If you run email marketing campaigns, you’ve probably heard of tracking pixels: tiny, invisible images that tell you whether an email was opened, when, and on which device. It’s a feature we’ve taken for granted for years, and it’s the basis of metrics, such as open rate, that we build our marketing strategies on.
In 2026, European data protection authorities started spelling out how these pixels can be used. In April, France’s CNIL published a recommendation on tracking pixels in emails, and on 17 April the Italian Data Protection Authority (Garante) adopted dedicated guidelines on tracking pixels (Decision No. 284), published in the Italian Official Journal on 29 April 2026. In Italy, anyone using tracking pixels in emails must comply by 29 October 2026.
So how can you keep using tracking pixels while following the new rules? In this article we explain what the guidance says, when it applies, what you need to do and, above all, how Emailchef helps you manage consent to tracking pixels.
⚠️ Important note
This article is based on our current interpretation of the Italian guidelines. Some points in the text leave room for interpretation. In particular, the Garante’s text doesn’t make it entirely clear whether granular withdrawal (letting users withdraw consent to tracking while still receiving emails) is mandatory for anyone using tracking pixels, or just one of the permitted options. It’s also not operationally clear whether giving customers only aggregate statistics, while internally collecting non-anonymized data for security and deliverability purposes, is enough to comply. We’ll update this article as soon as we have more definitive answers. In the meantime, Emailchef has taken the most cautious approach: granular withdrawal is already available for all your subscribers.
Rules may also differ in other countries: this article doesn’t replace the advice of your privacy advisor.
1. What the new guidance on tracking pixels says
Tracking pixels are transparent images of minimal size (often a single pixel) embedded in emails. When the recipient opens the message, their email client downloads the image from a remote server. At that moment, information is collected such as the fact that the email was opened, the time, the device used and sometimes data that can uniquely identify the user.
The Italian Garante describes them as particularly invasive markers, especially because of their hidden nature: recipients usually don’t know they’re being tracked. Hence the need for clear rules.
The legal basis is European. Tracking pixels fall under Article 5(3) of the ePrivacy Directive, which governs storing or accessing information on a user’s device, as the European Data Protection Board confirmed in its Guidelines 2/2023. Each country has transposed this rule into its own law (in Italy, Article 122 of the Privacy Code), and the GDPR principles on consent, transparency and accountability apply alongside it.
In practice: if you send promotional newsletters or email marketing campaigns and want to keep measuring opens at an individual level, you need your recipients’ consent.
The Garante takes a pragmatic approach to how that consent is collected. To avoid so-called consent fatigue (users being overwhelmed by too many consent requests), it explicitly allows consent to tracking to be included in the broader consent to receive promotional communications. A single informed consent is therefore enough in Italy, as long as the request is worded neutrally, without pressure, and the user has been properly informed.
However, this simplification only applies to collecting consent. When it comes to withdrawing it, the rule changes: users must be able to withdraw consent granularly, choosing whether to stop receiving emails altogether, or to keep receiving them without being tracked.
The Garante also requires you to publish a clear, transparent privacy policy explaining what you’re doing.
What about France and other European countries?
The CNIL’s recommendation follows the same principles: inform recipients, ask for their consent when tracking is individual, and make it easy to withdraw. On some points, however, it’s stricter than the Italian guidelines, for example by calling for consent specific to tracking pixels, rather than consent bundled with the newsletter subscription.
Other European authorities are expected to take similar positions. Since the details can vary from country to country, if your business is based outside Italy, check the guidance of your local data protection authority.
2. When do the Italian guidelines apply?
In Italy, the Garante set a six-month transition period from publication in the Official Journal, which took place on 29 April 2026.
The date to mark in your calendar is 29 October 2026. By then, everyone using tracking pixels in emails under Italian jurisdiction (companies, professionals, public bodies, email marketing service providers) must comply with the new rules.
One useful clarification: using a platform like Emailchef doesn’t exempt you from these obligations. You are the data controller for your subscribers’ data, and Emailchef is the data processor that handles it on your behalf. This means we take care of some things (more on that shortly), but others remain your responsibility, in particular collecting consent and informing your subscribers properly.
3. How to comply with the guidance on tracking pixels
Complying with the guidance means taking action on several fronts, but without turning everything upside down. Here are the practical steps, split between what you need to do as the data controller and what we’ve put in place at Emailchef to support you.
What you need to do
Update your privacy policy. This is the starting point. The privacy policy you link from your sign-up form (and, in general, the one you refer to whenever you collect an email address) must clearly explain:
- that you use tracking pixels in the emails you send;
- what information you collect (IP address, open, time, device);
- what you use it for (measuring campaign performance, segmenting subscribers, personalizing content);
- how long you keep this data;
- how users can withdraw consent at any time, including selectively.
Review your sign-up form text. Under the Italian guidelines, you don’t need to add new checkboxes: a single consent, collected in an informed and neutral way, can cover both receiving promotional emails and tracking. What you do need to check is that the privacy policy linked from the form explains both, and that the text next to the consent checkbox doesn’t only mention receiving commercial communications while ignoring tracking. In other countries, such as France, a separate consent for tracking pixels may be required: check the rules that apply to you. A wording such as “I agree to receive commercial email communications and to the collection of email open data, as described in the privacy policy”, together with a visible reminder that consent can be withdrawn selectively, is consistent with the Italian guidelines. In other countries, such as France, a separate consent for tracking pixels may be required: check the rules that apply to you.
In Emailchef you’ll find a ready-made element for your sign-up forms, with a text that collects consent to both the newsletter and open tracking.
Handle existing subscribers. For people already on your mailing list, the Garante provides a specific transition arrangement. At the first useful opportunity (that is, with the first email you send after updating your practices, or at the first point when your relationship with the user changes), you need to:
- update your privacy policy and make it available;
- send an email that points to the new privacy policy, explains that you use tracking pixels, and reminds users that they can withdraw consent, either to receiving emails or just to tracking.
In our documentation, How to manage tracking pixels in Emailchef, you’ll find an example notice ready to add to your next campaign.
Document everything. The GDPR accountability principle applies here too: you must be able to show that you collected consent, in what form and when, and that you provided adequate information. Keep consent logs and track changes to your privacy policy.
What we do at Emailchef
To help you follow the guidance on tracking pixels, we’ve built into Emailchef all the tools you need to manage consent. They’re already active in your account, and most of them work automatically, with no setup required. Here’s what you’ll find:
- Granular withdrawal of consent.
From the Update your preferences and Unsubscribe links included in every email, each subscriber can choose to keep receiving your emails without being tracked. When someone turns off open tracking, Emailchef stops including the pixel in their emails and applies their choice to all the lists they’re subscribed to. This is the selective withdrawal described in the Italian guidelines.
- Consent in sign-up forms.
The Garante allows consent to tracking to be collected together with consent to the newsletter, as long as the request is clear. In Emailchef you’ll find a ready-made element for your forms, with a text that mentions both: you don’t have to write it from scratch or add extra checkboxes.
- Status and history for every contact.
In each contact’s details you can see their open tracking status: Enabled or Disabled if the subscriber has made a choice, or Enabled by default. The latter is the status Emailchef assigns to all contacts until they express a preference, such as those already on your lists before these changes: they’re the contacts it’s especially important to send the tracking pixel notice to.
If a subscriber asks you to change their choice, for example by replying to one of your emails or calling you, you can update it yourself, for a single contact or for several contacts at once. Every change is recorded in the contact’s history, along with the date, time and source: so, if you’re ever asked, you can show when and how each choice was recorded.
- Segments based on open tracking.
You can create a segment of contacts with a specific status, for example everyone who has turned off tracking. You can use it to exclude them from campaigns where you want to measure opens, or to send them content designed to be evaluated through clicks.
- Flows that take tracking into account.
Se un Flow invia email diverse in base all’apertura, chi non è tracciato risulta sempre come “non aperto”, anche se ha letto l’email. Per evitarlo, puoi aggiungere al Flow una condizione che riconosce i contatti non tracciati e li fa proseguire in modo diverso: ad esempio, ricevono l’email successiva dopo un certo numero di giorni, oppure in base ai click invece che alle aperture.
- Campaigns without tracking.
When you set up a campaign, you can choose to send it without including the pixel in any recipient’s email. This is useful for non-promotional communications, or when you don’t have a legal basis to track opens. In the campaign report, you can always see whether open tracking was enabled.
Want to put these features into practice? You’ll find step-by-step instructions in our guide Tracking pixels: how to follow privacy guidelines with Emailchef.
4. Example texts
The texts below are starting points that you can adapt to your brand’s tone of voice and your specific setup. They’re based on the Italian guidelines: they don’t replace the advice of your privacy advisor, and they may need changes to meet the rules in your country.
Text next to the sign-up form checkbox
I agree to receive commercial email communications and to the collection of email open data, as described in the privacy policy.
Paragraph to add to your privacy policy
Add it to the section of your privacy policy that describes the purposes of processing related to email marketing. The text is written from your company’s point of view and addresses your subscribers: “we” is you, “you” is the person receiving your emails.
Tracking email interactions through tracking pixels
The emails we send you may contain tracking pixels: tiny images that, when you open the message, allow our system to detect certain information about your interaction with the email.
Data collected: IP address, email address, date and time of opening, type of device and email client used.
Purposes: measuring the performance of our email campaigns, understanding which content is most relevant to you, segmenting future communications more appropriately, and ensuring the security and proper delivery of our messages.
Legal basis: your consent, given at the time of subscription or later, under the national rules implementing Article 5(3) of Directive 2002/58/EC (in Italy, Article 122 of Legislative Decree 196/2003) and Article 6(1)(a) of Regulation (EU) 2016/679 (GDPR).
Retention period: data collected through tracking pixels is kept only for as long as strictly necessary for the purposes above, in line with the principle of data minimization, after which it is deleted or anonymized in aggregate form.
Withdrawal of consent: you can withdraw your consent at any time. You can choose to stop receiving our emails, or to keep receiving them without being tracked, using the “Update your preferences” link at the bottom of every email, or by contacting us at the details provided in this privacy policy.
5. What will change in your statistics and automations
Some of your recipients will choose not to be tracked, and for them you’ll no longer receive an open signal. The most visible consequence will be a lower open rate for the same number of actual opens, because the calculation will still be based on all recipients, while the number of recorded opens will be lower.
It’s worth remembering that, even today, open rate isn’t a fully reliable metric. Many email clients already block tracking pixels or load them in an anonymized, preemptive way: for example, Apple Mail with Mail Privacy Protection, which downloads images in advance, and Gmail, which loads images through its own servers. This means the “true” open rate has long been different from what you see in your reports. That’s why it makes sense to use it to compare campaigns, rather than as an absolute measure of engagement. The new guidance accentuates a trend that was already underway: the metric keeps its comparative value, but the absolute number should be read with even more caution.
The other effect, less immediate but important, concerns automated flows based on whether an email was opened (for example: “if the user opens email A, send email B; otherwise, send email C”). Untracked contacts will usually appear as “not opened”, so they won’t enter the branches that depend on an open. If you use this kind of automation, now is the time to review it: consider alternative criteria (such as a link click) or flows that don’t penalize untracked users.
In Emailchef you can do this directly in your Flows: in entry points, conditions and events you can use each contact’s open tracking status, so untracked contacts follow a path designed for them.
6. FAQ
Yes, but with conditions. Tracking pixels fall under Article 5(3) of the ePrivacy Directive, which requires prior consent to access information on a user’s device, unless an exception applies. The GDPR then sets the standards for that consent: informed, freely given, specific and easy to withdraw. National authorities, such as Italy’s Garante and France’s CNIL, have published guidance on how to apply these rules to emails.
In Italy, the deadline is 29 October 2026, so if you haven’t acted yet, now is the time. In Emailchef the tools to manage consent are already active: what’s left for you is updating your privacy policy and informing your existing subscribers. We recommend doing this together with your privacy advisor, so it fits your specific situation.
Under the Italian guidelines, no: existing subscribers are covered by a specific transition arrangement, so you don’t need to run a re-consent campaign. Instead, you need to update your privacy policy and then send your subscribers an email that points to the new policy, explains that you use tracking pixels, and reminds them they can withdraw consent. In other countries, check whether different rules apply.
Under the Italian guidelines, no. The Garante explicitly allows consent to tracking to be included in the broader consent to receive promotional communications, to avoid consent fatigue, provided that the linked privacy policy clearly describes the use of tracking pixels and the checkbox text isn’t misleading or forced. In France, the CNIL calls for consent specific to tracking pixels, so a separate checkbox may be needed.
Both require you to inform recipients, collect consent when tracking is individual, and make it easy to withdraw. The main difference is how consent is collected: the Italian Garante allows a single consent covering both the newsletter and tracking, while the French CNIL calls for consent specific to tracking pixels. The two authorities also set different timelines, so check the guidance that applies to you.
Processing data collected through tracking pixels without a valid legal basis exposes you to action by the data protection authority, including requests to comply and, if they aren’t followed, the administrative fines provided for by the GDPR. Beyond fines, your subscribers’ trust is at stake.
Only in limited cases. The Italian guidelines allow exceptions for security purposes, technical needs strictly necessary to provide the service requested, and service or institutional communications. The principles of proportionality and data minimization always apply: any exception must be justified and documented, and it isn’t a general green light.
Purely service emails, such as order confirmations or password resets, typically fall within the cases where tracking can be justified without specific consent, because it’s strictly necessary to provide the service the user requested. But be careful: if you add promotional content to a transactional email, the nature of the communication changes and consent requirements apply again.
No. The guidance specifically covers tracking pixels, which the Garante considers particularly invasive because they’re hidden. A link click, on the other hand, is a visible action the user takes voluntarily: when they click a link, they know they’re taking an action and being redirected. That’s why click tracking falls outside the scope of the guidance.
The Garante’s guidelines apply to processing under Italian jurisdiction, but they’re based on EU rules, the ePrivacy Directive and the GDPR. Other national authorities, starting with France’s CNIL, have published similar guidance, sometimes with stricter requirements. If you operate outside Italy, check the guidance of your local data protection authority.
If you have any questions about the new features, our support team is here to help.
