The Italian Data Protection Authority has published its guidance document, Tracking Pixels in Emails: The Authority’s Guidance, summarising the Guidelines adopted by means of Decision No. 284 of 17 April 2026, published in Official Gazette No. 98 of 29 April 2026. In nine key points, the document clarifies when these tracking tools may be used and what safeguards must be in place. The guidance provides a concise overview of how tracking pixels work, their purposes and the rules governing their use, highlighting the key aspects of the Guidelines.
What Are Tracking Pixels and How Do They Work?
Tracking pixels are often transparent, very small images hosted on a remote server and downloaded to the user’s device when an email is opened. Recipients are rarely aware of their presence and, despite their increasingly widespread use, pixels have not yet been standardised or codified.
Downloading a pixel notifies the sender that the message has been opened and may reveal the recipient’s IP address, device, viewing time and number of opens. Pixels do not disclose the content of the message, but they can track whether it has been opened, deleted, forwarded or archived. If the user configures their email client to display messages in plain-text format only, the pixel, like any other image, will not be downloaded and tracking will therefore not take place.
Purposes, Parties Involved and Types of Messages
Pixels are used to ensure that emails are successfully delivered, combat spam and measure audience reach and performance by tracking whether messages have been opened or read and whether attachments have been downloaded. They may also be used to personalise messages and improve the effectiveness of advertising campaigns.
The Guidelines apply to all public and private entities involved in the process of sending communications, including senders, providers of email delivery and tracking technology, email service providers, mailing-list owners and recipients. Each party must determine its role in the processing of personal data, including whether it may qualify as a joint controller.
The types of messages concerned are varied and include newsletters, direct email marketing campaigns (DEMs), institutional communications, transactional emails and service messages. Whether a message is commercial, informational, institutional or service-related affects the assessment of the applicable rules.
Article 122 of the Italian Privacy Code: Three Conditions for Lawfulness
The Italian Data Protection Authority brings the use of tracking pixels within the scope of Article 122 of the Italian Privacy Code (Legislative Decree No. 196/2003), since the mechanism involves both placing the pixel on the recipient’s terminal equipment and subsequently collecting information.
As a general rule, their use is prohibited unless one of the following conditions is met: the recipient has given informed, freely given, specific and unambiguous consent; the processing is necessary; or the service has been expressly requested by the user.
The GDPR remains the overarching legal framework. The Authority emphasises the intrusive nature of this form of tracking and the potential conflict with the principle of fairness under Article 5(1)(a) of the GDPR. The requirements of transparency and accountability, together with the principle of data protection by design, continue to apply.
The Requirement to Provide Privacy Information
Given that tracking pixels are difficult to identify, recipients must be informed in advance, regardless of the purpose of the communication or the nature of the sender. The privacy notice must be clear, comprehensive and easily accessible, enabling recipients to understand that tracking tools will be used and for what purposes.
Information may be provided in layers. For example, a brief notice may be included in the form used to collect email addresses, with a link to more detailed information. The notice may also be delivered through pop-ups, videos or chatbots.
For processing activities already under way, the information may be provided with the first relevant subsequent message or at the first appropriate point of change in the relationship with the data subject.
Consent, Exemptions and Granular Withdrawal
Consent is required where a tracking pixel measures the behaviour of an individual recipient, for example to tailor the content and frequency of promotional campaigns or to create commercial profiles. Consent must be obtained before the pixels are installed, preferably when the email address is collected. In the context of promotional communications, it may be incorporated into the marketing consent, provided that the request is presented neutrally and without undue pressure.
Consent is not required where the purpose is to generate aggregated statistics, monitor deliverability or combat spam, provided that it is not possible to link an email opening to an individual recipient. This may be achieved, for example, by using identical pixels throughout a campaign and anonymising technical data. An exemption also applies to messages containing operational instructions for user authentication.
The same approach applies to institutional or service messages where it is important to establish whether the recipient has actually become aware of their contents. These include communications concerning contractual changes, security incidents, phishing or fraud, deadlines and compliance requirements, as well as certain institutional information campaigns. It is the controller’s responsibility to verify that the relevant conditions are met, in accordance with the principle of accountability.
Withdrawal of consent must be straightforward and granular. Recipients must be able to continue receiving emails while requesting that they no longer contain tracking pixels, for example through a link or icon included in each message. Refusal must not restrict or adversely affect the service, and the controller must keep a record of the recipient’s choices.
Privacy by Design and by Default
To implement Article 25 of the GDPR and minimise both the personal data processed and the risks to data subjects, the guidance recommends assigning each recipient a non-intelligible, non-sequential identifier. This identifier should be associated with the recipient’s email address in a separate environment within the platform, ensuring that the email address itself does not appear in the request generated by the pixel.
Data protection considerations should therefore be taken into account from the outset when selecting and configuring email delivery tools.
In Summary
The guidance revisits the Guidelines and highlights their key provisions. Its publication comes shortly before the deadline for implementing the required measures, which, it should be recalled, is 29 October 2026.
Lawyer Rossella Bucca and Dr. Giulia Mazzeo