Italy. ePrivacy / marketing. Act
Codice Privacy Arts 122/130Personal Data Protection Code, Title X (Arts 121-132-quater): electronic communications – cookies (Art 122) and unsolicited communications (Art 130)
In force
Partly verified
Medium confidence. No verification notes recorded.§1Summary
- Synopsis
Italy's ePrivacy rules are inside the Privacy Code: Art 122 requires consent for non-essential cookies and Art 130 requires opt-in for automated and electronic marketing, with a public opt-out register for telephone marketing.
- Key themes
- Unique features
Garante guidelines forbid cookie walls in most cases and treat scrolling as not consent; telemarketing enforcement is aggressive.
- SaaS relevance
Any SaaS website, app or product that sets non-essential cookies/SDKs or sends marketing emails/SMS to users in this country needs prior consent (subject to exemptions) under this law, regardless of where the provider is based.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- Telecom providers: authority notification under Reg 611/2013; otherwise GDPR
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- GDPR Art 83: €20m or 4% global turnover (Garante applies GDPR-scale fines)
§3Dates
- Key dates
- Adopted
- In force
- Garante cookie guidelines of 10 June 2021 (applicable Jan 2022); reformed public opt-out register (DPR 26/2022)
§4Text and authority
- Text
- Authoritative text normattiva.it
- Authority
- Garante per la protezione dei dati personali
§5Where it applies
- Domestic law of
- Italy
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence. No verification notes recorded.