--- title: "Italy — AdTech & Commercial Privacy | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/italy/adtech-and-commercial-privacy/ source_html: /jurisdictions/italy/adtech-and-commercial-privacy/index.html description: "Italy — AdTech & Commercial Privacy: adtech_and_commercial_privacy AdTech & Commercial Privacy 6 sub-modules 6 claims Amber ▾ # Rules are clear and mature but enforcement volume against cookie-banner manipulation and" generated_at: 2026-10-25T04:46:50Z content_sha256: 80f289052e159a740f4098f87d61364184086db1a4d75096a677b2a1d5f60d60 generator: "fe-fleet/md-twin@1.0" --- # Italy — AdTech & Commercial Privacy | Data Protection Monitor ### D7AdTech & Commercial Privacy6 sub-modules6 claimsAmber▾# Rules are clear and mature but enforcement volume against cookie-banner manipulation and unconsented marketing remains high. Primary framework ePrivacy Directive 2002/58/EC as transposed by Art.122 Codice Privacy + GDPR Arts.4(11),6,7,12,13,25 Supervisory authority [Garante per la protezione dei dati personali](https://www.garanteprivacy.it/) Traffic-light rationale — Amber Rules are clear and mature but enforcement volume against cookie-banner manipulation and unconsented marketing remains high. #### Sub-modules (6) #### Cookies And TrackersAmber The 2021 Linee Guida cookie mandate a default no-cookie state on first access and ban cookie walls absent an equivalent no-consent path. Claims (2): - Under the Garante's 2021 cookie guidelines, at first website access no cookie or tracking tool other than technical ones may be positioned on a user's device by default, and no active (third-party) or passive (fingerprinting) tracking may occur without consent. - Cookie walls are deemed unlawful by the Garante unless the site operator provides equivalent access to content/services without requiring consent to cookies or other trackers, and re-prompting consent at every visit is considered redundant and invasive. #### Dark PatternsAmber A 2025 decision sanctioned a cookie banner configured so that both 'accept technical only' and 'accept all' installed the same four cookies, a dark-pattern-style design flaw. Claims (1): - The Garante found a violation of Arts.4(11),5,7,12,13,24 and 25 GDPR and Art.122 Codice where a cookie banner was configured so that clicking either 'accept technical cookies' or 'accept all cookies' resulted in the same four cookies being installed, undermining granular consent. #### Opt Out SignalsGreen The Registro Pubblico delle Opposizioni functions as Italy's institutionalised opt-out signal for telemarketing, free to consumers and overseen by the Garante. Claims (1): - The Registro Pubblico delle Opposizioni (RPO) is a free, institutional service allowing consumers to register fixed and mobile numbers to block telemarketing, with Garante oversight of the register's operation. #### Clean Rooms And DcrRed No clean-room/data-collaboration-room-specific Garante guidance or enforcement was located in this research cycle. Absence provenance: No dedicated Garante material on data clean rooms surfaced.. Searched: Garante clean room data collaboration room privacy. #### Cross Context AdvertisingAmber The Garante fined data-broker Lusha EUR 2 million for monitoring and selling the data of a large number of individuals, illustrating cross-context data monetisation enforcement. Claims (1): - The Garante sanctioned data-broker Lusha EUR 2 million for monitoring and offering for sale the personal data of a large number of individuals. #### Direct MarketingAmber Multiple decisions (Lex Iuris, Enel Energia) sanction unconsented direct-marketing processing under Art.6(1)(a) GDPR and Art.130 Codice. Claims (1): - The Garante fined Enel Energia EUR 26.5 million for aggressive telemarketing where consumers' data were used without consent and the accountability principle was not complied with. Category narrative 63 words Italy's cookie/tracker regime rests on the Garante's 2021 Linee Guida (Art.122 Codice + Arts.4(11),7,12,13,25 GDPR): default no non-technical cookies on first access, prohibition of cookie walls (absent an equivalent no-consent alternative), rejection of scrolling as valid consent, and a 6-month minimum before re-prompting consent. Dark-pattern-style banner manipulation, data-broker cross-context monetisation (Lusha), and unconsented direct marketing (Lex Iuris, Enel Energia) have all been sanctioned. Periodic update · new data 2026-10-18 #### AdTech & Commercial Privacy The live adtech item for Italy this cycle is the approaching 29 October 2026 compliance deadline under the Garante's Linee guida sui tracking pixel. Businesses, platforms, and newsletter operators using tracking pixels for advertising, analytics, or engagement-measurement purposes must bring their privacy notices, consent-capture mechanisms, and withdrawal mechanisms into conformity with the guidelines by that date. The deadline was reiterated in the Garante's newsletter of 8-9 October 2026, indicating active regulatory attention to this compliance area ahead of the cut-off. Tracking pixels are commonly embedded in advertising creative, email newsletters, and analytics tooling, meaning the guidelines' practical reach extends across commercial adtech practice broadly rather than being confined to a narrow category of operator. The precise legal-instrument citation underlying the guidelines has not been independently retrieved this cycle, which limits the ability to state with full confidence the exact statutory hook (whether grounded directly in the Codice Privacy, in ePrivacy-derived cookie-consent rules, or in a standalone Garante guideline exercising its general regulatory powers) behind the pixel-specific requirements. #### Outlook With the compliance deadline now within weeks, the near-term question is the rate of market conformity achieved by 29 October 2026 and whether the Garante follows with visible enforcement against non-compliant tracking-pixel practices. A secondary item to confirm in a future cycle is the precise legal basis of the guidelines themselves, which would clarify the applicable penalty regime for non-compliance. 2 earlier distinct update(s) Periodic update · new data 2026-10-11 #### AdTech & Commercial Privacy The Garante's guidelines on the use of tracking pixels in email marketing communications, adopted 17 April 2026, entered into force, per a notice dated 5 October 2026. These guidelines set standards for the use of tracking pixels, a technology commonly embedded in marketing emails to register when and whether a recipient has opened the message, bringing this practice within the Garante's active guidance framework for commercial email marketing. The precise relationship between the 17 April 2026 adoption date and the actual entry-into-force date was not confirmed against the Garante's own provvedimento text this cycle, and that gap should be noted before relying on either date as definitive. Separately, the Garante sanctioned a banking institution, under provvedimento 613/2026, for violations of the right to object to the use of personal data for commercial purposes, per reporting dated 14 September 2026. This finding rests on secondary reporting, as the provvedimento text itself was not directly retrieved this cycle; the specific nature of the commercial use to which the bank's customers objected was not detailed in the available sourcing. Taken together, these two developments show continued Garante activity on both ends of the commercial-privacy spectrum: proactive guidance-setting on tracking technology, and reactive enforcement against a financial-sector controller's handling of marketing-objection rights. #### Outlook Confirmation of the tracking-pixel guidelines' precise in-force date against the Garante's own text, and retrieval of the full provvedimento 613/2026 text concerning the banking institution's direct-marketing sanction, are the two clearest next steps to firm up this cycle's findings. Periodic update · new data 2026-09-28 #### AdTech & Commercial Privacy The Garante's 29 July 2026 newsletter recorded a marketing-related enforcement matter against Altroconsumo Edizioni, resulting in a fine of EUR 280,000. This is the principal adtech and commercial-privacy development for Italy this cycle, though it should be treated with appropriate caution: the finding rests on a single source, the Garante's own newsletter announcement, and the underlying provvedimento's full reasoning and factual basis were not independently corroborated in the sources reviewed this cycle. Reports suggest the matter concerned marketing-related processing, though the precise nature of the violation, whether direct-marketing consent failures, unlawful profiling for marketing purposes, or another commercial-privacy issue, was not specified in the sources available. The scale of the fine, at EUR 280,000, indicates the Garante treated the underlying violation as a serious matter within its marketing-enforcement practice, consistent with the broader pattern this cycle of the Garante maintaining an active enforcement tempo across multiple sectors simultaneously. However, given the single-source basis for this specific finding, readers should treat the characterisation of the violation itself as provisional pending corroboration from the Garante's own primary publication of the full provvedimento text. #### Outlook Corroboration of the Altroconsumo Edizioni matter through a primary Garante publication would materially strengthen confidence in this finding for a future cycle. In the interim, the EUR 280,000 fine should be read as one data point within the Garante's broader active-enforcement posture this cycle, alongside the Poste Italiane/PostePay sanction, rather than as a fully resolved standalone finding. Evidence 6 Sources and claims (6) - Confirmed[Garante Privacy](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9679893) — Under the Garante's 2021 cookie guidelines, at first website access no cookie or tracking tool other than technical ones may be positioned on a user's device by default, and no active (third-party) or passive (fingerprinting) tracking may occur without consent.observed 2026-08-03 - Confirmed[Garante Privacy](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9679893) — Cookie walls are deemed unlawful by the Garante unless the site operator provides equivalent access to content/services without requiring consent to cookies or other trackers, and re-prompting consent at every visit is considered redundant and invasive.observed 2026-08-03 - Confirmed[Garante Privacy](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10118222) — The Garante found a violation of Arts.4(11),5,7,12,13,24 and 25 GDPR and Art.122 Codice where a cookie banner was configured so that clicking either 'accept technical cookies' or 'accept all cookies' resulted in the same four cookies being installed, undermining granular consent.observed 2026-08-03 - Confirmed[Garante Privacy](https://www.garanteprivacy.it/temi/telemarketing) — The Registro Pubblico delle Opposizioni (RPO) is a free, institutional service allowing consumers to register fixed and mobile numbers to block telemarketing, with Garante oversight of the register's operation.observed 2026-08-03 - Probable[Garante Privacy](https://www.garanteprivacy.it/home/-/asset_publisher/4e4H/rss) — The Garante sanctioned data-broker Lusha EUR 2 million for monitoring and offering for sale the personal data of a large number of individuals.observed 2026-08-03 - Confirmed[Garante Privacy](https://www.garanteprivacy.it/web/garante-privacy-en/press-room) — The Garante fined Enel Energia EUR 26.5 million for aggressive telemarketing where consumers' data were used without consent and the accountability principle was not complied with.observed 2026-08-03