[REVISION HISTORY]

GDPR implementation and enforcement in Italy

1 recorded revision of this situation.

What changed

2026-10-07 15:56 UTC → 2026-10-29 09:25 UTC · added ~~removed~~

The implementation of the European Union’s General Data Protection Regulation (GDPR) has transitioned from broad legislative alignment to specific enforcement actions regarding digital tracking. Initially, the focus centered on the full implementation of the GDPR framework, with Italy moving to repeal its existing Personal Data Protection Code to align with EU provisions. This phase established immediate obligations for businesses and public entities to protect individual rights regarding data access, rectification, and erasure. More recently, the Italian Data Protection Authority (Garante Privacy) has issued specific mandates concerning email marketing. ~~Companies~~ Companies, digital platforms, and newsletter providers are ~~now~~ required to comply with rules regarding tracking pixels—invisible images used to monitor user interactions like IP ~~addresses~~ addresses, device types, and open rates. Under these guidelines, tracking without explicit, free, specific, and informed consent is ~~prohibited.~~ prohibited, except for strictly necessary technical, security, or institutional purposes. Organizations must provide clear information regarding data collection and offer a simple method for users to revoke consent, ~~with compliance~~ such as a link at the bottom of a message. The authority emphasizes the principle of accountability, requiring data controllers to ensure personal data is protected while using these tools for purposes like audience measurement or spam prevention. Compliance checks are scheduled to begin following the October 29, 2026, ~~deadline.~~ deadline, with violations subject to sanctions under the GDPR.

Versions

Select a version to see what changed compared to the one before it.