\n\n\n\n

The Measure stems from the need to curb the use of \u201cconcealed\u201d tracking technologies in electronic mail communications, particularly those used in newsletters, direct e-mail marketing<\/em> (DEM), transactional e-mails, service communications or institutional messages.<\/p>\n\n\n\n

Tracking pixels are transparent images of minimal size, often amounting to a single pixel and therefore imperceptible to the recipient. They are embedded in e-mails but hosted on remote servers and have no content-related function. When the message is opened, an HTML code inserted in the text automatically generates a request to the sender\u2019s server: the pixel is downloaded by the recipient\u2019s e-mail client<\/em> and stored in the memory of the recipient\u2019s terminal device. This process, which is invisible to the user, enables the sender to obtain information regarding the opening of the communication and, in some cases, additional information that can be inferred from the recipient\u2019s IP address, such as the type of device used, the time spent viewing the message and the number of subsequent openings of the same e-mail.<\/p>\n\n\n\n

The Authority characterizes this operational sequence as a case of access to a terminal device pursuant to Article 122 of Legislative Decree No. 196\/2003 (the \u201cPrivacy Code<\/strong>\u201d), the provision that transposes into the national legal order Article 5(3) of Directive 2002\/58\/EC (the \u201ce-Privacy Directive<\/strong>\u201d). This classification is also consistent with EDPB Guidelines 2\/2023 on the technical scope of application of the same European provision, which the Guidelines expressly reference. Loading the pixel constitutes the \u201cstorage of information in the user\u2019s terminal equipment,\u201d and the recording of the opening constitutes the subsequent \u201caccess to information already stored,\u201d both operations falling within the scope of Article 122 of the Privacy Code.<\/p>\n\n\n\n

The privacy notice: an obligation across all categories of communication<\/strong><\/h2>\n\n\n\n

The Guidelines clarify that any use of tracking pixels in e-mails requires the transmission of an appropriate privacy notice to the recipient, irrespective of the type of message (commercial, service-related or institutional) and the nature of the sender (private or public). According to the Authority, failure to provide such notice renders the processing unlawful under the principle of fairness set out in Article 5(1)(a) GDPR, given the concealed nature of tracking pixels.<\/p>\n\n\n\n

In this respect, the Authority follows the same simplification logic already adopted for cookies in the Guidelines of 10 June 2021 (web doc. No. 9677876): the privacy notice may be structured on multiple levels, with a concise statement in the form used to collect the e-mail address and a reference to a more detailed version, which may be incorporated into the existing cookie policy<\/em>. Multichannel methods are permitted, such as pop-up<\/em> windows, videos, virtual assistants and chatbots, provided that the overall system ensures completeness, clarity and usability, in accordance with the principle of accountability<\/em> pursuant to Article 5(2) GDPR.<\/p>\n\n\n\n

For processing activities already under way on the date the Guidelines entered into force, the Authority considers it appropriate to discharge the information obligation by means of the first subsequent communication or the first available point of discontinuity in the relationship with the data subject.<\/p>\n\n\n\n

Consent is almost always required<\/strong><\/h2>\n\n\n\n

Article 122(2-bis) of the Privacy Code imposes a general prohibition on accessing the user\u2019s terminal device, from which derogations are permitted only where specific conditions are met. The Guidelines identify the situations in which consent is not required and those in which it is mandatory.<\/p>\n\n\n\n

Consent is mandatory where measurement of the open rate is carried out on an individual basis in order to assess and optimize promotional campaigns and thus modify the subject line, frequency or relevance of messages based on the behavior of the individual recipient; or where the open data are used to infer the user\u2019s tastes, interests and preferences in order to build commercial profiles that may also be used for other initiatives. The Measure clarifies that, for processing activities subsequent to the Guidelines, consent should preferably be collected at the time the e-mail address is obtained. The Authority accepts that consent to the tracking pixel may be incorporated into the more general consent to receive promotional communications, thereby avoiding redundant multiple requests that generate consent fatigue<\/em>, provided that the request is framed neutrally and that the user is fully informed.<\/p>\n\n\n\n

Consent may, however, be omitted where:<\/p>\n\n\n\n