Italy requires consent for individual open tracking from 29 October 2026
Does Italy require consent for email tracking pixels?
In one sentence
Italy follows France: from 29 Oct 2026, tying an open to a named person needs — aggregate open counts do not.
Emailrules interpretation
Italy is adopting the same idea as France: you may measure in bulk without naming people. Linking “this person opened” for marketing needs a clear yes. Plan for per-person control or no-pixel sends before the date, not after a complaint.
Why it matters. If you sell into Italy and your only has all-or-nothing , that is a product gap — not a footnote.
Dotted words open definitions. See how email actually works.
What to do
Your move — not a lecture
This one needs you
No platform does this for you. One concrete move, then you are done.
More than when this page was written. Klaviyo shipped per-recipient control in July 2026, and it names this deadline in its own help page. It stops the open being recorded; it does not take the pixel out of the email.
Your part: Deciding, before October, whether discarding the open is enough for you or whether you need the image gone — Article 122 bites on reading the device, not on writing the result down. And if you rely on the aggregate exemption instead, making sure nothing downstream ties an open back to a named person.
What to do first
Put 29 October 2026 in the calendar with a two-month run-up. This is a build, not a checkbox, and the deadline will not move.
You can skip this if: Nobody on your list is in Italy.
Who this applies to
Anyone emailing recipients in Italy. Compliance is due six months after publication in the Gazzetta Ufficiale, which lands on 29 October 2026.
Checklist
- 01Separate the tracking choice from the subscription choice, and let people revoke tracking alone.
- 02Decide now what your -free path is. On Klaviyo you can mark recipients as unsubscribed from open tracking, which discards the open but still requests the image; on most other setups there is no control at all. Neither is the same as not loading a pixel, so establish which you can live with before October rather than in it.
- 03If you rely on the aggregate exemption, use one undifferentiated across all recipients and do not tie back to individuals.
- 04Generate any tracking identifier as unintelligible and non-sequential.
Skip if
Purely statistical aggregate counting that measures the global percentage of , plus security and authentication flows, and mandatory institutional communications such as fraud notices, contract changes and breach notifications.
That’s enough to act. The exact wording, the enforcement record and the primary source sit under Proof & sources, for counsel, bosses, or AI tools that need a citation. Not legal advice.
Proof
Exact position, enforcement, sources
For records and people who will check you. Skip if Monday’s move is already clear.
Source fact
The Garante published binding guidelines treating tracking pixels under Art. 122 of the Codice Privacy. Measuring per recipient requires prior, free, specific and informed . Only aggregate statistical counting escapes it, and a recipient who withdraws tracking consent must keep receiving your email without the .
What happens if you do not
Not yet enforced, because the deadline has not arrived. Worth noting that the Garante fined Poste Italiane and PostePay a combined 12,501,000 euros in April 2026 for unlawful device tracking under the same Art. 122 hook, so the provision is one the authority actively uses.
Source
- Garante per la protezione dei dati personali, provvedimento n. 284 del 17 aprile 2026, Linee guida in materia di utilizzo di tracking pixelPublished 29 Apr 2026Read primary source
History of this page
- Correction: this page said the per-recipient pixel switch does not exist in the tools most people are on. Klaviyo shipped one in July 2026 and cites this deadline itself. Corrected, and kept the part that still lands on you: the pixel is still requested by the device, which is what Article 122 regulates.
- Added after publication in the Gazzetta Ufficiale.
Related
Take this with you
GET https://emailrules.today/rules/italy-email-tracking-pixel-consent?format=json
Same URL, same answer, every field including the ones behind the Proof tab. An Accept: application/json header on the plain URL does the same thing. All the endpoints.