Italy Data Protection & Privacy Regulation

Lawful Processing & Special Data

The Garante's decision against IQVIA Solutions Italy S.r.l., provvedimento n. 710 of 23 September 2026, found that the company processed the health data of approximately one million patients, drawn from around 800 general practitioners, without an adequate legal basis and without adequately informing patients. The decision carries a second, structurally more significant finding: the Garante rejected IQVIA's claim that the dataset was anonymous. It found that a persistent per-patient code, combined with detailed health, demographic and location attributes, made re-identification reasonably possible, so the data remained personal data subject to the full special-category regime rather than falling outside GDPR's scope as genuinely anonymous information. The decision reportedly sets, for the first time in the Garante's enforcement practice, a numeric equivalence-class threshold for assessing anonymity claims over health data — a test grounded in how many individuals could plausibly share the same combination of attributes within the dataset, rather than a simple assessment of whether direct identifiers were removed.

This reasoning establishes a more demanding evidentiary standard for any controller in Italy seeking to rely on anonymisation as a basis for processing health data outside the special-category lawful-processing regime. A controller can no longer assume that removing a name or similar direct identifier is sufficient; it must be able to demonstrate, with some degree of rigour, that the remaining combination of attributes does not make re-identification reasonably possible. The decision's reasoning was reported via secondary press sources rather than the Garante's own published text, which has not yet been directly retrieved.

Outlook

The clearest next step is confirmation of the IQVIA decision's full text against the Garante's own publication, to establish the precise contours of the equivalence-class threshold the decision reportedly introduces. Controllers processing health data in Italy under an anonymisation rationale should treat this decision as a signal that the bar for such claims is rising, pending that confirmation.

Controller/Processor Duties

Businesses, platforms and newsletter operators in Italy must bring tracking-pixel-related privacy notices, consent mechanisms and withdrawal mechanisms into line with the Garante's Linee guida sui tracking pixel by 29 October 2026. This compliance deadline was reiterated in the Garante's newsletter of 8-9 October 2026; the underlying guidelines themselves entered into force before this cycle's reporting window, so what is new this cycle is the regulator's active reiteration of an approaching deadline rather than a change to the underlying substantive obligation. The guidelines' own legal-instrument citation has not been independently retrieved this cycle, so the precise statutory or regulatory basis for the guidelines cannot be stated with full precision at this time.

The practical effect for controllers and processors operating tracking pixels on websites, platforms or in email newsletters is that consent capture, notice content, and withdrawal mechanisms tied to pixel-based tracking must be reviewed and, where necessary, remediated ahead of the deadline. The Garante's active reiteration of the deadline through its public newsletter channel suggests the regulator is treating this as a live compliance priority rather than a routine, low-visibility requirement.

Outlook

The 29 October 2026 deadline is imminent. Entities operating tracking pixels without current alignment to the Garante's guidelines face a narrow remaining window to achieve compliance. Watch for whether the Garante follows the deadline with enforcement activity against non-compliant operators, which would indicate the reiterated deadline functions as an active enforcement trigger rather than a guidance reminder without immediate consequence.

Controller/Processor Duties

The Garante's IQVIA decision, provvedimento n. 710 of 23 September 2026, made three distinct findings on accountability and controllership. First, the company had not defined data retention periods for data that, in some cases, dated back to 2001 — a failure to set and apply a retention policy consistent with the data-minimisation and storage-limitation principles. Second, IQVIA had not carried out a data protection impact assessment despite processing health data at scale. Third, the Garante found IQVIA had not adopted adequate security measures for the dataset in question. A 120-day compliance deadline, running from notification of the decision, was imposed to remedy these failures.

On controllership itself, the Garante held that IQVIA was the data controller from the point at which it collected data at the offices of the roughly 800 general practitioners involved, rejecting any characterisation that would place controllership solely with the GPs themselves. This finding is significant for any data-aggregation or data-intermediation business model built around collecting data from a dispersed network of independent professional sources: the point of collection, not merely the point of onward use, can anchor controllership.

The same proceeding reportedly absorbed a separate procedure concerning a personal-data breach that IQVIA had itself notified to the Garante, suggesting the breach notification and the substantive processing failures were considered together in reaching the Eur7 million sanction, though the precise weighting between the two strands was not detailed in the secondary reporting reviewed this cycle.

Outlook

The 120-day compliance deadline imposed on IQVIA is a concrete marker to watch: confirmation of IQVIA's remedial steps, including retention-period definition, a completed DPIA, and enhanced security measures, would indicate how the Garante expects compliance to be demonstrated following a controllership-and-accountability finding of this kind.

Controller/Processor Duties

The Garante's Provvedimento n. 237, dated 17 April 2026, sanctioned Poste Italiane and its PostePay division for unlawful monitoring of applications installed on users' Android devices. This matter falls squarely within the controller/processor duties framework because it turns on the adequacy of security-of-processing measures and the accountability obligations that attach to a controller operating consumer-facing mobile applications. Monitoring the applications installed on a user's device, beyond what is necessary for the stated purpose of the service being provided, raises questions of purpose limitation and data minimisation that sit at the heart of the controller's accountability obligations under the framework the Garante enforces.

While the sanction itself is reported at a probable confidence level, drawing on a secondary summary rather than direct retrieval of the full text of Provvedimento n. 237, the underlying pattern is consistent with the Garante's established enforcement posture toward large consumer-facing financial and postal-services groups: security-of-processing failures involving device-level data collection have previously drawn Garante attention, and this action continues that pattern. The involvement of PostePay, a payment-services brand operating under the broader Poste Italiane group, places the matter within a sector where the Garante has historically maintained close scrutiny given the scale of the consumer base involved.

For controllers operating consumer mobile applications in Italy, the practical implication is that monitoring practices extending to the broader set of applications installed on a user's device, rather than being confined to the data strictly necessary for the service's own functionality, present a live enforcement risk. The accountability principle requires that any such monitoring be justified by a documented, proportionate purpose and be transparent to the data subject; absent that justification, the Garante has shown itself willing to sanction on exactly this fact pattern.

Outlook

The Poste Italiane/PostePay sanction should be read as a signal that the Garante continues to treat device-level application monitoring as a live enforcement priority within its broader controller/processor duties remit. Operators of consumer-facing mobile applications in the Italian market, particularly within financial and postal services, should expect continuing scrutiny of similar monitoring practices. No further detail on the full scope or remedial requirements of Provvedimento n. 237 was available in the sources reviewed this cycle, and confirmation from a primary Garante publication would strengthen the evidentiary basis for this finding in a future cycle.

Controller/Processor Duties

The Garante's controller/processor duties enforcement this cycle centres on data-minimisation and retention accountability. On 24 February 2026, the Garante issued an order concerning Amazon worker-data record-keeping practices, addressing excess data retention in the employment context. Separately, on 29 April 2026, the Garante issued guidance against accommodation providers retaining copies of guest identity documents, a similar retention-minimisation intervention in the hospitality sector. Both are Probable-confidence findings, sourced from the Garante's own Tier-1 press-room index, though the full text of the underlying provvedimenti was not retrieved this cycle, which limits the granularity of what can be reported about the specific corrective measures ordered in each case.

Taken together, these two orders confirm active accountability and data-minimisation enforcement by the Garante across at least two distinct sectors, employment and hospitality, within a single reporting window. This pattern is consistent with tightening in this module's trajectory, reflecting a regulator actively testing retention practices against the GDPR's data-minimisation and storage-limitation principles rather than confining enforcement attention to breach-notification or consent failures alone.

Outlook

Watch for the full text of both the Amazon worker-data order and the accommodation-provider guidance to become available, which would allow a more granular assessment of what data-retention thresholds the Garante is now applying, and for whether this retention-focused enforcement pattern extends to further sectors in the coming cycle.

Sectoral Watch

Under Article 29 of the EU Data Act, Regulation (EU) 2023/2854, charges for switching between cloud and data-processing services are capped at the provider's direct switching costs until 12 January 2027. From that date, such switching charges are prohibited outright. This is a directly applicable EU regulation, meaning it takes effect in Italy without requiring a separate national transposition statute, though Member States may still need to designate a national competent authority or data coordinator for enforcement purposes. Italy's national competent authority or data coordinator for the Data Act has not been confirmed as designated as of this cycle, and no Italy-specific implementing instrument has been identified.

This provision is relevant to any cloud or data-processing service provider operating in or serving the Italian market, and to businesses relying on such services who may currently face switching costs that will become entirely prohibited from January 2027. The absence of a confirmed Italian national competent authority designation is itself a notable gap: enforcement mechanics for Italian customers of cloud-switching arrangements remain unclear pending that designation.

Outlook

The key date to track is 12 January 2027, when the switching-cost prohibition takes full effect across the EU including Italy. Separately, and arguably more immediately relevant for Italian market participants, is whether Italy designates a national competent authority or data coordinator for Data Act enforcement before that date; the absence of such a designation as of this cycle leaves an open question about which Italian authority, if any, will be responsible for enforcing the switching-cost prohibition domestically.

Sectoral Watch

The Garante issued two sectoral developments on 1 October 2026. First, it republished an updated edition of its practical guide, 'Privacy e recupero crediti', addressed to banks, finance companies, phone and energy companies engaged in debt-recovery activity. This is a routine guidance republication rather than a substantive rule change, but it signals continued regulatory attention to the debt-collection sector's data-protection practices across multiple industries.

Second, and more substantively, the Garante expressed a favourable opinion, with observations, on the draft legislative decree transposing EU Directive 2024/2831 on platform work into Italian law. The Garante's observations specifically asked for greater attention to rider privacy in the transposition, a sector-specific concern given the extent of location, performance and activity-monitoring data typically generated by platform-based delivery and ride-hailing work. The opinion was favourable overall but conditioned on these observations being addressed as the decree proceeds, a posture consistent with the Garante's established practice of engaging with government transposition drafts ahead of their final adoption rather than only after the fact.

Outlook

The transposition decree for the EU Platform Work Directive is the clearer marker to watch here: whether the final adopted text incorporates the Garante's rider-privacy observations, and how the debt-recovery guidance republication is received across the banking, finance, telecommunications and energy sectors it addresses, are both worth tracking as this decree moves through the legislative process.

Sectoral Watch

The Garante's inspection plan for the second half of 2026 identifies at least 35 inspections to be conducted between August and December. The plan marks a deliberate shift in sectoral focus: AI-system checks, which had previously concentrated on the education sector and schools specifically, are being redirected toward municipalities, local health authorities (ASL), geomarketing, neuromarketing, dynamic pricing, and DPO-supplier relationships. This redirection signals that the Garante's sectoral enforcement priorities for the remainder of 2026 are moving away from education-sector AI deployments and toward public-administration bodies and commercial pricing/marketing-technology practices that involve algorithmic processing of consumer or citizen data.

The inclusion of municipalities and local health authorities as inspection targets is notable because it extends the Garante's practical sectoral attention into public-sector bodies that increasingly deploy AI-assisted systems for service delivery and resource allocation, sectors that had not previously been named as a discrete inspection priority. Similarly, the explicit naming of geomarketing, neuromarketing and dynamic pricing as inspection targets reflects a sectoral focus on commercial practices that use behavioural or location data to shape consumer-facing pricing or marketing decisions, an area where AI-driven personalisation techniques raise the kind of profiling and transparency questions the Garante has flagged in other contexts this cycle.

This sectoral shift should be read alongside the broader enforcement-and-redress picture for the cycle, in which two concrete sanctions (Poste Italiane/PostePay and Altroconsumo Edizioni) were already recorded; the expanded inspection programme suggests the Garante intends to sustain, rather than taper, its practical enforcement tempo through the remainder of 2026, with AI systems and public-sector/commercial-marketing practices as the named sectoral targets.

Outlook

Operators in the named sectors, particularly municipalities, local health authorities, and providers of geomarketing, neuromarketing, or dynamic-pricing technology serving Italian consumers, should treat the August-December 2026 window as a period of elevated inspection risk. The DPO-supplier relationship focus also suggests that outsourced data-protection-officer arrangements will receive specific scrutiny during this period. No further detail on the specific inspection criteria or expected enforcement outcomes was available in the sources reviewed this cycle.

Sectoral Watch

Italy's telecoms and e-privacy sectoral overlay was confirmed applicable to a new use case this cycle: Codice Privacy Article 130(1) requires opt-in consent for automated calling systems, and this requirement is confirmed to extend to AI voice agents specifically. An opt-out mechanism such as the Registro delle Opposizioni (RPO) list is explicitly insufficient to satisfy this opt-in requirement, an Assessed-confidence finding sourced from the Garante's own Tier-1 guidance on artificial intelligence.

This finding is significant because it closes a potential ambiguity as automated calling technology increasingly incorporates generative AI voice capabilities: the existing sectoral telecoms consent standard, rather than being displaced or superseded by AI-specific rules, is confirmed to continue applying in full to AI-driven calling systems. Businesses deploying AI voice agents for outbound calling in Italy therefore cannot rely on opt-out registration alone and must secure affirmative opt-in consent under the existing Article 130(1) standard.

Outlook

Watch for whether the Garante issues further sector-specific guidance applying existing telecoms and e-privacy standards to other AI-driven communication channels, and for any enforcement action testing compliance with the opt-in standard specifically in the context of AI voice agents.

AdTech & Commercial Privacy

The Garante's guidelines on email tracking pixels, issued as Provvedimento n. 284 of 2026, reach the end of their six-month compliance window on 29 October 2026. The guidelines require prior, free, specific and informed opt-in consent before deploying any email tracking pixel capable of identifying the recipient upon opening the message. A narrow exception is carved out for pixels used strictly for deliverability, security, or institutional-communication purposes, where such tracking does not serve a marketing or profiling function. Organisations conducting commercial email campaigns into Italy that rely on open-tracking pixels without having obtained the required opt-in consent face exposure once the compliance window closes.

The guidance reflects the Garante's broader approach to consent-based lawful bases for tracking technologies in the commercial-privacy space, treating pixel-based open-tracking as functionally equivalent to other tracking technologies requiring prior consent rather than treating it as incidental to message delivery. The narrowness of the stated exception suggests limited scope for commercial actors to rely on operational necessity as a basis for continuing undisclosed open-tracking after the deadline passes.

Outlook

With the compliance deadline falling on 29 October 2026, the immediate question is how actively the Garante moves to enforcement against non-compliant senders once the window closes, and how strictly it interprets the deliverability/security/institutional exception in practice. No enforcement action under this specific guideline has been identified as yet.

AdTech & Commercial Privacy

The live adtech item for Italy this cycle is the approaching 29 October 2026 compliance deadline under the Garante's Linee guida sui tracking pixel. Businesses, platforms, and newsletter operators using tracking pixels for advertising, analytics, or engagement-measurement purposes must bring their privacy notices, consent-capture mechanisms, and withdrawal mechanisms into conformity with the guidelines by that date. The deadline was reiterated in the Garante's newsletter of 8-9 October 2026, indicating active regulatory attention to this compliance area ahead of the cut-off.

Tracking pixels are commonly embedded in advertising creative, email newsletters, and analytics tooling, meaning the guidelines' practical reach extends across commercial adtech practice broadly rather than being confined to a narrow category of operator. The precise legal-instrument citation underlying the guidelines has not been independently retrieved this cycle, which limits the ability to state with full confidence the exact statutory hook (whether grounded directly in the Codice Privacy, in ePrivacy-derived cookie-consent rules, or in a standalone Garante guideline exercising its general regulatory powers) behind the pixel-specific requirements.

Outlook

With the compliance deadline now within weeks, the near-term question is the rate of market conformity achieved by 29 October 2026 and whether the Garante follows with visible enforcement against non-compliant tracking-pixel practices. A secondary item to confirm in a future cycle is the precise legal basis of the guidelines themselves, which would clarify the applicable penalty regime for non-compliance.

AdTech & Commercial Privacy

The Garante's guidelines on the use of tracking pixels in email marketing communications, adopted 17 April 2026, entered into force, per a notice dated 5 October 2026. These guidelines set standards for the use of tracking pixels, a technology commonly embedded in marketing emails to register when and whether a recipient has opened the message, bringing this practice within the Garante's active guidance framework for commercial email marketing. The precise relationship between the 17 April 2026 adoption date and the actual entry-into-force date was not confirmed against the Garante's own provvedimento text this cycle, and that gap should be noted before relying on either date as definitive.

Separately, the Garante sanctioned a banking institution, under provvedimento 613/2026, for violations of the right to object to the use of personal data for commercial purposes, per reporting dated 14 September 2026. This finding rests on secondary reporting, as the provvedimento text itself was not directly retrieved this cycle; the specific nature of the commercial use to which the bank's customers objected was not detailed in the available sourcing.

Taken together, these two developments show continued Garante activity on both ends of the commercial-privacy spectrum: proactive guidance-setting on tracking technology, and reactive enforcement against a financial-sector controller's handling of marketing-objection rights.

Outlook

Confirmation of the tracking-pixel guidelines' precise in-force date against the Garante's own text, and retrieval of the full provvedimento 613/2026 text concerning the banking institution's direct-marketing sanction, are the two clearest next steps to firm up this cycle's findings.

AdTech & Commercial Privacy

The Garante's 29 July 2026 newsletter recorded a marketing-related enforcement matter against Altroconsumo Edizioni, resulting in a fine of EUR 280,000. This is the principal adtech and commercial-privacy development for Italy this cycle, though it should be treated with appropriate caution: the finding rests on a single source, the Garante's own newsletter announcement, and the underlying provvedimento's full reasoning and factual basis were not independently corroborated in the sources reviewed this cycle. Reports suggest the matter concerned marketing-related processing, though the precise nature of the violation, whether direct-marketing consent failures, unlawful profiling for marketing purposes, or another commercial-privacy issue, was not specified in the sources available.

The scale of the fine, at EUR 280,000, indicates the Garante treated the underlying violation as a serious matter within its marketing-enforcement practice, consistent with the broader pattern this cycle of the Garante maintaining an active enforcement tempo across multiple sectors simultaneously. However, given the single-source basis for this specific finding, readers should treat the characterisation of the violation itself as provisional pending corroboration from the Garante's own primary publication of the full provvedimento text.

Outlook

Corroboration of the Altroconsumo Edizioni matter through a primary Garante publication would materially strengthen confidence in this finding for a future cycle. In the interim, the EUR 280,000 fine should be read as one data point within the Garante's broader active-enforcement posture this cycle, alongside the Poste Italiane/PostePay sanction, rather than as a fully resolved standalone finding.

Algorithmic, Biometric & Surveillance Governance

Legislative Decree no. 179 of 7 October 2026, in force since 23 October 2026, directly answers the long-open question of which Italian authorities bear AI Act supervisory responsibility. AgID and ACN are designated as the national AI Act market-surveillance and notifying authorities, while Banca d'Italia, CONSOB and IVASS retain AI Act supervisory competence over high-risk AI systems within their respective pre-existing financial-sector remits -- banking and financial services, investment services, and insurance respectively. This settles, at the level of institutional design, how high-risk AI deployments in Italy's financial sector will be supervised going forward, removing ambiguity that had persisted since the AI Act's entry into application.

The decree's approach of layering AI Act competence onto existing sectoral regulators, rather than creating a wholly new supervisory body for financial-sector AI, mirrors the general pattern of AI Act implementation in several EU Member States with established sectoral financial regulators. Full confirmation of the decree's scope and any transitional provisions awaits independent retrieval of its text; the account here is based on two consistent secondary press reports describing its substantive content.

Outlook

The practical operation of this supervisory split -- particularly how Banca d'Italia, CONSOB and IVASS coordinate with AgID and ACN on cross-cutting AI governance questions, and how the Garante's distinct data-protection competence interacts with all of the above -- will become clearer as the designated authorities begin exercising their new mandates.

Algorithmic, Biometric & Surveillance Governance

This is the most significant module for Italy this cycle, carrying four distinct developments that together indicate an escalating pattern of Garante engagement with algorithmic and AI-adjacent governance ahead of, and independent of, the formal enactment of Italy's AI Act implementing legislation.

The most material of these developments is the Garante's favourable opinion on Italy's draft legislative decree implementing the EU AI Act. The draft decree, as reviewed by the Garante, would designate the Garante itself as the market-surveillance authority for high-risk AI systems deployed in four sensitive contexts: justice administration, law enforcement, immigration and border management, and processes touching the democratic process. This is a substantial expansion of the Garante's institutional remit beyond its existing GDPR-based mandate, and it reflects a deliberate legislative choice to route AI Act market-surveillance responsibility for these particularly sensitive domains through the existing data-protection authority rather than creating a wholly new oversight body. As of this cycle, the decree remains at the proposed stage; the Garante's opinion is favourable but the decree has not yet been enacted, and its final text and effective date remain open questions.

Separately, and demonstrating that the Garante is already applying AI Act principles operationally ahead of the implementing decree's enactment, the regulator issued a provvedimento dated 14 May 2026 addressing the use of AI systems in the workplace to analyse workers' emotional or psychological states. This provvedimento explicitly invoked the AI Act's prohibition on emotion-inference systems in the employment context, treating that prohibition as already operative guidance for employers deploying such systems on Italian workers, notwithstanding that the national implementing decree itself remains unenacted.

A third development concerns biometric identification in the criminal-procedure context. The Garante has called for an express prohibition, to be incorporated within a pending reform introducing a new Article 359-ter biometric-identification framework into Italy's criminal-procedure law, on the use of databases obtained through indiscriminate scraping or otherwise assembled in violation of data-protection law. This is advocacy directed at a pending legislative reform rather than a completed instrument, but it signals the Garante's substantive position on how facial-recognition and biometric-identification databases used by law-enforcement bodies should be constrained.

A fourth strand concerns generative AI directly. In a provvedimento dated 3 July 2026, the Garante examined the character.ai generative-AI companion service, noting specifically the existence of a dedicated version of the service for minor users, launched in November 2024. This examination sits at the intersection of algorithmic governance and the treatment of vulnerable users, and is addressed further under the children and vulnerable groups module.

Outlook

The enactment trajectory of the AI Act implementing decree is the central item to watch: a favourable Garante opinion is a meaningful procedural step but does not itself extend the Garante's market-surveillance remit until the decree is formally enacted. In the interim, the workplace-AI provvedimento and the biometric-scraping advocacy both demonstrate that the Garante is willing to apply AI Act-derived principles through its existing enforcement and policy powers, a pattern likely to continue as the decree moves through the remainder of the legislative process.

Algorithmic, Biometric & Surveillance Governance

This module carries the highest density of material developments in Italy's data-protection landscape this cycle, with four distinct threads escalating simultaneously. First, the Garante imposed a EUR 158,000 fine on Character Technologies Inc. on 9 July 2026 for GDPR violations concerning privacy notices and child-protection and age-verification failures, a Confirmed-confidence, Tier-1-sourced primary enforcement action.

Second, the Garante's ruling under Provvedimento 10281021 holds that AI Act transparency obligations for manipulated content become applicable from 2 August 2026, while clarifying that deepfakes are not per se a prohibited practice under the AI Act; at the time of the ruling this obligation was enacted but not yet effective, and it is now understood to be in force given the 2 August 2026 applicability date has since passed. This is a Confirmed-confidence, Tier-1-sourced finding.

Third, the Garante flagged AI Act incompatibilities in a proposed police facial-recognition decree, specifically objecting to a 7-day biometric-data retention period that would apply regardless of whether a crime actually occurred, and called for modifications ahead of a final Council of Ministers vote expected before October 2026. This is a Probable-confidence finding, sourced at Tier 3, and represents an active, unresolved dispute between the regulator and the government over a still-proposed instrument.

Fourth, and most structurally significant, the Court of Rome annulled the Garante's own December 2024 EUR 15 million fine and media-campaign order against OpenAI on 18 March 2026, on one-stop-shop jurisdiction grounds. This is a Confirmed-confidence finding, though sourced at Tier 3, and it represents a significant judicial reversal of the regulator's own enforcement action. Read together, this annulment and the continuing aggressive enforcement against Character.AI signal a meaningful judicial check on Italy's AI-enforcement reach even as the regulator continues pursuing smaller generative-AI operators, an Assessed-confidence key judgment.

Outlook

Watch for the final Council of Ministers vote on the facial-recognition decree, expected before October 2026, and for whether the Garante appeals the Court of Rome's OpenAI annulment or adjusts its jurisdictional approach to future one-stop-shop cases in light of that ruling.

Children & Vulnerable Groups

The Garante's provvedimento dated 3 July 2026 examined the generative-AI companion service character.ai, with particular attention to a dedicated version of the service designed for minor users, which had been launched in November 2024. This examination places Italy's data-protection regulator among those actively scrutinising generative-AI companion services for their treatment of under-18 users, a category of service that raises distinct concerns given the emotionally engaging, conversational nature of the product and the potential for minors to form parasocial attachments to an AI companion without adult-level capacity to assess the risks of doing so.

The existence of a dedicated minors-facing version of the service, launched nearly two years before the Garante's examination, indicates the provider had already made a deliberate product decision to serve the under-18 demographic, which in turn sharpens the regulatory question of what safeguards, age-verification mechanisms, and data-processing limitations were in place for that minors-specific product tier. The sources reviewed this cycle establish that the Garante examined the service and its minors-specific version, but do not specify the provvedimento's ultimate findings, remedial requirements, or sanctions, if any, arising from that examination.

This generative-AI/minors matter should be read alongside the broader algorithmic-governance developments this cycle, particularly the workplace-AI emotion-inference provvedimento, as both reflect the Garante applying heightened scrutiny to AI systems that engage with, infer from, or affect the psychological and emotional states of individuals, whether workers or, in this case, minor users of a generative-AI product.

Outlook

Further detail on the character.ai provvedimento's findings and any resulting remedial measures would clarify whether Italy is moving toward a more prescriptive standard for minors-facing generative-AI products specifically. Given the Garante's demonstrated pattern of proactive AI-system scrutiny this cycle, further provvedimenti addressing other generative-AI companion or chatbot services with minor-facing product tiers should be considered a plausible continuation of this line of regulatory attention.

Children & Vulnerable Groups

The Garante's Character Technologies enforcement action carries a binding children's-data-protection dimension this cycle. Alongside the EUR 158,000 fine imposed 9 July 2026, the corrective-measures order requires Character Technologies to guarantee age-verification systems, implement cooling-off mechanisms preventing minor re-registration after account closure, and set default-private minor profiles, with compliance to be reported to the Garante within 120 days. This is a Confirmed-confidence, Tier-1-sourced finding with a binding compliance deadline, marking a tightening trajectory for this module.

The specificity of the corrective measures, particularly the cooling-off mechanism preventing re-registration and the default-private setting for minor profiles, indicates the Garante is moving beyond generic GDPR privacy-notice failures toward prescriptive, child-specific design requirements for generative-AI platforms likely to be used by minors. The 120-day reporting deadline gives a concrete compliance-verification point in the near term.

Outlook

Watch for Character Technologies' 120-day compliance report to the Garante, due in approximately early November 2026 based on the 9 July 2026 order date, which will indicate whether the prescribed age-verification and cooling-off measures were implemented as ordered.

Enforcement & Redress

The Garante imposed a EUR 7 million fine on IQVIA Solutions Italy Srl by Provvedimento n. 710 of 6 October 2026, rejecting the company's position that health data concerning approximately one million patients had been rendered anonymous. The Garante found that a persistent per-patient code retained within the processing system enabled re-identification of individuals, meaning the data had in substance remained personal data rather than achieving genuine anonymisation. On this basis, the Garante held that IQVIA's processing violated GDPR Articles 5 (principles relating to processing), 9 (special categories of data, given the health-data context), 13 (information to be provided), 25 (data protection by design and by default), 28 (processor obligations), 32 (security of processing) and 35 (data protection impact assessment).

The decision is a significant marker of the Garante's enforcement posture toward the anonymisation standard, rejecting a claim of anonymisation where a technical identifier persisted that could in practice be used to re-link data to individuals. This has particular salience for health-data controllers and processors relying on pseudonymisation techniques -- such as persistent per-subject codes -- while characterising their output as anonymous for regulatory purposes. The full text of Provvedimento n. 710/2026 has not been independently retrieved; this account relies on secondary reporting of the decision's substance and legal basis.

Outlook

The IQVIA decision is likely to be read by other health-data controllers in Italy as a signal to review whether pseudonymisation techniques they characterise as anonymisation would withstand the same scrutiny. Whether IQVIA appeals the decision, and the outcome of any such appeal, would be the next material development to watch in this matter.

Enforcement & Redress

The Garante per la protezione dei dati personali fined Cairo Editore 9,380 euros by provvedimento n.759 of 23 September 2026, published 16 October 2026, for publishing images of a crime scene found not essential to the informational purpose of the article in question. The fine was issued under the essentiality-of-information principle and dignity-protection rules applicable to journalistic activity, and concerns the same underlying case — the Garlasco case — that produced an earlier fine against RTI on 29 July 2026. The Garante is applying the same legal theory repeatedly across multiple publishers within a relatively short reporting period, which indicates a sustained enforcement line specific to this case rather than an isolated application of the essentiality-of-information principle.

This pattern is significant for media organisations covering high-profile criminal cases generally: the Garante's recurring willingness to find that crime-scene or victim-related imagery exceeds what is essential to inform the public, even where the underlying facts being reported are themselves newsworthy, signals an active and specific enforcement posture on image selection in crime journalism rather than a generalised tightening of journalistic-exception rules as a whole.

Outlook

Given the recurring nature of this enforcement line — two fines against two different publishers over the same case within a roughly two-and-a-half-month span — further enforcement action against additional publishers that covered the same case with similar imagery is plausible. Watch for whether the Garante's approach in this case influences its treatment of image-publication decisions in other high-profile criminal matters going forward, which would indicate a durable shift in enforcement emphasis rather than a case-specific response.

Enforcement & Redress

Italy's enforcement activity was notably active this cycle, anchored by the Garante's Eur7 million fine against IQVIA Solutions Italy S.r.l., provvedimento n. 710 of 23 September 2026, for the unlawful processing of health data belonging to approximately one million patients of around 800 general practitioners. This is among the larger fines the Garante has issued and reflects the seriousness with which the authority treated both the lawful-basis failure and the rejected anonymisation claim underlying the processing.

On the same date, 23 September 2026, the Garante issued a second, much smaller enforcement decision, provvedimento n. 634, fining Fondazione Rome Technopole Eur8,000 for publishing online the personal data of 480 scholarship-award winners. Though modest in scale by comparison to the IQVIA fine, this decision is a reminder that the Garante's enforcement activity spans a wide range of controller types and data volumes, from large-scale health-data processing by a multinational data company to a more limited publication of award-recipient data by a research foundation. A third enforcement thread, the banking institution sanctioned under provvedimento 613/2026 for direct-marketing objection-right violations reported 14 September 2026, adds to the picture of a Garante actively pursuing enforcement across sectors in this window.

The full texts of provvedimento n.710/2026 and n.634/2026 were not directly retrieved from the Garante's own publication channel this cycle; the findings rest on secondary press reporting and, for n.634, a direct Garante docweb reference.

Outlook

Direct retrieval of the full provvedimento texts for n.710/2026 (IQVIA) and n.634/2026 (Fondazione Rome Technopole) from garanteprivacy.it would firm up the precise legal reasoning and sanction calculation behind both decisions. The IQVIA decision's 120-day compliance deadline is the clearest concrete marker to track going forward.

Enforcement & Redress

Italy's enforcement and redress picture this cycle is defined by two concrete sanctions and one significant forward-looking programme. The Garante sanctioned Poste Italiane and its PostePay division in Provvedimento n. 237 of 17 April 2026, for unlawful monitoring of applications installed on users' Android devices, a matter addressed in detail under the controller/processor duties module. Separately, the Garante's 29 July 2026 newsletter recorded a EUR 280,000 fine against Altroconsumo Edizioni for a marketing-related violation, a finding that rests on a single source this cycle and should be treated as provisional pending corroboration.

Beyond these two concluded matters, the Garante's inspection plan for the second half of 2026 represents a significant expansion of its forward enforcement pipeline: at least 35 inspections are planned for the August-to-December window, with sectoral scope expanding to include geomarketing, neuromarketing, dynamic pricing, DPO-supplier relationships, municipalities, local health authorities, and AI systems generally. This expanded inspection programme, considered alongside the two concrete sanctions already recorded this cycle, indicates the Garante is sustaining an active enforcement tempo across a widening set of sectors rather than concentrating attention on a narrow set of repeat targets.

The combination of concrete sanctions with an expanding forward inspection programme is itself the significant structural fact for this module this cycle: it indicates the Garante's enforcement posture is both active in the present and set to broaden further in scope over the remainder of 2026.

Outlook

The 35-plus inspections planned for August-December 2026 should be watched closely, both for their outcomes and for whether the sectoral pattern (municipalities, ASL, geomarketing, neuromarketing, dynamic pricing, DPO-supplier relationships, AI systems) proves predictive of where the Garante's next concrete sanctions land. Corroboration of the Altroconsumo Edizioni fine through a primary Garante publication remains an open item for a future cycle.

Enforcement & Redress

Italy's enforcement and redress landscape this cycle is marked by both continued aggressive fining activity and a significant judicial check on the regulator's own reach. The Character Technologies fine of EUR 158,000, imposed 9 July 2026, is a Confirmed-confidence, Tier-1-sourced primary enforcement action. Separately, reporting indicates Intesa Sanpaolo was fined EUR 31.8 million in March 2026 for an insider data breach; however, this figure is sourced only from a Tier-4 secondary compilation and could not be corroborated against a Garante primary provvedimento this cycle, and is accordingly reported at Uncertain confidence with attribution limited to the secondary source rather than presented as an established fact.

The most structurally significant development is the Court of Rome's annulment, on 18 March 2026, of the Garante's own December 2024 EUR 15 million fine and media-campaign order against OpenAI, on one-stop-shop jurisdiction grounds. This is a Confirmed-confidence finding, sourced at Tier 3, and represents a meaningful check on the scope of the Garante's enforcement jurisdiction in cross-border AI cases. Separately, the Garante is confirmed, at Probable confidence from a Tier-4 source, to act as competent authority for AI Act enforcement in areas overlapping data protection, particularly for high-risk AI systems processing personal data, expanding its effective enforcement remit even as the OpenAI annulment narrows its jurisdictional reach in one specific respect.

Outlook

Watch for primary-source corroboration of the reported Intesa Sanpaolo fine, which remains an open evidentiary gap, and for whether the Garante's expanded AI Act competent-authority role generates new enforcement activity distinguishable from its existing GDPR enforcement programme.