I Read Europe's Email Tracking Pixel Rules: Italy's Deadline Is October 29, and the Open Rate Was Already Lying

On October 29, Italy’s grace period for email tracking pixels ends. France’s transition for existing addresses ended on July 14. Germany has no new date: the ePrivacy rule is already in its law, and the one German authority view I found says it covers counting pixels.

Most marketers I talk to ask the same question: how do we keep our open rates?

Wrong question. The open rate was already lying to you. The law only made the lie harder to ignore.

I read the primary texts: the Italian Garante’s guidelines, the French CNIL’s recommendation and its Q&A, and the EDPB guidelines both are built on. I work from Switzerland, where the ePrivacy Directive is not law, so I also checked what happens when a Swiss sender writes to Italian, French or German inboxes.

This is what I found, and what I would change on Monday.

It is my reading of public texts, not legal advice. For your consent wording and privacy notice, ask your lawyer or data protection adviser. Last checked: October 11, 2026.

Key Takeaways

• Italy’s deadline is October 29, 2026. The Garante’s guidelines of April 17 give six months from their publication in the Gazzetta Ufficiale. The authority says it will check compliance in the second half of 2026.
• The base rule is European, not Italian. The EDPB says a pixel in an email falls under Article 5(3) of the ePrivacy Directive, the cookie rule. Each country enforces its own version of it.
• France is stricter and earlier. Its transition for existing addresses ended on July 14, and even anonymous, aggregated pixel data needs consent there.
• Germany has the same rule and no new date. Its federal commissioner is reported to say that a counting pixel is not technically necessary for a newsletter.
• Where your subscribers live decides which authority can act on you, not where your company sits. According to the EDPB and the CNIL, there is no one-stop-shop for this rule.
• The fix is mostly configuration. Stop tracking individuals by default, ask for consent where you collect the address, and add a footer link that switches off tracking only.

What Is an Email Tracking Pixel?

An email tracking pixel is a tiny, usually invisible image hosted on the sender’s server and embedded in an email. When the reader opens the message and images load, their device requests that image, and the sender learns that the email was opened, when, and on which device.

Three details matter, all from the Garante’s text.

First, the pixel is usually unique to you: the Garante writes that trackers are “as a rule unique for each recipient” (my translation). The request can carry an identifier, your IP address and your device type, and it can show how long the message stayed open and how many times.

Second, they are common. At the one email provider and the one marketing automation platform it inspected, the Garante found pixels in “almost all cases” (my translation).

Third, there is an off switch, and it belongs to the reader. No image download, no pixel. A subscriber who reads in plain text leaves no trace, and the Garante says so itself.

You can see your own in five minutes. Send yourself your latest campaign and open the message source. Look for images one pixel wide, images with no visible content and image addresses with long strings of characters.

Not every pixel looks like that, so ask your vendor too. The Garante notes that tracking pixels have no standard name or syntax, which means that searching the source for the word “pixel” may find nothing.

I like these details because they put the law in perspective. The pixel is not magic. It is an image request, and a surprising amount of marketing hangs on it.

Why the Open Rate Was Lying Before the Law Arrived

Apple said it plainly in 2021. With iOS 15, Mail Privacy Protection “stops senders from using invisible pixels to collect information about the user.” It “helps users prevent senders from knowing when they open an email.”

Read that twice. A feature exists to stop senders from knowing when you opened an email.

Your dashboard still reports opens, with a timestamp. For anyone using that feature, I would not trust the number.

Add readers who block images or read in plain text. The open rate stops measuring attention. It measures a mix of humans, privacy tools and silence.

My rule is simple. Treat the open rate as a rumor, not a metric. I would not change a subject line, a send time or a segment on opens alone.

With valid consent, the pixel is allowed under this rule. I am not telling you to ban it. I am telling you to stop treating its output as the truth.

One European Rule, Many National Enforcers

The base rule is not Italian. It is European.

Article 5(3) of the ePrivacy Directive, the cookie rule, says that storing information on someone’s device, or reading information already stored there, needs consent. The main exception is what is strictly necessary for a service the person asked for.

Does a pixel in an email count? The EDPB gave its answer in its Guidelines 2/2023, final version of October 7, 2024. It says that in an email the sender may include a tracking pixel to detect when the receiver reads it, and that the image lands on the reader’s device “at the very least through the caching mechanism of the client-side software.”

The conclusion: “Article 5(3) ePD is applicable, even if this storage is not permanent.” The identifier the device sends back counts as a “gaining of access.”

Each EU country wrote this rule into its own law and gave it to its own regulator. These are the three I checked:

• Italy: Article 122 of the privacy code.
• France: Article 82 of the Informatique et Libertés law.
• Germany: § 25 TDDDG.

Here is the part that surprises people. According to the EDPB and the CNIL, there is no one-stop-shop for this rule. The GDPR lets a company deal mainly with the regulator where it is based. The ePrivacy rules do not work like that.

An internal EDPB paper from June 2021 says each authority enforces its national law “as far as it concerns users located in its territorial jurisdiction.” The CNIL repeats it in its FAQ on email tracking pixels: the European cooperation mechanism does not apply to these checks. Translation: the country where your subscribers live decides which authority can act, not the country where your company is registered.

Authorities can also look past their borders. The EDPB says that when a sender has no establishment in a country, national law “may provide other criteria” to enforce the rule. The CNIL says it can act against companies outside the EU when their pixels track people in France and the conditions of the law are met.

Italy: What the Garante Expects by October 29

The text is provvedimento no. 284 of April 17, 2026, published in the Gazzetta Ufficiale on April 29. It gives six months to comply. The Garante also published a nine-section vademecum.

On October 5, the Garante restated the date in its own notice: “By October 29, 2026, companies, platforms and newsletters must adapt notices, consents and withdrawal systems” (my translation). Some sources say October 28. The Garante’s notice says 29.

The rule and its exceptions

The default is no. Using a pixel is forbidden unless an exception applies. The first exception is consent that is informed, free, specific and unambiguous.

The Garante names three cases that need no consent. It calls them examples, and the sender must check that its own case fits.

• Aggregated statistics. A count that measures the overall opening percentage, anonymized. The Garante suggests the same pixel for every recipient of a campaign, and anonymized IP and client data.
• Authentication security. Account activation, password resets, data-rights requests.
• Service messages the sender must legally send. Contract changes, privacy notices, security incidents, phishing warnings, deadline reminders.

Tracking individuals to improve promotional campaigns needs consent. That includes changing the subject line after low opens, sending less to people who do not open, and building commercial profiles from reading behavior. Much of what “email optimization” means falls here.

Consent and withdrawal

One consent can cover both, in principle. Consent to the pixel can sit inside consent to receive promotional emails, if the request is “neutral and free of pressure” (my translation). The best moment is when you collect the address.

Every recipient needs a way out, in two sizes. The Garante’s example is a link or icon in the footer that leads to a page. There, the person can stop all emails, or stop only the tracking and keep the emails. Refusing tracking cannot reduce the service, and you must record the choices.

Privacy by design. The Garante suggests an opaque, non-sequential ID per recipient, matched to the email address in a separate internal layer. The address then never appears in the pixel request.

Existing lists and enforcement

Existing lists get a transition. The Garante calls it a transitional regime, only for processing already in progress, to be phased out progressively. If you already send with pixels, inform people with your first useful send, then add and announce the granular withdrawal.

It covers everyone. Senders, sending platforms, list renters and tracking vendors. Newsletters, promotional mailings, automated messages and service emails. The text makes no exception for B2B.

And then? The Garante says that checking these guidelines is part of its planned inspections in the second half of 2026. The text names no fine amounts. It does say that a pixel that stays hidden would make the related processing unlawful, and that pixels used without information cannot be used.

A worked example. You send a monthly newsletter to 4,000 contacts, 600 of them in Italy and 400 in France. Your platform tracks opens per person.

For the 400 French contacts, the CNIL’s transition ended in July. Unless you sent the information email in time for addresses collected before April 14, you need consent, or no pixel. For the 600 Italian ones, the Garante lets existing contacts stay under its transition: inform them with your first useful send and offer the footer switch, all before October 29.

The other 3,000 depend on where they live. Germany applies the same ePrivacy rule today, and purely Swiss contacts fall under Swiss law. One clean version is still cheaper than three.

My take: the aggregated statistics exception is the sleeper, but only in Italy. If your provider can send one identical pixel per campaign with anonymized IP and client data, you may keep a campaign-level count there.

France still wants consent for it, and the German commissioner sees counting pixels as consent territory. Check each market before you rely on it.

France: The Strict Older Sibling

France published first. The CNIL adopted its recommendation on March 12, 2026, as deliberation no. 2026-042, and published it on April 14. It rests on Article 82 of the Informatique et Libertés law and follows the same EDPB guidelines.

It asks for prior consent for four uses: analyzing the open rate to optimize campaigns, building profiles, analyzing suspected fraud, and individual deliverability measurement outside the exempt cases.

It allows two narrow exemptions: authentication security, and deliverability (checking that your emails still reach the inbox) limited to the date of the last known open, the day and not the time, for emails the recipient asked for.

The details are strict. Consent is best collected with the address, and silence counts as a refusal. Refusing must be as easy as accepting, and waiting six months before asking again is the CNIL’s good practice.

Then comes the part that hurts. Anonymous data does not help. Question 18 of the CNIL’s FAQ asks whether anonymous or aggregated data removes the consent duty. The answer is no: Article 82 applies “que les données concernées soient personnelles ou non” (my translation: whether or not the data are personal).

The Italian exception for aggregated statistics has no French twin. If you send to both countries, France sets the bar.

The transition is over. Addresses collected before April 14 could keep their pixels if the sender clearly informed people within three months and nobody objected to the pixel, and that window closed on July 14.

Without the information email, the CNIL says to collect consent or stop using the pixels. It allows a longer delay only with documented reasons.

The recommendation applies to every email, whatever the context, professional addresses included. It does not directly cover tracked links, but the CNIL says they follow the same logic.

Germany: No New Date, Same Rule

Germany wrote the same ePrivacy rule into § 25 TDDDG, the former TTDSG. You need consent for what is not technically necessary for the service the reader asked for.

The Federal Data Protection Commissioner has given a clear view, as ComputerWeekly reports in German. A counting pixel is not technically necessary for a newsletter, so recipients must consent beforehand. A pixel without consent is conceivable only if no personal or other user data are collected, and for tracking pixels that is not the case as a rule.

The conference of German data protection authorities discussed newsletter tracking at its 110th meeting. It announced a publication for 2026 to point out the legal situation. I found no published text yet.

So German senders have no October date to hit. They have a rule that is already in force, a federal commissioner’s view reported in the press, and an announced publication.

Switzerland: Outside the Directive, Not Outside the Problem

I work from Switzerland, so this part is personal.

The ePrivacy Directive is not Swiss law. I found no Swiss authority statement saying that email pixels need consent. What Swiss law does say:

• Mass advertising by email needs prior consent (Unfair Competition Act, Art. 3(1)(o)). In short, the exception covers your own customers, for similar products, with an easy opt-out. I wrote about it in the Moccogni Consulting guide to email marketing for Swiss SMEs.
• The telecom act (Art. 45c) allows processing data on someone else’s device for telecom services and billing, or if users are informed about the processing and its purpose and told they may refuse. As far as I found, no Swiss authority has said whether that covers pixels in emails.
• The revised data protection act applies when a pixel processes personal data. Intentional breaches of some of its duties can lead to fines of up to CHF 250,000 for the people responsible. I found no Swiss case about pixels.

None of that shields you when you write to Italy, France or Germany. Their authorities can apply their own rules to the inboxes of the people who live there.

My opinion: build to the strictest rule you meet. Keeping three versions of one newsletter costs more than keeping one clean one.

Three Myths I Keep Hearing

“We only use it for statistics.” In Italy, statistics are exempt only when they are anonymous, for example one identical pixel for every recipient of a campaign. If your platform knows who opened, it is not statistics. It is tracking.

“My email platform handles compliance.” The platform runs the mechanics. The Garante describes the sender as the one who decides whether to use pixels and for what purpose, even when a vendor manages them. It also asks every party in the chain to define its role and mentions joint controllership.

“We are not based in Italy or France.” Your subscribers might be. A Swiss company with a few hundred Italian addresses is a sender with Italian recipients, and an authority can look at where the recipients live.

What I Would Change on Monday

I started with my own newsletter. The code that sends it contains no open pixel, and the only images in the emails are article thumbnails hosted on my site. I checked the code on October 11, 2026.

Your setup may not be so lucky, so here is the order I would work in.

1. List every system that emails your contacts. Newsletter tool, CRM, shop, support desk, booking tool. The Garante counts automatic and transactional messages, not only newsletters.
2. Switch off individual open tracking. Most email platforms have a setting for it. If yours does not, ask your vendor in writing what its pixel records.
3. Ask for consent where you collect the address. One neutral, unforced request that covers the emails and the measurement. A starting point, not tested wording: “Send me your newsletter. Record whether I open it, and on which device, so you can improve it. I can switch off the recording any time from the footer.” Plain, specific and easy to undo. Have your lawyer check the final wording.
4. Add the two-switch footer. “Stop all emails” and “Stop tracking, keep the emails.” Two links, one page, no guilt trip.
5. Send the transition notice. In Italy, inform people with your first useful send. In France, the three months have passed, and consent is the route.
6. Ship a pixel-free version for people who say no. The Garante says that refusing tracking must not limit the service.
7. Keep a consent log. Who agreed, when, to which wording, in which language. If your list is multilingual, the wording must be too, and I wrote about running newsletters in several languages before.
8. Use opaque IDs. If you keep any per-recipient pixel, make sure the email address never appears in its URL.

What to Measure Instead of Opens

If opens are a rumor, what is real? Four things I would put on the dashboard.

• Replies. The best signal in B2B, and a pixel cannot fake it.
• Conversions per send, measured with campaign parameters on your links and your own analytics. Analytics on your own site has its own consent rules. I wrote about the formula and the measurement problem behind marketing ROI.
• List health. Unsubscribes, spam complaints, bounces and growth.
• Revenue per thousand emails sent. It ends most arguments about subject lines.

A note on clicks. The Garante’s guidelines are about pixels.

The CNIL says tracked links are not directly covered by its recommendation, but they also read from and write to the device, so Article 82 applies to the people who use them. Treat link tracking with the same care until a regulator says otherwise.

FAQ

Do I need consent for email tracking pixels in Europe?

In most cases, yes. The EDPB says Article 5(3) of the ePrivacy Directive applies to pixels in emails. Exceptions are narrow: security, messages you must legally send and, in Italy, anonymized aggregate statistics, which France does not allow without consent.

Why are tracking pixels controversial?

They are hidden. The Garante calls them particularly invasive because they work without the recipient knowing. The pixel is usually unique to you and can carry your IP address and device type.

Does it apply to B2B and service emails?

Yes to B2B. Service emails are covered too, with one narrow exception: messages the sender must legally send and for which knowing they were read matters.

Is click tracking affected?

The guidelines are about pixels. The CNIL says tracked links follow the same logic. Until a regulator says more, assume they need the same transparency and a way out.

Will the EU change the rule?

The European Commission proposed changes to the cookie rules on November 19, 2025, in the Digital Omnibus. As of October 11, 2026 it is a proposal under negotiation, not law. Until it is adopted, today’s rules apply, and I would not build a compliance plan on it.

The Bottom Line

Email tracking pixels were never the point. The point is that email is a private channel, and Europe is done pretending a hidden image request is a harmless detail.

I think that is good news. Teams that stop chasing opens start reading replies, sales and complaints. That is where the signal always was.

The next deadline may not be about pixels. It could be about whatever invisible tracker comes after them. Build the habit now: know what you collect, say it plainly and give people a switch.

If you want a second pair of eyes on your setup, tell me which platform sends your emails. I will tell you what I would check first.