Translated automatically by AI from the Italian original.
ROME – The final deadline passed on 29 October for companies, email platforms and newsletter managers to update their privacy notices, collect consent and implement opt-out systems in line with the new guidelines from the Italian Data Protection Authority on tracking pixels.
A major regulatory change that the consumer association Codici is now highlighting to inform citizens of their rights and push businesses towards genuine digital transparency.
What are tracking pixels and what the Authority says
Tracking pixels (or tracking bugs) are tiny, transparent 1×1-pixel images, effectively invisible to the user, embedded in emails and hosted on remote servers. When the email application downloads the image, the sender is notified whether, when, how many times and on which device the email was opened, all without the recipient’s knowledge.
The Authority’s recent directives apply the provisions of Article 122 of the Privacy Code to this technology:
- General ban and prior consent: a blanket prohibition on tracking is established, with specific exceptions. Outside those exceptions, anyone sending marketing emails, commercial newsletters or automated order confirmations must obtain explicit prior consent from users.
- Mandatory transparency: the use of tracking pixels must be clearly disclosed to the recipient before the message is sent.
Codici’s stance: “No more hidden tracking”
Antonella Votta, the lawyer who heads Codici’s Privacy and New Technologies sector, stressed the significance of the change:
“For years, millions of people have been monitored every time they opened a newsletter or a promotional email, without knowing it and without ever giving consent. The Authority’s guidelines are a step in the right direction. Transparency is not optional and hidden tracking can no longer be the norm. Now, however, we need the rules to be respected and effective checks. We urge businesses to comply seriously, without looking for shortcuts, and we call on citizens not to remain passive: blocking remote images, requesting information and withdrawing consent are simple, effective tools. Anyone who encounters violations can report them to our help desks: we will stand by consumers even in dealings with the Authority.”
— Antonella Votta, Privacy and New Technologies lead, Codici
How to protect yourself and what businesses must do
For consumers: there are three practical ways to protect yourself: disable automatic loading of remote images in your email client, check whether the sender has obtained proper consent, and exercise your GDPR rights (access, objection and erasure) or inspect the message source code (select “Show original” in Gmail) for 1×1-pixel image strings. If a company fails to respond, you can report it to the Authority.
For businesses: all companies and email marketing platforms must map their tracking tools and providers, update their privacy notices and processing records, review contracts with external sending platforms and provide simple, selective consent withdrawal mechanisms.
