Email Open Tracking Pixels: What Changes for Marketing Campaigns in Italy

October 2026

The Italian Data Protection Authority (Garante) published new guidelines regarding the use of email open-tracking pixels. These guidelines introduce new requirements for brands using email opening data for marketing purposes.

An email open-tracking pixel is an invisible image embedded in an email that allows a sender to detect when an email has been opened. Open-tracking data is commonly used for campaign performance measurement, segmentation, personalization, scoring, automation triggers and deliverability monitoring.

According to the Garante, the use of open-tracking technologies for marketing purposes now requires greater transparency and, in many situations, the collection of consent from recipients.

For brands operating across multiple European countries, this regulatory trend is not limited to Italy. Similar principles have already been adopted in France by the CNIL, and other European regulators may follow.

What Does the Garante Require?

The Garante considers that open-tracking pixels used for marketing purposes require appropriate consent and transparency.

This applies whenever opening data is used to:

personalize communications.
enrich customer profiles.
create audiences.
build engagement scores.
trigger marketing automations.
target openers or non-openers.
optimize future marketing communications.

In contrast, certain non-marketing uses may remain exempt, particularly when opening data is used solely for:

deliverability monitoring.
security purposes.
anti-spam measures.
anonymous aggregated reporting.

What Can You No Longer Do Without Consent?

Brands should no longer rely on identifiable opening data for marketing purposes without an appropriate consent framework.

Examples include:

targeting openers versus non-openers.
triggering journeys based on opening behaviour.
creating engagement scores using open events.
using opening activity for segmentation or profiling.
enriching customer profiles with identifiable opening data.

What Can Still Be Done?

The regulation does not prohibit all use of opening data.

Brands may continue to:

monitor deliverability indicators.
analyze aggregated campaign statistics.
use anonymized reporting.
perform security-related processing.
monitor inbox placement and reputation metrics.

The key principle is that data used under these exemptions must not subsequently be reused for individual marketing activation.

Compliance Timeline

The Italian framework introduces a transition period ending on 28 October 2026.

Three categories of contacts should be considered.

1. Contacts Created Before 29 April 2026

These contacts may benefit from a transitional notice-and-opt-out regime.

Brands should:

inform contacts of their use of email open tracking.
clearly explain the purposes of tracking.
provide an easy way to refuse tracking.

Provided the contact does not object, tracking may continue under the transitional framework.

2. Contacts Created Between 29 April 2026 and 28 October 2026

Based on the current interpretation of the Italian framework, these contacts should not automatically benefit from the transitional regime.

Brands should obtain explicit consent before using identifiable opening data for marketing purposes.

As a result, a dedicated consent collection campaign may be required for this population.

3. Contacts Created After 28 October 2026

For all new contacts collected after the compliance deadline, brands should ensure that their consent framework is compliant from the moment of acquisition.

Where opening data is intended to be used for marketing purposes, appropriate consent should be collected before such processing takes place.

Newsletter Consent and Tracking Consent

The Italian guidance appears to allow brands to collect newsletter consent and tracking consent together, provided that:

the tracking activity is clearly explained;
the recipient receives transparent information;
consent is freely given and informed;
the recipient can later withdraw tracking consent.

Because this remains an important legal interpretation point, brands should consult their DPO or legal counsel before defining their consent strategy.

Splio Recommendation

We recommend that brands:

Audit all current uses of email opening data.
Identify which use cases rely on identifiable opening information.
Distinguish marketing uses from deliverability or security uses.
Review existing consent collection mechanisms.
Prepare communications for contacts covered by the transitional regime.
Ensure contacts can stop tracking without necessarily unsubscribing from marketing communications.