Tracking pixels in email: the rules of the Garante and the CNIL, and what to do by 29 October

If you send a newsletter, you almost certainly know how many people opened it. What you may not know is how you know it: inside every message there is a tiny image, the size of a dot and invisible to the recipient. When the email is opened, that image is downloaded from the sender's server, and that download is an event that says who opened it, when and from where.

It is called a tracking pixel, and since April 2026 it has had precise rules in Italy and France. Two national authorities have addressed the same phenomenon, with different documents that must be kept distinct. The Garante per la protezione dei dati personali, the Italian data protection authority, published the Guidelines on the use of tracking pixels in email communications (decision no. 284 of 17 April 2026, Official Gazette no. 98 of 29 April 2026). A few days earlier, on 12 March, the French authority CNIL had adopted a recommendation on the same subject. One message, in the end: pixels in email process personal data, and to use them you need consent, information and the possibility of withdrawal.

The deadline for compliance in Italy is 29 October 2026. If you send to an international audience, however, you must consider both authorities: the differences, and the practical rule for navigating them, are in the table towards the end of this article.

What tracking pixels are and what data they collect

A tracking pixel is a small transparent image embedded in the body of the email. When the message is opened, the mail program requests it from the server, and in that request travel data that sending platforms, from the most popular to professional services, show in their statistics:

• who opened the message, with their own email address;
• when, with exact date and time;
• from which device or mail program;
• the IP address from which the request is made.

These are not anonymous numbers: they are data relating to an identifiable person. This is why the Garante brings the pixel under article 122 of the Italian Privacy Code, the same provision that governs cookies and other tracking tools, and requires the three safeguards that provision provides for: clear information, prior consent and the possibility of withdrawal. Consent, moreover, governs access to the tracking tool: any subsequent use of the data collected remains subject to the GDPR, which requires identifying a legal basis, not necessarily a second consent, and its rules on purposes, retention and the rights of data subjects.

An honest clarification: a recorded opening is a technical event, not proof that the person read the message. Preview panes, filters and mail protection systems can anticipate or simulate the loading of the image.

The guidelines stress the particular intrusiveness of these tools, which operate without the recipient being fully aware of them. And they make a point that works as a practical rule: if part of the tracking remains hidden even after the privacy policy, that hidden residue risks making the processing unlawful.

The guidelines address anyone using tracking pixels: those who send newsletters and marketing communications, but also email service providers and mass-mailing platforms. For senders, the 29 October deadline is not a suggestion: anyone who keeps tracking openings without valid consent is processing data without a legal basis, with the sanctions the GDPR provides for violations of the consent rules. The decision, moreover, did not originate from a complaint: it matured on the basis of inspections the Garante carried out in October 2025 at an email service provider. And on 5 October 2026 the Garante also published an operational vade mecum, specifying that compliance checks are among the inspection activities planned for the second half of 2026. Inspections are not a remote hypothesis: they look inside platforms, not just websites.

What you have to do, in practice

1. Check what your platform actually collects

Before anything else, find out what data the service you send with passes on. The simplest method is a test: create a control email address, subscribe it to your list, send a newsletter and look at what information the platform shows you about that opening. Mind you: a panel that only shows percentages does not by itself prove that the underlying processing is anonymous. Platforms, as a rule, generate a different pixel for each recipient: that is how they can tell you who opened. The exemption for global statistics, therefore, is not the starting condition but a configuration you have to build, and in Italy it applies only in certain cases: the count must be global, with no personalized measurements, with the same pixel for all recipients of the same campaign and effective anonymization of the IP address and other technical data, serving purposes such as deliverability and anti-spam, which the guidelines give by way of example. Measuring the effectiveness of campaigns does not fall under that exemption: that requires consent. In France, mind you, the exemption does not exist: the CNIL does not recognize anonymous aggregate counting as a consent-free route. Ask your vendor how data is collected upstream and how aggregate mode is set. If instead you see the address, the time and the device of who opened, you are processing personal data, and the rest of this article concerns you directly.

2. Update your privacy policy

The privacy policy must explain that the communications contain measurement tools and with what purposes: openings, clicks, reading times and devices. A distinction helps here: openings are measured with the pixel, clicks usually with tracked links, and not all platforms collect the same data. The policy must be exact and match the real configuration: it must not omit what happens, nor describe processing that does not take place. In France, if you collect consent, the essential purposes must be presented before the choice.

3. Set up consent

Here Italy and France say similar things, with one difference that shows up in the signup form. Consent can sit in a single statement, newsletter and tracking together, or in two separate checkboxes: what changes is what happens afterwards.

In Italy the Garante admits the single statement on one condition: whoever accepted must be able to withdraw tracking alone while staying subscribed. The wording must be neutral and free of nudging, and must be enriched so that whoever subscribes knows that the emails will contain tools measuring openings. Choices must be recorded, as article 7 of the GDPR requires, keeping the proof: the wording presented, the version of the privacy policy, the date. One limit remains: single consent covers tracking with purposes connected to the communication, not standalone purposes such as advertising profiling on other channels, which require a separate choice.

In France the CNIL also admits single consent, for connected purposes, but with two differences: the essential purposes must be indicated before the choice, and the package can stay closed, whoever refuses the pixel does not receive the newsletter. Separate withdrawal, mandatory in Italy, is not in France.

The structure that works in both countries, and the one we recommend, is the most granular: two checkboxes, one for the newsletter, required to subscribe, and an optional one for tracking, which those who do not want it leave unchecked while staying subscribed. It is the structure My Agile Privacy® uses with its privacy policy, and it works for those sending to both markets.

If you choose the single checkbox, and you only send to Italy, the starting wording is enriched like this:

I consent to receiving promotional material, as described in point c of the privacy policy, and to the use of the tracking tools included in the communications I will receive, to measure the effectiveness of the campaigns, recording the opening of messages and the related technical data (such as date and time of opening, IP address and device information), as described in section 4 of the privacy policy.

If you choose the two checkboxes, the optional one on tracking, valid in both countries, is this:

I consent to the use, in the informational or commercial communications sent to the address I provided and on any device on which I read them, of tracking tools that record the opening of messages and the related technical data (date, time, device and IP address), in order to assess the effectiveness of the communications, as described in section 4 of the privacy policy.

If you do not track at all, the wording stays as it was:

I consent to receiving promotional material, as described in point c of the privacy policy.

The emails must really be free of individual measurement, however, and the policy must describe only what actually happens: even the mere counting of openings, if it stays on, is tracking, and must be declared.

In all cases the wording declares the purpose, not just the operations: consent covers what is declared. If tracking also serves to personalize content or frequency, the purpose must be added. And if the platform also tracks clicks on links, the wording must say so, adding clicks on links among the interactions recorded. Double opt-in remains good practice, with the confirmation email sent without pixels or tracked links.

4. Existing lists do not need new consent

Whoever already has a subscriber base does not have to ask everyone for new consent. The guidelines provide a transitional regime for processing already under way: it is enough to give the updated information with the first useful message, or at the first moment of discontinuity, for example in the first newsletter sent after the privacy policy update. That same communication must indicate how to withdraw tracking. A worthwhile precaution: the compliance notice travels better without a pixel, because its job is to tell people about tracking who were not yet informed, not to measure whether they opened it. The simplification has one condition, though: it applies to processing already under way on a lawful basis. It does not heal lists collected without valid consent, and does not cover new uses of tracking or substantial changes of purpose. For recipients in France, instead, the transitional period is closed: whoever did not inform in time must collect consent for non-exempt pixels, or stop using them, barring objective and documented delays.

5. Offer granular withdrawal

This is the most technically demanding point, and the one that separates serious compliance. Whoever does not want to be tracked must be able to keep receiving the newsletter, but without a pixel. Withdrawal can be total or partial, and the Garante suggests keeping it simple: a link or a recognizable icon in the footer of every email, leading to an area where preferences are managed. Whoever refuses tracking cannot be penalized: they must have full enjoyment of the service.

Not all sending platforms offer this yet, and not all give it the same prominence. In your checks, the question to ask is precise: after withdrawal, is the pixel removed from the email, or does the platform merely stop recording its events? It is not a detail: if the pixel stays in the message, when it is opened the access to the recipient's device happens anyway, and the data reaches the platform's servers regardless. The mechanism must be implemented and communicated to users, and it distinguishes two planes: for future sends, the platform must omit the revoked pixel; for emails already sent, which cannot be modified, the solution expressly indicated by the CNIL is to ignore entirely the requests associated with it, without recording new events. Merely hiding the statistics in the panel is not enough. And there is a further effect: when the processing was based on consent, withdrawal also entails deleting the data already collected, if there is no other legal basis for keeping it.

6. Check whether you fall under the exemptions

Not all tracking requires consent, and the exemption does not depend on who sends: it depends on the purpose of the individual tracking and on the type of message. The same company can have newsletters whose pixels require consent and service emails whose pixels do not. Article 122 of the Privacy Code provides exemptions that the guidelines apply to pixels: the three most common cases are these.

• anonymous aggregate statistics, and only in certain cases: the count measures the overall opening percentage without differentiating individual users, with effective anonymization of the IP address and other technical data, and serves purposes such as deliverability and anti-spam, which the guidelines cite by way of example; measuring campaign effectiveness is not covered by the exemption, and aggregate data cannot drive decisions about the individual recipient;
• security purposes, such as messages related to authentication: account confirmations, password resets;
• institutional and service communications the controller is obliged to send: data breach notifications, contractual changes, security notices.

Even in these cases the exemption is not automatic: the pixel must be necessary for that specific purpose, in the individual type of message, and proportionality and minimization remain. The Garante gives the example of an authentication code verified on a terminal already known to belong to the user: security justifies that targeted check, not any pixel in any service email. Two clarifications complete the picture: the aggregate exemption concerns openings, not clicks, which do not appear in the guidelines; and it is an Italian exemption, because the CNIL does not recognize an exemption for anonymous aggregates, either for openings or for tracked links. Those with recipients across the border, relying on aggregates alone without consent, are not covered.

To understand who is exempt, the clearest example is an e-commerce, with one reading rule: in Italy it is not the category of email that decides the exemption, it is the strict necessity of the pixel in the individual case. The order confirmation to a consumer is an obligation, but the pixel accompanying it is exempt only if it is also necessary to verify that the message was taken note of. The welcome email can fall under the exemption when it completes account activation or authentication, not when it is merely promotional. The shipping notice must be assessed against concrete obligations and logistics needs. The abandoned cart is a no: the CNIL classifies the recovery email as promotional, and the pixel it contains does not benefit from the exemption, so it requires consent; review requests, as a rule, do not benefit from the exemptions. Different is the French track for emails connected to a requested service, order confirmations and shipping included: there the CNIL's deliverability logic covers the pixel, provided it really serves only to measure delivery, adapt the channel and clean lists. The same shopkeeper, on the same day, handles tracking under different rules: it is the necessity of the individual pixel, purpose by purpose, that decides, not who sends.

It remains true in any case that the exemption concerns consent only: the privacy policy must still truthfully describe exempt pixels too, and the processing of the resulting data continues to answer to the GDPR.

The Italian Garante or the French CNIL: the differences in brief

If your processing falls under French law, for example because it involves recipients and devices in France, the recommendation the CNIL adopted on 12 March 2026 and published on 14 April also concerns you. The two authorities reach the same result on individual tracking, but diverge on concrete points, and they are not interchangeable.

References: for individual openings, Garante para. 6 and CNIL points 3.1-3.2; for tracked links, CNIL FAQ Q1 and EDPB Guidelines 2/2023 (paras. 49-51), while the Italian decision does not expressly address them.

On deliverability the settings diverge, for newsletters and promotional communications: Italy contemplates the exemption for anonymized global statistics but requires consent for individually managing inactive recipients; France admits the latter under strict conditions, including expressly requested newsletters if the pixel serves only that, and then allows anonymizing the data for totals. Two almost mirror-image logics: the clearest way to see why the two authorities cannot be confused.

Do you have recipients in more than one country and no country-split lists? The practical rule is simple: ask for consent for every form of tracking and do not count on the exemptions. The exemptions in the table hold only in their own country: the aggregate opening count that in Italy requires no consent is not exempt in France; and where a document does not address a point, like clicks for the Garante, silence is not permission. In practice: track only those who said yes, and leave without consent only the pixels strictly necessary for security and service emails. If instead you want to exploit a country's exemptions, split your lists by country and apply each regime to its own, after making sure the applicable law really is that one. It is a prudent choice.

In France the transitional period for addresses already collected is closed: whoever has not yet informed recipients must collect consent for non-exempt pixels, or stop using them.

Ready-made texts, with the My Agile Privacy® guided procedure

The most delicate part of compliance is making the signup form and the privacy policy say the same things. The My Agile Privacy® Policy Assistant helps here too: in the guided procedure, at the site features step, you find the checkboxes dedicated to email pixels (openings, clicks, service emails), for sites subject to the GDPR or UK legislation, and the privacy policy is composed with the paragraphs matching what you declared.

With tracking active, the Assistant lists the requirements you and your sending platform must meet, from the ban on pixels and tracked links for those who do not consent to the withdrawal link in every message, up to the platform processing data only on your behalf, and asks for an explicit confirmation before proceeding. One button opens the window with the ready-made texts for the signup form, in 32 languages: the newsletter checkbox and the optional tracking one, with the variant including clicks, to copy as they are, with instructions for using them, including keeping proof of every choice, and double opt-in recommended in every case. The Assistant does not configure your sending platform: that check remains yours, and it is the reason for the confirmation requested.

The feature is available from version 3.4.1 of My Agile Privacy®.

Any doubt about your setup, or want to understand which of your communications fall under the exemptions? Write to us from the contact form: real people answer, who deal with consent and privacy policies every day.