Is Web Analytics Legal in Italy? Garante 2026 Rules

Italy has become the sharpest test yet of whether you can measure users without asking permission first. In 2026 the Italian data protection authority — the Garante — drew two hard lines: one around web and product analytics, and one around the tracking pixels embedded in email. Both rest on the same principle. Measurement that identifies or profiles a person needs prior consent; only genuinely anonymized, aggregate measurement can run without it. For any SaaS team with Italian users, that principle now has a deadline attached.

The headline event is Provision No. 284, the Garante's first dedicated guidelines on email tracking pixels, adopted on 17 April 2026 and published in the Gazzetta Ufficiale on 29 April 2026 with a six-month compliance window that closes on 28 October 2026 (Iubenda). But the pixel decision sits on top of a longer-standing Italian position on web analytics consent, and read together the two define a clear, checkable standard. This post turns that standard into something a founder or growth lead can act on before the deadline.

The one rule underneath both decisions

The Garante's logic is consistent across analytics and pixels: the trigger for consent is identification and profiling, not the technology itself. A tracking pixel that fires when a recipient opens an email and ties that open back to a specific person is, in the regulator's view, doing the same job as a cookie — building a behavioral record about an individual — and so it needs the same prior, informed, freely given consent under Articles 6(1)(a) and 7 of the GDPR (Covington Inside Privacy). Web analytics that assigns a persistent identifier and profiles a visitor lands in exactly the same category.

This is why you cannot reason about Italy tool by tool. The question is never "is this vendor allowed?" but "does this specific configuration identify or profile a person?" The same analytics script can be exempt in one setup and consent-gated in another, depending on whether it stores a per-user identifier, masks IPs, and stays first-party. That distinction between anonymous audience measurement and identity-linked behavioral analysis is the same one drawn in the product-analytics versus web-analytics breakdown, except here it is the line between legal and illegal rather than a feature comparison.

Web analytics: the consent-exempt test in Italy

Italy lets you treat analytics as a consent-exempt "technical" cookie, but only under tight conditions. The measurement must be strictly first-party, used for the single purpose of measuring your own audience, must not be used to profile individuals, must not share data with third parties, and must mask IP addresses before any processing — the commonly cited threshold being that at least the fourth octet of an IPv4 address is stripped (Clickport). Miss one of those and the analytics stops being technical and starts needing a banner.

The practical consequence for GA4 is the same in Rome as it is in Paris: it does not qualify. GA4's identifiers, cross-property data model, and transfers put it outside the first-party, non-profiling, no-sharing box, so running it in Italy means running a consent banner and absorbing the decline rate. Every visitor who says no becomes a missing row in your acquisition data, and that gap falls hardest on the top-of-funnel numbers you use to judge channels — the same distortion we quantify in the consent-decline acquisition-gap analysis. A first-party, IP-masking, cookieless measurement tool is the way most privacy-conscious SaaS teams keep honest traffic counts without tripping the consent wire, as covered in the cookieless acquisition-data guide.

Email pixels: Provision No. 284 in plain terms

Provision No. 284 extends the same consent logic to the open-tracking pixel in your email. If a pixel fires when someone opens your message and identifies that recipient — the default behavior of a unique-per-user tracking pixel — it now needs prior opt-in consent in Italy. The Garante specifically flags pixels used to carry out behavioral assessment, segment audiences, trigger automated follow-up sequences, or feed behavioral-advertising platforms as consent-requiring (Global Policy Watch). That covers the open-rate and engagement tracking baked into almost every lifecycle and marketing email platform.

The compliance bar is not only consent but transparency. Controllers must give clear, complete information before any pixel fires — the technology used, the specific purposes, the categories of data collected, any third-party recipients, retention periods, and the right to withdraw — and must let recipients revoke granularly, either stopping all mail or keeping the emails while switching off tracking (A&O Shearman). For a SaaS growth team, that means open-rate as a headline metric is about to get materially noisier for Italian recipients, and any onboarding or nurture flow that branches on "opened / did not open" needs a rethink.

What actually stays exempt

The exemptions are narrow and worth memorizing, because they define the shape of compliant measurement rather than a loophole. Three uses escape consent under the pixel guidelines: anonymized aggregate open counts that use a single shared pixel — not a unique one per recipient — with related technical data like IP and device anonymized; security and authentication confirmations such as account activation and password-reset flows; and legally mandated institutional messages such as banking notices. Anything that measures a named individual's behavior to improve campaign performance falls outside these and needs consent.

The pattern mirrors the web-analytics test exactly: aggregate and anonymous is fine, individual and identifying is not. That symmetry is useful because it gives you one design principle to apply across both surfaces. If you want a defensible measurement stack in Italy, you build an anonymous, aggregate layer that runs for everyone and a consented, identity-linked layer that runs only for opted-in users — the same two-tier architecture that keeps the rest of your EU footprint clean, and the natural extension of the criteria France codified in the CNIL consent-exempt analytics checklist.

Why an Italy pass is not a France pass

The trap for multi-market SaaS teams is assuming one European consent assessment covers the continent. It does not. France's CNIL moved to a self-assessment model with its own conjunctive criteria — first-party, single-purpose, no third-party sharing, truncated IPs, a 13-month identifier cap, and a narrow event scope. Italy's Garante shares the spirit but expresses it through its own tests and, with Provision No. 284, extends it explicitly to email pixels with a fixed statutory deadline. A configuration that clears the CNIL self-assessment can still fail in Italy if, say, its IP handling or pixel behavior does not match the Garante's framing.

Practically, that means your compliance record needs a per-country column, not a single "EU: yes" checkbox. The direction of travel is the same everywhere — measurement is drifting toward first-party, anonymized, consent-exempt designs — but the deadlines and the specific conditions differ by member state, and enforcement is arriving on national timelines. Teams operating on both sides of the Atlantic face the parallel version of this fragmentation in the US, where cure periods are expiring state by state, as the US state privacy-law compliance guide lays out.

A pre-deadline checklist for SaaS teams

With 28 October 2026 fixed, treat this as an operational task, not a legal abstraction. First, inventory every analytics script and email pixel that touches Italian users, and classify each as anonymous-aggregate or identity-linked. Second, for web analytics, confirm your primary tool is first-party, non-profiling, IP-masking, and shares nothing with third parties; if it is GA4, accept that it needs a banner and pair it with an exempt, cookieless layer for accurate traffic. Third, for email, decide per flow whether open-tracking is worth a consent prompt or whether an anonymized aggregate open-count is enough for your reporting.

Fourth, fix the transparency layer: your privacy notice and pre-tracking disclosure must name the technology, purpose, data categories, recipients, retention, and withdrawal right before anything fires, and your preference center must allow granular revocation. Fifth, document the decisions and retention settings so you have a written basis if the Garante asks. None of this is exotic; it is the same first-party, anonymized, consent-aware discipline that increasingly defines privacy-friendly analytics across Europe — Italy has just put a date on it.