The invisible pixel in the newsletter: time runs out on 29 October

It is worth explaining what this is about, because the technical name hides something very simple. A tracking pixel is an invisible image, one dot wide, that your email loads from a server when the recipient opens it. That load tells the sender the email was opened, when, from which IP address and often on which device. Nobody sees it and nobody asks for it: it has been there for twenty years, in almost every newsletter in the world, and for twenty years it was treated as a harmless statistic.

The legal point is that harmless it is not. Reading and writing information on someone's device is the operation the ePrivacy Directive makes subject to consent: it is the same rule as for cookies, and it does not say «cookies», it says storage and access. The pixel deposits nothing, but it obtains information from the recipient's terminal the moment they open it, and the result for the individual is identical. That, in two lines, is why a twenty-year-old habit changes status.

• There is no ban: the decision does not prohibit pixels, it requires them to rest on a basis and to be declared.
• Individual open-tracking for marketing purposes requires the recipient's consent, subject to specific exceptions.
• Consent to tracking may in some cases be collected together with consent to the emails, but only if the user is clearly informed and can later switch off the tracking ALONE while still receiving the messages.
• For existing lists no re-consent campaign is needed: update the notice and tell subscribers about the use of pixels and the right to withdraw.
• The notice must say that the pixel exists, what it collects and how long that data is kept: «browsing data» will not do, because it is not browsing.

There is also a distinction worth holding firm, because it separates two processing operations that platforms show on the same screen. Knowing how many emails out of a thousand were opened is one thing; knowing that Maria Rossi opened your email on Tuesday at 9:14 and again on Thursday is another. The first is aggregate data, the second is personal data that builds over time a profile of when a person reads, from where, how often. The decision looks at the second, and most email marketing dashboards do the second by default.

For the DPO of a client who sends newsletters, there are four things to check before the 29th and none of them needs a project: whether the platform uses pixels and at what granularity; whether the notice names them; whether the consent collected covers tracking too or only sending; and whether there is a way to switch tracking off for someone who asks, without removing them from the list. The fourth is usually the one that is missing, and it is also the only one that cannot be fixed by rewriting a text.

One last note on scope, because the decision is Italian but the problem is not. The substantive rule is Article 5(3) of the ePrivacy Directive, transposed in every Member State: other countries' authorities may reach different conclusions on the details, but the underlying reasoning — a pixel that reads from the device is storage and access — is not an Italian speciality. Anyone running subscriber lists across several countries would do well not to treat this as a local formality.