DATA PROTECTION | Italian Data Protection Authority adopts Guidelines on tracking pixels in emails

On 17 April 2026, the Italian Data Protection Authority (DPA) adopted Guidelines on the use of tracking pixels in email communications (the Guidelines), clarifying the data protection requirements applicable to email tracking technologies and strengthening transparency obligations towards users.

The Guidelines qualify tracking pixels as particularly invasive tracking tools, as they enable senders to monitor whether and when an email has been opened, often without the recipient’s awareness. The Italian DPA clarifies that the use of tracking pixels falls within the scope of Article 122 of the Italian Privacy Code, since such technologies involve both the storage of information on, and access to information stored in, users’ terminal devices.

Accordingly, the use of tracking pixels generally requires users’ prior consent, which must be freely given, specific, informed and unambiguous. The Guidelines nevertheless identify limited exemptions where tracking pixels may be used without consent, including (a) aggregated and anonymised statistical measurements aimed at improving email deliverability and preventing spam; (b) security-related communications connected to authentication procedures or fraud prevention; and (c) institutional or service communications necessary to comply with legal obligations or protect users against security threats.

The DPA further stresses the need to provide layered and easily accessible privacy notices and confirms that users must be able to withdraw consent through simple and granular mechanisms, including the possibility to continue receiving emails while disabling tracking functionalities only. Particular attention is also devoted to the implementation of privacy by design and by default measures aimed at reducing the identifiability of recipients and limiting the circulation of personal data.

The Guidelines apply to information society service providers, email service providers, operators of mass emailing platforms and, more generally, any entity using tracking pixels in email communications. The Italian DPA granted operators six months from publication of the Guidelines in the Official Journal to comply with the new requirements.

Newsletter n. 118 – May 2026