It happens on a Thursday. The Data Protection Authority publishes a 48-page ruling, and within 40 minutes, Italian marketers’ WhatsApp groups are flooded with three-minute audio messages from people who haven’t even read the document but already have a very strong opinion. Classic.

I read the whole document (if you can believe it!). It's called measure no. 284 of april 17, 2026, is about tracking pixels in email, and it is one of the most dense regulatory texts with technical implications that I have read in recent years(I don't read often). It is a developer's piece and an email infrastructure manager's piece.

The facts, stripped down to the bare essentials

Tracking pixels are those invisible, one-pixel-wide images that email marketing platforms embed in newsletters to determine whether the email has been opened. Here’s how they work: the remote server serves the image only when the client requests it, and the request contains all the relevant metadata—IP address, user agent, timestamp, and recipient ID.

The Garante made two inspections of an email provider and a marketing automation platform between October 2025 and February 2026. Textual conclusion of the measure: tracking pixels are used "in virtually all cases". It is not a downward estimate. It is an assessment.

The key legal point is this: the pixel is classified as a case that falls under the'Article 122 of the Privacy Code, that is, the same rule that applies to cookies. Article 122 contains a general prohibition, subject to exceptions: no one may store information on a user’s device or access it without prior, free, specific, and informed consent. This rule has been in place since the ePrivacy Directive was transposed in 2012. What was missing was explicit guidance applying it to emails. Now it is in place.

Six months from publication in the Official Gazette to comply. After that, the penalty provisions of Article 83 of the GDPR take effect. Twenty million or 4% of global revenue—whichever is higher.

This is not just an Italian problem

The ePrivacy directive is European. It exists identically in every member state. The Italian Garante's measure explicitly recalls the EDPB Guidelines 2/2023 dated October 7, 2024, which constitute the shared framework at the European level regarding the technical scope of application of Article 5(3) of the ePrivacy Regulation. In other words: the Italian Data Protection Authority was the first to issue a ruling, but the interpretation already exists at the EDPB level.

The French CNIL—which is notoriously a “Class A villain” when it comes to privacy issues—will likely follow suit within a few months. The Germans will too. The Irish take their sweet time, but they’ll get there eventually. Anyone who sends newsletters to European citizens has a problem either way, regardless of where the company is headquartered.

The interesting technical part (and which no one is commenting on)

Paragraph 6 of the provision contains a specific architectural recommendation that, as a developer, really caught my attention. The Data Protection Authority, in accordance with Article 25 of the GDPR (privacy by design), suggests the following:

"The sender should generate an unintelligible, non-sequential identifier and associate it with the recipient's email address, storing this correspondence in an internal, separate layer of the platform being used."

In plain language: The pixel's URL must not contain the recipient's email address—neither in plain text, nor in Base64, nor in any other easily reversible format. It must be an opaque identifier, generated separately, whose association with the email address is stored in an internal database and never travels over the public network.

All right: go check how your platform does it. Open the HTML of a recent newsletter, look for the tag <img> Check the tracking pixel and see what URL it generates. If you find your email address in it, an unsalted hash, or any string that can be traced back to your address within thirty seconds, that platform isn't ready. And that's the default setting for more platforms than you might think.

This is the part of the measure that—beyond general comments—requires real technical work—not just a "privacy compliance" plugin downloaded on the fly from the repository.

What you can do without consent (the three exemptions)

The provision is not the opening paragraph of a dystopian novel. Paragraph 5 lists three cases where consent is not needed.

Anonymous aggregate statistics. You can measure a campaign’s overall open rate without asking for consent, provided that you use the same pixel for all recipients (not a unique pixel per user) and anonymize IP addresses and client information. Result: You know that a campaign was opened by 34%, but you don’t know who. A round number, zero individual profiling.

Security and authentication. Password reset, account confirmation, data portability, handling GDPR requests. Here the pixel is used to verify that the message arrived at the right home and the waiver is full.

Mandatory institutional or service communications. Contract changes, data breach notifications, deadline reminders, phishing alerts. Legitimate.

What not It’s perfectly legitimate to do this without consent—it’s standard practice: I track who opens the email to see if the content works, adjust the frequency based on individual interest, identify who’s “hot” and who’s “cold,” and personalize the next email. In other words, that’s exactly what Mailchimp, Brevo, ActiveCampaign, HubSpot, Klaviyo, FluentCRM, and Substack do—out of the box, by default, from day one.

The false problem that someone is already selling

As soon as the measure came out, my lawyer Alessandro Vercellotti — who specializes in digital law and knows this stuff inside and out — pointed out something worth repeating. Agencies are already offering "strict double opt-in": one checkbox for the newsletter, another separate one for tracking, both of which are mandatory upon sign-up. Cost of implementation: substantially high. Urgency: extremely high.

The problem is that the Data Protection Authority stated the opposite.

The text of paragraph 6 is explicit: consent to tracking can be included under the more general newsletter subscription, provided that the request is neutral and provided that—and this is the point that changes everything—the opt-out is granular. A checkbox during sign-up is fine, but then the user must be able to opt out of tracking alone without losing access to the newsletter. A preferences panel accessible from the footer of every email. Period.

As Vercellotti pointed out, whoever is selling double consent either hasn't read the document, or is betting that you won't read it. In either case, same rule: ask for a second opinion before you sign quotes(maybe just ask him who is really good).

The four consequences, without sweetening

1. The open rate as a KPI is in critical condition

A portion of your subscriber base will end up in the "newsletter yes, tracking no" segment. For them, open rates will no longer be measurable. If you bill clients based on open rates, start building an alternative model today: clicks on valuable links, direct responses, and downstream conversions. The open rate survives as a technical indicator of delivery. As a proxy for engagement, it’s on the decline.

2. The preference panel is code, not compliance

The granular opt-out panel required by the regulation is not a checkbox in the email. It is a full-fledged page, linked from the footer, connected to the CRM, which saves the user’s choices as subscriber properties, and which modifies how the pixel is rendered during the sending process. If your platform currently provides neither a user interface nor a developer hook to conditionally suppress the pixel, you’re accumulating technical debt at breakneck speed.

3. Penalties are no longer the 30,000-euro theater

Up to 4% of global turnover. No one starts at the ceiling, but the enforcement environment is hot: in the same week that these guidelines came out, the Garante imposed a sanction of 12.5 million to Poste Italiane and Postepay regarding a different case (the ThreatMetrix feature in the BancoPosta apps). The Authority is not sitting idly by.

4. Your email platform is the first bottleneck

Three checks you can perform today, without calling anyone. Open the HTML of a recent newsletter and look at the pixel’s URL: does it contain the recipient’s email address (in plain text or in formats that can be easily reverse-engineered)? If so, the platform is not “privacy-by-design” according to the Italian Data Protection Authority’s criteria. Open the admin panel and try sending the same campaign to two segments with different tracking policies: can you do this without duplicating the campaign? If not, the workflow doesn’t comply with the new regulations. Search the documentation for the hook or filter that allows you to conditionally suppress the pixel on a per-subscriber basis: does it exist? If not, contact the platform’s support team immediately.

Six months. Which is not six months

In software we know one thing that the right often ignores: development timelines are not linear. If adapting requires database audits, information update, CRM intervention, preference panel build, possible platform migration, re-consent campaign, end-to-end testing, post-deployment monitoring--six months is a tight timetable. Not wide.

Those who start in late summer work in a hurry. Those who start in October arrive late. Those who arrive late take what is left of the market, which is usually not the best: rigid platforms, hasty consultations, patch solutions. The first one to move in order gets to choose. Platform, partner, architecture, timing.

Sources

If you have an active newsletter and so far have only read the three-minute audios, that's the sign. The measure is there, takes less than an afternoon to read, and contains everything you need to know where to start. In six months, the conversation will change. Not for the better for those who will have procrastinated.