Italy Bans Open Pixels, US Court Greenlights Cold Email Lawsuits — Two Legal Shifts That Redefine Deliverability Risk in 2026
What if your open-rate data became a legal liability in Italy, and your cold email sequence landed you in court in the U.S. — all in the same week?
That is no longer a hypothetical. Two separate regulatory developments – one from Italy’s data protection authority, one from a federal court in Washington State – have shifted the compliance landscape for anyone sending email at scale. In Europe, the tracking pixel you rely on for lead scoring now requires explicit consent for new subscribers. In the U.S., a ruling against Skechers USA has confirmed that state anti-deception laws can survive CAN-SPAM preemption, meaning a snappy subject line in a cold email campaign can trigger a class action lawsuit. Deliverability professionals can no longer treat privacy and consent as separate concerns. They are now the same risk vector.
Italy’s Garante Makes Open Tracking Pixel Consent Mandatory – With a Tight Deadline
Italy’s data protection authority, the Garante per la protezione dei dati personali, issued guidelines in April 2026 that directly target how email senders deploy open tracking pixels. The core requirement: disclosure to every recipient and, for most use cases, prior consent. This is not a recommendation. It is a mandate with an enforcement deadline of October 28, 2026.
The rules apply to any email program with subscribers in Italy. Two dates matter:
- For subscribers who joined before April 29, 2026: you must update your opt-in forms to include clear language about tracking pixels and provide an opt-out mechanism by October 28, 2026.
- For subscribers who join on or after April 29, 2026: you must obtain prior, explicit consent for open tracking pixels at the moment of sign-up.
The Garante’s position is that individual-level open tracking – the kind that tells you exactly when a particular lead opened a message – triggers GDPR-level consent requirements. There are exemptions for certain types of emails (e.g., transactional) and for opaque pixels that provide only aggregate data. But for the vast majority of marketing and cold email programs, the pixel is now a regulated data collection tool.
France introduced similar rules earlier in 2026. More EU countries are expected to follow. The implications for deliverability are immediate. If you rely on open rates to segment active leads or trigger follow-ups, you can no longer assume that tracking works uniformly across your list. Subscribers who opt out of pixel tracking will drop off your radar – and your algorithms.
Skechers Ruling Opens Door for State-Level Cold Email Lawsuits
On May 19, 2026, a federal judge in the Western District of Washington allowed a class action against Skechers to proceed under Washington’s Commercial Electronic Mail Act (CEMA). The plaintiffs alleged that Skechers sent emails with subject lines designed to create a false sense of urgency – think “Last Chance” or “Only 2 Left” when inventory was not actually limited. Skechers argued that CAN-SPAM preempted CEMA. The court disagreed.
The ruling centers on CAN-SPAM’s express preemption clause (15 U.S.C. § 7707(b)(1)), which preserves state laws that “prohibit falsity or deception in any portion of a commercial electronic mail message or information attached thereto.” The court held that CEMA’s subject-line provisions fit squarely within that carveout. Because the subject lines were alleged to be deceptive (creating false urgency), the state law was not preempted.
This matters far beyond Skechers. It means that any state law that targets deceptive email practices – not just spam volume, but actual content – can survive preemption as long as the deception claim is rooted in falsity. Cold email campaigns often use urgency or scarcity tactics to drive opens. Those tactics now carry a measurable legal risk in states with strong consumer protection statutes. Washington is one. California, New York, and others have similar laws waiting for plaintiffs’ lawyers to dust them off.
The takeaway: CAN-SPAM is not a shield. If your subject line can be interpreted as materially deceptive, a state court can let the lawsuit proceed.
Two Shifts, One Consequence: Deliverability Strategy Must Now Account for Dual Regulatory Pressures
At first glance, these two developments seem unrelated – one is about tracking technology, the other about email content. But they converge on the same operational point: the data you use to optimize deliverability and conversation sequencing is becoming a liability.
Consider a common cold email workflow. You send a batch of initial emails from a new domain. You track opens via a pixel to identify who is engaged. Then you send a follow-up within 48 hours, using a subject line like “Did You Miss This?” to create urgency. Under the new Italian rules, if any recipient is in Italy, tracking that open without prior consent is a violation. Under the Skechers precedent, if your follow-up subject line implies scarcity or a missed opportunity in a way that is not strictly accurate, a Washington resident could sue.
Deliverability risk is no longer just about bounce rates and spam complaints. It is about legal exposure per recipient, per email. And that exposure varies by jurisdiction.
What to Do Now: Five Concrete Moves for Email Campaigns That Cross Borders
Practitioners cannot wait for the October 28 deadline or for the next state to file a copycat lawsuit. Here is what you can implement this week:
- Audit your subscription flow for Italian subscribers. For any sign-up form that collects email addresses from Italian residents, add a clear checkbox or toggle for pixel tracking consent. This must be separate from general marketing consent. Existing subscribers need an opt-out mechanism – automate that with a preference center update before October 28.
- Segment your open tracking data. Stop using individual-level open pixels for recipients who have not explicitly consented. Instead, consider relying on engagement signals like link clicks, reply rates, or domain-level aggregate data. This may degrade your lead scoring accuracy in the short term, but it avoids consent violations.
- Review all cold email subject lines for honesty. Go through your past 60 days of outbound sequences. Flag any subject line that uses words like “last chance,” “expiring,” “limited,” or “urgency.” Remove them or rewrite to be factually verifiable. If you cannot prove the scarcity, do not use the phrase – especially for contacts in Washington, California, or New York.
- Update your CAN-SPAM compliance checklist to include state-level review. CAN-SPAM requires honest subject lines. Now treat state law as an additional layer. Add a step to your campaign approval process: “Is this subject line false or deceptive under any state’s consumer protection act?” If you cannot answer with confidence, kill the email.
- Work with legal counsel on a jurisdiction-specific opt-in strategy. The Italian rules have exemptions for opaque pixels and transactional messages. Your lawyer can help you classify your email types correctly. Similarly, a state-by-state assessment of cold email laws is overdue. The cost of a class action defense dwarfs the cost of a compliance audit.
The Unresolved Tension: Consent Fatigue vs. Performance Data
These two shifts force a deeper question: how much transparency is too much? If you ask every subscriber to opt into tracking, many will say no. That means your engagement metrics become less reliable. Your deliverability models – built on historical open behavior – start to drift. Cold email sequences that rely on time-sensitive triggers lose their edge.
On the other hand, ignoring these regulations is not an option. Italy has made clear it will enforce the October deadline. The Skechers ruling will likely be cited by plaintiffs in other states. And more jurisdictions are moving in the same direction – the EU is watching France and Italy, and individual U.S. states are watching Washington.
So here is the open question that no regulatory authority has answered: If open pixels become conditional and subject lines must be purely factual, what replaces the signals that drive modern email deliverability? Will we revert to a world where only click-throughs and replies matter – or will the industry invent new, consent-safe tracking mechanisms fast enough?
The answer will determine whether email marketing in 2027 is more precise or more blunt.