Email Tracking Pixel Consent in Italy and France: What To Do Before Oct 28
Email open-tracking pixels now need their own consent in Italy and France, separate from whatever consent you already collected to send the email at all. Italy’s data protection authority published the guidelines on April 29, 2026, with a compliance deadline of October 28, 2026, less than three weeks from now. France applies the same consent-first standard.
Klaviyo turns on open tracking by default on every send. For a brand with Italian or French subscribers, that default is now a compliance gap, not a settings choice to revisit eventually.
What Actually Changed
The core change is that the tracking pixel is now treated the same way a cookie is treated under ePrivacy rules. A tracking pixel is the tiny invisible image embedded in an email that reports back when it’s opened, along with details like device and approximate location. Using it to measure campaign performance, personalize content, or feed engagement scoring into a profile now requires the recipient’s prior, separate consent, the same legal standard that already applies to tracking cookies on a website.
This is a narrower requirement than it might sound. It’s specifically about the tracking mechanism itself, not about whether you’re allowed to email the subscriber at all. A brand can have fully valid consent to send marketing emails and still be out of compliance on the tracking pixel specifically, because the two consents aren’t the same thing under this guidance.
Why Your Newsletter Opt-In Doesn’t Cover This
The direct answer is that consent for receiving marketing emails and consent for being tracked while reading them are legally distinct actions under this rule. A subscriber who checked a box to join your list agreed to receive emails. They did not separately agree to have their opens tracked, scored, and fed into a profile, even if that tracking has been happening invisibly the whole time.
Consent here has to be specific to the tracking itself: informed, and separate from the general marketing opt-in. Recipients also need a way to withdraw just the tracking consent, as easily as they gave it, without having to unsubscribe from the list entirely. A single blanket opt-in at signup that never mentions tracking doesn’t meet that bar.
The Transition Period: Existing Versus New Subscribers
There’s a real distinction here worth understanding before assuming the deadline wipes out your entire list’s tracking overnight. For addresses already on your list before the guidance took effect, sends with tracking can continue through the transition, provided recipients are informed at the first reasonable opportunity and given a clear, granular way to opt out of just the tracking.
For any address collected from the guidance’s publication date onward, the consent-first requirement applies immediately, with no transition allowance. That means the practical urgency is split: existing subscribers need a notice-and-opt-out mechanism in place, while new signups need consent-first tracking built into the opt-in flow itself, starting now, not by October 28.
What To Actually Do Before October 28
The direct answer is to check how much of your list is Italian or French first, because that determines how urgent this actually is for your specific account. If the number is small, the fix is still worth doing, but it’s not the same five-alarm problem it is for a brand with a meaningful EU subscriber base.
From there: add a clear, specific mention of open tracking to your signup flow for new subscribers, going forward. For your existing Italian and French subscribers, send a notice that explains the tracking and gives them a granular way to opt out of it without unsubscribing from the list. Email list hygiene in Klaviyo already covers how to build segmented, permission-based lists; the same segmentation logic applies here, just scoped to tracking consent instead of engagement.
What Happens If You Do Nothing
Nothing changes about your ability to send. What changes is the legal basis for the tracking data you’re collecting on those sends. Open rate, as a metric, has already been getting less reliable for reasons unrelated to this guidance. Apple’s Mail Privacy Protection changed what open-rate data actually means for a different reason entirely: it pre-fetches images regardless of whether a human opened the email, inflating the number itself. This consent requirement doesn’t inflate or deflate the metric. It determines whether collecting it from Italian and French recipients without the right consent is a compliance violation after October 28.
The practical risk isn’t a sudden mass enforcement sweep the day after the deadline. It’s that the gap sits there, unaddressed, the same way plenty of brands left SPF and DKIM half-configured for years before deliverability problems forced the issue. Fixing this now, while the deadline is still ahead of you, is a smaller task than fixing it retroactively once it’s already a problem.
If you’re not sure whether your current Klaviyo setup actually separates tracking consent from your general opt-in, book a free audit and we’ll help you check before the deadline, not after.