Italy's data protection authority, the Garante, used its 8 October 2026 newsletter (no. 553) to set out a dense enforcement picture. It announced guidelines on email tracking pixels. It said its second-half 2026 inspections will include checks on how those guidelines are applied. And it recapped a run of actions against AI-generated deepfakes. I could not open the Altalex report on the inspection programme itself, so this analysis rests on the Garante's own published material, not on the programme's full text.
The case for the Garante's approach
The strongest argument for this enforcement is straightforward. Some AI services cause harm quickly, and slow procedures arrive too late. Clothoff, an app that digitally undresses photos of real people, is the clearest example. On 1 October 2025 the Garante, in provision 574, provisionally limited processing of Italian users' data by the British Virgin Islands company behind it. It found that age controls were not fully effective and that the "Fake" marking was barely visible and could be cropped out. It also noted that the company had not answered an information request sent on 6 August 2025. The press agency ANSA reported the order on 3 October 2025. A regulator that waited for a final sanction against an offshore operator that ignores its letters would protect nobody. On this narrow point the Garante is right.
Where the enforcement gets less certain
The harder case is the Garante's 23 July 2026 reprimand of R.T.I. S.p.A., publisher of Striscia la notizia, over satirical deepfakes of the journalist Enrico Mentana. According to the published decision, the Garante found breaches of GDPR Article 5 (lawfulness, fairness, transparency) and Article 25 (data protection by design and by default). Its reasoning was that the alteration was not clearly perceptible, that the statements looked truthful, that the real news-studio setting raised the risk of disinformation, and that the disclaimers would not work for a viewer joining mid-broadcast. It banned further processing in that form and imposed no fine.
The Garante itself called the legal question new and noted that it involves artistic expression, and it chose a reprimand as the proportionate response. That restraint is sensible. It also shows the problem. A broadcaster now has a regulator's view that a satirical format breached data protection principles, but no rule that says what an adequate label looks like. Satire depends on exaggeration, and the decision turns on whether exaggeration was sufficient and whether a disclaimer reached an inattentive viewer. Those are editorial judgements. A data protection authority is not obviously the best body to make them, and a pro-speech approach should say so.
A criminal law now exists, which changes the picture
Italy has also legislated. Law 132 of 23 September 2025, the national AI law, was published in the Gazzetta Ufficiale and entered into force on 10 October 2025. According to the Garante's newsletter, its Article 26 adds Article 612-quater to the Criminal Code, which punishes the unlawful spread of AI-generated or altered content with one to five years' imprisonment, generally on the victim's complaint. This is the right kind of instrument. It is a statute passed by Parliament, aimed at harmful conduct, and it leaves the privacy regulator's principles-based tools for situations the statute does not reach. The more clearly the criminal offence handles non-consensual sexual deepfakes, the less pressure there is to stretch GDPR principles to cover satire and commentary.
Tracking pixels: clear rules, short runway
The pixel guidelines are a better model of how to regulate. The newsletter says companies, platforms and newsletter operators must bring notices, consent and withdrawal systems into line by 29 October 2026. It places pixels under Article 122 of the Privacy Code, with the GDPR as the general framework. Prior, free, specific and informed consent is required, with exceptions for security, strictly technical needs, and institutional or service messages. The Garante also published an information sheet aimed at email providers and mass-mailing platforms.
This is what proportionate enforcement looks like. The rule is published, the exceptions are listed, the deadline is stated, and an inspection programme then checks compliance. Small senders can plan around it. The remaining risk is practical. A deadline only a few weeks after the guidelines appeared leaves little time for small publishers who rely on off-the-shelf email tools, and the supplier-facing information sheet matters for that reason.
What to watch
The Garante's health-data work shows it will impose large penalties when it finds clear violations. The newsletter notes a €7 million sanction on IQVIA Solutions Italy (provision 710 of 23 September 2026), for data on about one million patients that was not truly anonymous. That is a conventional GDPR case with a specific legal test. It differs in kind from the deepfake actions, which apply broad principles to new technology.
Three things follow. First, interim orders against non-responsive offshore services are justified, and other regulators should note the Clothoff approach. Second, the RTI reprimand should be treated as a signal and not as a template, because there is no fine, no court test yet, and a 30-day window for the broadcaster to challenge it. Third, the Garante has itself asked for more powers over deepfakes. Parliament should answer with narrowly drawn statutes, as it did with Article 612-quater, rather than letting a regulator's reading of Articles 5 and 25 carry the weight of speech-sensitive decisions.
Innovators in Italy can live with strict rules if they are written down in advance. What they cannot plan around is a regime where the line between lawful satire and a data protection breach is drawn case by case after publication.