If your company sends out newsletters, this article is for you. It will take you four minutes. No legal jargon, no scaremongering.<\/p>\n\n\n\n
On April 17, 2026, the Data Protection Authority published the Order No. 284<\/a>, a technical document governing the use of \u201ctracking pixels\u201d in emails. Tracking pixels are tiny invisible images\u2014literally one pixel in size\u2014that email marketing platforms (Mailchimp, Brevo, HubSpot, FluentCRM, ActiveCampaign, and all the others) automatically insert into newsletters to detect when the recipient opens the message.<\/p>\n\n\n\n Following two inspections conducted between October 2025 and February 2026, the Data Protection Authority determined that the use of these pixels requires the explicit consent<\/strong> of the recipient. A generic newsletter subscription is no longer enough. The window of opportunity to comply is six months<\/strong> from the date of publication of the regulation in the Official Gazette. Failure to comply may result in penalties of up to 41% of annual revenue.<\/p>\n\n\n\n Anyone who sends emails to European recipients, regardless of where their company is based. Specifically: e-commerce businesses, employment agencies, professional firms, training schools, LMS platforms, associations, B2B companies with commercial newsletters, and B2C companies with periodic promotions. In WebWakeUp\u2019s client portfolio, that\u2019s practically everyone.<\/p>\n\n\n\n Leaving aside the technical details, the measure requires three specific adjustments.<\/p>\n\n\n\n The website\u2019s Privacy Policy must explicitly mention tracking pixels, explain what data they collect, and for what purposes. If your current policy refers generically to \u201canalytics tools,\u201d that is no longer sufficient.<\/p>\n\n\n\n Users must be informed, before subscribing, that the newsletter contains tracking pixels. Contrary to what some agencies are suggesting, a separate dual consent checkbox is not required: the Data Protection Authority has explicitly stated that a single request is sufficient, provided that the opt-out (see below) is granular.<\/p>\n\n\n\n This is the most technically challenging part. In addition to the standard \u201cunsubscribe\u201d link, every email must include a link to a page where the user can choose to either unsubscribe completely or continue receiving the newsletter without being tracked. Those who choose \u201cno tracking\u201d must continue to receive exactly the same content as everyone else\u2014you cannot penalize those who refuse tracking.<\/p>\n\n\n\n Most email marketing platforms today don\u2019t offer this feature out of the box. Building it properly is a project, not just a plugin to install.<\/p>\n\n\n\n Before you start thinking that every email now requires the recipient\u2019s consent, here\u2019s some good news: the Data Protection Authority has identified three situations in which tracking remains lawful even without explicit consent.<\/p>\n\n\n\n You can still see how many people in total opened a campaign\u2014for example, \u201c341% of recipients\u201d\u2014without knowing who specifically. The condition is technical: the platform must use an identical pixel for all recipients (not a different one for each) and must not collect data that allows individual users to be identified.<\/p>\n\n\n\n Registration confirmations, password resets, access codes, and responses to GDPR requests. Tracking is permitted in these cases because it helps verify that the message actually reached the intended recipient.<\/p>\n\n\n\n Contract amendments, important notices, data breach notifications, and deadline reminders. Consent is not required in these cases either.<\/p>\n\n\n\n Everything else\u2014and this is the point\u2014requires consent. Everything a corporate newsletter normally does: determining whether the subject line works, adjusting the frequency of emails based on reader behavior, distinguishing active readers from inactive ones, and personalizing the next message. This is exactly how email marketing platforms work by default, without needing to be configured. And this is exactly what needs to be rethought now.<\/p>\n\n\n\n As soon as the regulation was published, we read it in its entirety (all forty-eight pages) and drew up a compliance plan. WebWakeUp clients are already taking action on three fronts:<\/p>\n\n\n\n The difference between tackling this adjustment now and doing it in five months is the same as the difference between a move planned two months in advance and one pulled off in three days. The end result is different. So are the costs.<\/p>\n\n\n\n Three \u201cno\u201d votes out of three mean that the compliance effort must be planned now, not in August. In our experience, a job done right requires six to twelve weeks of coordinated work\u2014notification, stack, preferences panel, architecture, re-consent campaign, testing. The Data Protection Authority\u2019s six-month timeline isn\u2019t very long.<\/p>\n\n\n\n We offer a Free call<\/strong> to assess your situation. No obligation, and we won\u2019t send you a quote by email the next day without discussing it first. We\u2019ll give you an honest assessment of whether you\u2019re already set, if a targeted fix is all you need, or if a more comprehensive solution is required.<\/p>\n\n\n\n This is the kind of assessment you should make now, while you still have options. By October, time will be running out and your options will be limited.<\/p>\n\n\n\n \ud83d\udc49 Schedule a free call<\/strong><\/a> \u2014 We\u2019ll get back to you within 24 business hours.<\/p>\n\n\n\n Se la tua azienda invia newsletter, questo articolo ti riguarda. Ti servono quattro minuti. Zero legalese, zero allarmismo. Cosa \u00e8 successo Il 17 aprile 2026 il Garante Privacy ha pubblicato il provvedimento n. 284, un documento tecnico che disciplina l’uso dei “tracking pixel” nelle email. I tracking pixel sono piccole immagini invisibili \u2014 grandi letteralmente […]<\/p>\n","protected":false},"author":1,"featured_media":8416,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_breakdance_hide_in_design_set":false,"_breakdance_tags":"","footnotes":""},"categories":[12,121,98],"tags":[],"class_list":["post-8414","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-aziende","category-gdpr","category-siti-e-piattaforme"],"meta_box":{"fonti_e_risorse_dell_articolo":""},"_links":{"self":[{"href":"https:\/\/webwakeup.it\/en\/wp-json\/wp\/v2\/posts\/8414","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/webwakeup.it\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/webwakeup.it\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/webwakeup.it\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/webwakeup.it\/en\/wp-json\/wp\/v2\/comments?post=8414"}],"version-history":[{"count":1,"href":"https:\/\/webwakeup.it\/en\/wp-json\/wp\/v2\/posts\/8414\/revisions"}],"predecessor-version":[{"id":8415,"href":"https:\/\/webwakeup.it\/en\/wp-json\/wp\/v2\/posts\/8414\/revisions\/8415"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/webwakeup.it\/en\/wp-json\/wp\/v2\/media\/8416"}],"wp:attachment":[{"href":"https:\/\/webwakeup.it\/en\/wp-json\/wp\/v2\/media?parent=8414"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/webwakeup.it\/en\/wp-json\/wp\/v2\/categories?post=8414"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/webwakeup.it\/en\/wp-json\/wp\/v2\/tags?post=8414"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Who is involved<\/h2>\n\n\n\n
The three things you'll need in six months<\/h2>\n\n\n\n
1. An updated privacy policy<\/h3>\n\n\n\n
2. Clear consent to enrollment<\/h3>\n\n\n\n
3. A settings panel in the footer of every email<\/h3>\n\n\n\n
When consent is not required: the three exceptions<\/h2>\n\n\n\n
1. Anonymous and aggregated statistics<\/h3>\n\n\n\n
2. Security and Authentication Email<\/h3>\n\n\n\n
3. Mandatory service announcements<\/h3>\n\n\n\n
What we're doing for our customers<\/h2>\n\n\n\n
\n
If you're not a customer of ours: three things to check this week<\/h2>\n\n\n\n
\n
Let's talk about it<\/h2>\n\n\n\n
Official sources<\/h2>\n\n\n\n
\n