How many emails have you received in the last few days asking for permission to know when you open them?
Banks, couriers, tour operators and publishers have all sent them. It is no coincidence: 29 October 2026 was the deadline for complying with the guidelines of the Italian Data Protection Authority (Garante) on the use of tracking pixels in email. For anyone doing email marketing, this is not a technical detail. It changes the relationship between what is measured and what recipients know they are allowing to be measured.
What the Garante has established
Measure no. 284 of 17 April 2026, published in the Italian Official Journal on 29 April, starts from one observation: a tracking pixel is an invisible image that, when it loads, tells the sender the email has been opened, often together with the time, device and IP address. As a rule, the recipient does not notice.
This is why the Garante brings it under Article 122 of the Italian Privacy Code, the same provision that governs cookies, and derives three rules from it.
- Always inform. Anyone using pixels must say so, whatever the type of email: commercial, service or institutional.
- Ask for consent when measurement is individual. It is required if the open data of an individual recipient is used to evaluate campaigns, adapt frequency and content, or infer interests. For commercial emails it can be collected together with consent to receive communications, provided the request is clear and not forced.
- Allow granular withdrawal. Recipients must be able to choose between no longer receiving emails and continuing to receive them without tracking.
Consent is not required, however, for overall open statistics collected with the same pixel for all recipients of a campaign, for certain security measures, and for communications the sender is obliged to send.
For lists already in use, the Garante provides a transitional regime: recipients are informed with the first available mailing and offered the option to withdraw. For contacts collected from now on, the ordinary rule of prior consent applies.
Opens and clicks
The guidelines focus on pixels, that is, on opens. But the logic behind them, transparency towards recipients and their control over what is measured, applies in general to any form of individual measurement of interactions with an email.
That is why at ConnyLine we chose to apply the same safeguards to all individual measurement: a clear privacy notice, consent, and the option to opt out while staying subscribed.
What does not change: you can keep measuring
The new rules do not take measurement away. They move the line between what is measured for everyone and what is measured per person.
- For all recipients, the figures needed to evaluate a campaign remain available: total opens and clicks, clicks per link, click rate.
- For those who have consented, individual data also remains available: who opened, who clicked, the contact's history, behaviour-based automations.
In other words, you lose the detail on people who do not want to be observed. You do not lose the ability to understand whether a communication works.
How ConnyLine works
We redesigned the platform starting from one question: how can our customers keep measuring without being exposed to a risk that, as data controllers, would fall on them?
- Every contact has a tracking status: consent yes, consent no, unknown. Each status is recorded with date, source and privacy notice version, so that it can be demonstrated.
- Every list has a declared status. When uploading, the customer states whether consent exists, whether it is a list already in use or whether consent is missing. Without a declaration, the list cannot be uploaded.
- Every campaign goes out in two versions. ConnyLine automatically sends the tracked version to those who have consented and the version without individual tracking to everyone else.
- No personal identifier without consent. Contacts who have not consented receive emails without any element that identifies them individually.
- The recipient's choice prevails. Neither the customer, nor an import, nor an API integration can reactivate tracking for someone who has refused it.
- Every email contains the "Manage preferences" link, added automatically to the footer: recipients can opt out of tracking while staying subscribed, or unsubscribe.
- Consent is never pre-ticked. A pre-ticked box is not valid consent: the Court of Justice of the European Union ruled this specifically for tracking tools.
What to do now
For ConnyLine users, compliance comes down to five steps.
- Update the privacy notice on your website, starting from the template available at the bottom of this page.
- Update your sign-up forms with a clear consent box that is not pre-ticked. You can use the form available on the platform, which can be embedded in your website's HTML.
- Declare the status of each list, whether already uploaded or new.
- Send the "Informativa tracciamento" (tracking notice) template to lists already in use, before any other campaign.
- Review automations triggered by opens or clicks: they will only run for contacts who have consented.
The privacy notice and texts should then be validated by your privacy consultant or DPO: no platform, on its own, makes a sender compliant.
A choice about trust
In recent days, some have chosen to stop tracking their emails altogether and have presented it as a commitment to their readers. Others have asked for consent with clear wording and a visible button. Others have simply added a line to their privacy notice.
There is no single answer. But the question to ask is always the same: which data do I really need to make decisions, and which am I collecting just because I can?
For ConnyLine customers
We have prepared two practical tools, available in the reserved area of the website:
- Email tracking guide: how the platform works in detail, the email template for lists already in use, and ready-to-use texts for forms and the preference centre.
- Tracking privacy notice template: the text to adapt and publish on your own website.
You need to sign in with your ConnyLine account to read them.
This article is for information only and does not constitute legal advice.