The year 2026 marks a significant shift in the way tracking pixels are used in electronic communications. With the recent guidance issued by the Italian Data Protection Authority in its Guidelines on the use of tracking pixels in email communications of 17 April 2026, organizations are now required to reassess the lawfulness of many email tracking practices that have long been considered standard.
Tracking pixels are tiny invisible images embedded in emails that allow senders to collect information about recipients’ interactions with a message. Through these tools, organizations can determine whether an email has been opened, when it was opened and, in some cases, gather additional technical information associated with the viewing of the message, such as the recipient’s IP address or the device used.
According to the Authority, the issue does not lie in the technology itself, but rather in the fact that tracking frequently occurs without adequate transparency and without the recipient’s genuine awareness. Moreover, the practice is no longer limited to marketing communications. Tracking technologies are increasingly used in corporate and professional communications, making compliance considerations relevant to a much broader range of organizations.
The Authority clarified that the use of tracking pixels must be assessed in light of Article 122 of the Italian Privacy Code, which regulates access to information stored on users’ terminal devices and represents one of the cornerstones of Italy’s e-Privacy framework.
This has important practical consequences. Where tracking enables the monitoring of an individual recipient’s behavior, the recipient’s prior consent will, in most cases, constitute the legal basis required for lawful processing. In the Authority’s view, tracking pixels are capable of affecting the user’s private sphere and therefore cannot automatically be justified under general legitimate business interests.
The Guidelines identify several scenarios in which consent cannot be regarded as a mere formality.
This includes situations where the information collected is used to:
In essence, the more closely a processing activity is linked to a specific individual and allows the organization to reconstruct that individual’s behavior, the more indispensable consent becomes.
Beyond the issue of consent, the Authority’s guidance reinforces the importance of transparency and accountability.
Organizations must clearly inform data subjects about the existence of tracking mechanisms, the purposes of the processing, the categories of data collected, and the parties involved in the processing activities. They must also ensure that recipients can withdraw consent through simple and effective mechanisms while continuing to receive non-tracked communications.
From a governance perspective, controllers should be able to demonstrate the assessments performed, the legal basis relied upon, and the technical and organizational measures implemented to ensure compliance with applicable data protection requirements.
The Authority introduced a six-month transitional period following the publication of the Guidelines in the Official Gazette, establishing 29 October 2026 as the deadline for organizations to align their practices with the new requirements.
Ahead of that date, companies should consider taking the following actions:
Need information? Write to us and our team of experts will respond as soon as possible.
Fill in the form