Italy turned email tracking pixel consent into a hard deadline, and it falls on October 28, 2026. Almost all of the coverage so far has been written for newsletter teams with an opt-in form to amend. If you run cold outbound, the problem is harder, because the rule leaves you no compliant lane at all.
That is a stronger claim than the usual compliance note, so here is the reasoning up front. The Italian measure permits open tracking where the recipient gave prior consent, and it offers a transition for addresses already on file that depends on informing those recipients and letting them object. Both routes presuppose a relationship that existed before the email. Prospecting has no such relationship by construction. The first contact is the email.
The practical consequence is narrow and concrete: for recipients in Italy and France, open tracking on a prospecting sequence has no basis you can point at, and the fix is a sending setting rather than a copy change. Most teams have not made it because most teams do not know where the pixel is switched.
What the email tracking pixel consent rules actually require
The email tracking pixel consent rules in Italy and France require prior, informed, opt-in consent before a sender may place a pixel that fires on open and identifies the individual recipient, on the same legal footing that governs cookies.
The mechanism matters more than the label. Neither authority reasoned about marketing ethics or about whether open rates are useful. Both reasoned that a one by one image requested from your server when a message is rendered reads information from the recipient's device, which puts it inside Article 5(3) of the ePrivacy Directive rather than inside the general balancing tests of the GDPR. Once a practice sits there, consent is the gate and legitimate interest is not on the menu. That is the whole of it, and it is why arguing about the commercial reasonableness of open tracking does not move the analysis.
The two regimes agree on the principle and differ on the details, and the differences are the part worth memorising, because a single European sequence touches both. Twilio's own summary of the Italian open pixel rules for senders is a reasonable starting point if you need to brief a legal team, though like most of the available guidance it is written for subscriber mail.
| QUESTION | FRANCE, CNIL DELIBERATION 2026-042 | ITALY, GARANTE PROVISION NO. 284 |
|---|---|---|
| Adopted and published | Adopted March 12, 2026, published April 14, 2026 | Adopted April 17, 2026, published April 29, 2026 in Gazzetta Ufficiale No. 98 |
| Transition for addresses already on file | Closed July 14, 2026 | Closes October 28, 2026 |
| Addresses collected after publication | Consent required from the moment of capture | Consent required from the moment of capture |
| Can pixel consent ride on the marketing opt-in | No, it must be separate and purpose specific | Yes, it may be bundled into the general marketing consent |
| Anonymous aggregate open rates | Not accepted as an exemption | Permitted if the pixel is identical for every recipient on the campaign and IP and client data are anonymised |
| Legitimate interest as a basis | Not available | Not available |
| Reach beyond the country | Follows the recipient, so foreign senders are covered | Follows the recipient, so foreign senders are covered |
Read the fourth row twice if you sell into both markets. Italy lets you bundle pixel consent into a marketing consent and France does not, which means a consent string that is lawful for an Italian subscriber can be insufficient for a French one. Lifecycle teams can build for the stricter of the two and be done. The relevance for outbound is different and sharper, and it is the subject of the next section.
Why cold outbound cannot satisfy a prior consent test
Cold outbound cannot satisfy a prior consent test because every compliant route in both measures depends on a prior interaction with the recipient, and prospecting has no prior interaction by definition. The first contact is the message itself.
It is worth being precise about this rather than gesturing at it, because the gap is often papered over in vendor guidance that quietly assumes a subscriber. There are three doors in the Italian provision and a cold prospect walks through none of them.
Notice what this is not. It is not a claim that cold email into Italy or France is unlawful, which is a separate question governed by different rules and different national carve outs for business to business contact. The claim is narrower and more awkward: you may well be entitled to send the message, and separately not entitled to measure whether it was opened. Those two permissions come from different places and they do not travel together.
Outbound teams are used to compliance arriving as a disclosure obligation, something you satisfy by adding a line to the footer. We walked through one of those when the EU AI Act's disclosure duty landed on automated outreach. This is not that shape. No sentence you add to the email makes a non consented pixel lawful, which is why the remedy lives in your sending configuration rather than in your copy.
The email tracking pixel consent exemptions do not cover prospecting
The published exemptions from email tracking pixel consent cover authentication and transactional messages, a narrow deliverability hygiene use, and in Italy only, genuinely anonymous aggregate statistics. A prospecting campaign fits none of the three.
Each one is worth reading closely, because each is being cited loosely in the guidance circulating this month, usually by people with a product to sell. The authentication exemption is the least interesting and the clearest: password resets, multi factor codes and account verification mail can carry what they need to carry. Nobody is running a prospecting sequence through that door.
The deliverability exemption is the one being stretched hardest, and its conditions are unusually specific. It applies to transactional mail rather than promotional mail, it exists so a sender can identify and drop genuinely inactive recipients, and the platform may retain only the date of the last open, at day level, with no time component. A prospecting sequence is promotional by purpose, so the exemption's first condition excludes it before the retention limits are even reached.
The third exemption, anonymous aggregate open rates, is the one that sounds like a solution and is not. Italy permits it on conditions: the pixel must be identical for every recipient on the campaign, and IP and client data must be anonymised. An identical pixel cannot tell you who opened, only how many did. That is fatal for outbound, because nobody runs a prospecting sequence on a campaign level open percentage. The open event is used to branch the sequence, to score the lead and to time the follow up, and all three of those uses require knowing which person opened. France does not accept the aggregate exemption at all, so a pan European programme cannot lean on it even in the degraded form.
There is also a reporting consequence that is easy to miss until a dashboard starts moving for reasons nobody can explain. If open tracking goes dark for part of a list, the open rate denominator changes while the numerator changes differently, and the resulting percentage is not comparable to last quarter's. The arithmetic below is a straight illustration of how much of a campaign's open measurement disappears at various shares of Italian and French recipients. It is not measured data from any programme, it is division.
Share of a campaign's open measurement that becomes unavailable, by the proportion of recipients located in Italy or France. Illustrative arithmetic to size the reporting distortion, not measured results from any sending programme
The honest reading of that chart is that the distortion is a measurement problem rather than a performance problem, and the two get confused constantly. Nothing about turning the pixel off changes how many people read the message. It changes how many reads you can see, which is a different number that happens to sit in the same column of the same report. We made a related argument when we took apart why published open rate benchmarks mislead outbound teams, and the mechanism there was the same: an unstable denominator presented as a performance trend.
Your sequencer cannot express the distinction
The operational obstacle is not legal interpretation but tooling, because open tracking in most sending platforms is a workspace or campaign level switch while the consent question attaches to the individual recipient's location.
This is the part that turns a clear rule into a messy project. The rule follows the recipient. The setting follows the campaign. When the granularity of the obligation is finer than the granularity of the control, somebody has to absorb the difference, and there are only a few ways to do it.
| WHERE OPEN TRACKING IS SWITCHED | WHAT YOU CAN ACTUALLY SUPPRESS | WHAT IT COSTS |
|---|---|---|
| Workspace or account level | Everything, for every recipient in every campaign | All open data everywhere, including markets with no consent question at all |
| Per campaign or per sequence | Opens for an entire campaign | You must split European sends by country, which fragments sequences, sending volume and reporting |
| Per recipient or per contact field | Exactly the recipients who need it | Rarely exposed as a setting, so most teams cannot take this route today |
| Per message within a sequence | Nothing useful, because the question follows the recipient and not the step | A false sense of control, and a configuration nobody can audit later |
For most teams the realistic answer is the second row: segment European prospects by recipient country and run Italian and French recipients in sequences with open tracking disabled. It is more administration than anyone wants, it degrades your sequence branching for those segments, and it is defensible, which the alternative is not. The teams that will struggle are those that built branching logic on the open event, because that logic has to be rewritten rather than merely reconfigured.
If you are rebuilding the measurement anyway, rebuild it on signals that never touched the device. Replies, bounces, complaint rates and placement testing all survive this rule untouched, and they were the more honest instruments before it existed. Our view of the reply rate as the diagnostic that actually carries information has not changed, and the mechanics of reading hard bounces against soft bounces on a prospecting domain matter more once the open column is gone. This is also the moment to look hard at whether your reporting and analytics layer can survive losing an input it was probably over indexed on.
What October 28 changes in practice
October 28, 2026 closes the Italian transition for addresses collected before April 29, 2026, which removes the last conditional permission an outbound programme could have been relying on for Italian recipients.
Be clear about what does and does not change on that date. Addresses collected after publication have required consent since April 29, so for a programme that sources prospect data continuously, most of the list has been inside the consent regime for nearly six months already. What ends on October 28 is the grandfathering, not the rule. If your compliance position has been that the transition covers you, that position expires, and it was always thinner for prospecting than for subscriber mail because the transition's own conditions assumed a subscriber.
France is the more instructive case precisely because its deadline has already passed, and the legal analysis of the CNIL recommendation set out the device access reasoning before Italy adopted its own version. The French transition closed on July 14, 2026, and the authority indicated it would begin compliance work after that point. Any outbound programme that mails into France and still carries identifying open pixels has been outside the window for three months, not fifteen days. If you discover one problem while reading this, it is likelier to be in France than in Italy, and it is already overdue.
The broader pattern is familiar to anyone who has watched the inbox providers tighten requirements over the last two years. A rule lands, the guidance is written for the largest and most legible sender type, and prospecting teams discover six months later that the guidance never addressed their case. We saw the same thing when the Gmail bulk sender requirements were read as a business to business rulebook by teams whose sending profile looked nothing like the one the rules described. The defence is the same each time: read the actual scope line, work out whether your programme is inside it, and stop waiting for guidance aimed at you.
What to do before the deadline
The work before October 28 is a configuration audit and a segmentation change, not a legal project, and a competent operations person can complete the whole sequence in a few days.
None of what follows requires outside counsel to begin, though the policy wording at the end benefits from review. The ordering matters: find the switch before you argue about the policy, because teams routinely discover the pixel is on in places nobody remembered configuring.
The last play is the one with value beyond compliance. An outbound programme steered by open rate has been steering by the noisiest instrument on the dashboard for years, and the teams that already moved to reply and complaint based measurement will spend about an afternoon on this deadline. Our own engagements run on that basis for reasons that have nothing to do with European regulators, which is the sort of thing a cold email agency only finds out by watching the same dashboards go wrong across a lot of accounts. The regulation is forcing a decision that was overdue on the merits.
One caution against overcorrecting. This is a rule about a specific tracking mechanism in two countries, not a general verdict on measurement, and ripping out every pixel worldwide to feel safe will cost you real signal in markets where no such requirement exists. Scope the change to the recipients it covers, document the scoping, and keep the instrument where it is lawful.
See where you are cited today
A free snapshot audit of your rankings and AI citations before we ever talk.
Josh leads work at the intersection of SEO and generative engines at Something Inc., helping B2B brands get ranked and cited across every major AI engine.