Cookie consent in Italy: Article 122 and the Garante rules

What is the Italian cookie law?

Italy transposed Article 5(3) of the ePrivacy Directive in Article 122 of the Personal Data Protection Code (Codice in materia di protezione dei dati personali, Legislative Decree 196/2003). Article 122(1) allows storing information on, or accessing information from, the terminal equipment of a subscriber or user only if that person has consented after being informed. Two exceptions apply: technical storage or access needed only to transmit a communication over an electronic communications network, and what is strictly necessary for a provider to deliver a service the user explicitly requested.

The Garante per la protezione dei dati personali explains how it applies Article 122 in its Linee guida cookie e altri strumenti di tracciamento, adopted on 10 June 2021 and published in the Gazzetta Ufficiale n. 163 of 9 July 2021. Sites had 6 months from publication to comply. The guidelines supplement and clarify the Garante's cookie measure of 8 May 2014 in the light of the GDPR definition of consent.

What must a cookie banner contain in Italy?

The guidelines (section 7.1) list what the first layer must contain:

• a command, marked with an X, that closes the banner and keeps the default settings, meaning the visitor continues browsing with technical cookies only; the banner must say so;
• minimal information that the site uses technical cookies and, with consent, profiling cookies or other trackers;
• a link to the full cookie information, reachable in one click and also from the footer;
• a command to accept all cookies and trackers;
• a link to an area where the visitor can choose purpose by purpose, by third party or by cookie, with every option set to refusal by default.

The X must have the same graphic prominence as the other buttons. A separate "Reject all" button is not mandatory, but it is the clearer way to give the same result, and the guidelines leave room for it. Pre-ticked boxes are not allowed.

Other points the Garante insists on:

• Scrolling is not consent. Scrolling alone is never a valid way to consent. It can only be part of a wider process that produces a recordable, unambiguous action.
• Cookie walls are unlawful unless the site offers access to equivalent content or services without consent, which the Garante assesses case by case.
• Choices must be recorded. A refusal or a partial choice must be stored, and consent must be an event that can be documented.
• Changing your mind. A footer link must let the visitor review and change the choice at any time.

How often can the banner be shown again?

The guidelines say a choice must not be asked again unless one of three things happens: the processing changes significantly (for example new third parties), the site cannot know that a choice was made (for example the visitor deleted cookies), or at least 6 months have passed since the banner was last shown. Asking again on every visit after a refusal is the kind of pressure the Garante wants to avoid.

Do analytics cookies need consent in Italy?

Not always. The Garante treats analytics cookies as equivalent to technical cookies, which need no consent, when:

• they are used only to produce aggregate statistics for a single site or app, without tracking a person across different sites or apps;
• for third-party tools, the IP address is masked, at least its fourth component for IPv4;
• the third-party provider does not combine the data with other processing or pass it to anyone else, except for statistics across several sites of the same publisher or group.

A standard Google Analytics 4 setup does not meet these conditions and needs consent. Analytics also raised a transfer question: on 9 June 2022 the Garante found that a publisher, Caffeina Media, used Google Analytics in breach of the GDPR's rules on transfers to the United States and gave it 90 days to comply. The EU-US Data Privacy Framework, adopted by the European Commission on 10 July 2023, has since changed the transfer analysis for certified US companies, but it does not remove the consent requirement for the cookie itself. See analytics without consent for alternatives.

How much are the fines in Italy?

Article 166(2) of the Code puts breaches of Article 122 in the GDPR's highest band: up to 20 million euros or 4% of worldwide annual turnover, whichever is higher. The Garante can also order a site to stop processing or issue a reprimand.

Italian cookie enforcement works mostly through inspections of ordinary websites, many carried out online by the Guardia di Finanza's privacy and technology fraud unit on the Garante's behalf, with e-commerce among the sectors targeted. The decisions published in 2025 show the pattern. On 27 February 2025 the Garante reprimanded a sole trader whose banner offered no way to continue without tracking and no purpose-by-purpose consent, without a fine because the site fixed the problems quickly. On 27 March 2025 it closed a case against an online shop after finding that its cookies were technical and its analytics configured without a user identifier. Fines exist, but the Garante usually starts with orders and reprimands.

What else does the Garante expect from the information?

The cookie information must be clear and complete, and the consent request clear and concise, without disrupting the use of the service more than needed. The banner must also be accessible to people who use assistive technologies, such as screen readers. A site aimed at Italian visitors therefore writes the banner and the cookie information in Italian.

How does Cookiequiet fit Italian rules?

Setting up Cookiequiet takes one script tag and about five minutes: the scan fills the cookie table, Reject all sits on the first layer next to Accept all by default, the preferences center has every category off until the visitor turns it on, and Italian visitors get the banner in Italian. Every choice is stored in a consent log, which is the documentation the guidelines ask for. Run the free cookie scanner to see what your site sets before consent.