How to set up a signup form with Privacy Policy and separate management of consents for marketing and profiling purposes

Disclaimer

Introduction

Proper management of personal data is a cornerstone of the GDPR. To ensure regulatory compliance, collecting information via online forms requires a precise technical and informational structure. Supervisory Authorities have significantly increased their focus on so‑called tracking pixels in emails. The Decision of 17 April 2026 by the Italian Data Protection Authority, containing the Guidelines on the use of tracking pixels in email communications (“Guidelines”) sets out strict rules: these invisible technologies capable of recording email opens fall squarely under Article 122 of the Italian Privacy Code (which implements the so‑called ePrivacy Directive in Italy). This means that, subject to any exceptions provided for by the Guidelines, you must obtain the user’s explicit and informed consent to use such trackers; according to the Guidelines, this consent may be encompassed within consent for promotional/marketing purposes.

If you want to review the instructions for configuring a signup form with dedicated management of consent for marketing purposes, which also includes pixel tracking, see the article How to set up a form with Privacy Policy notice and dedicated management of marketing consent.

This guide explains how to practically configure a data and consent collection form, focusing on correctly handling profile fields, collecting consent for promotional and marketing communications, and managing tracking technically within magnews, in line with privacy by design requirements. In this scenario, tracking via pixels is encompassed within consent for profiling purposes, in accordance with privacy by design principles and applicable data protection guidance.

In the following example, we describe how to configure a newsletter signup form; however, you can apply the same guidance to other forms that collect an email address and consents for marketing and profiling purposes (for example, a website registration form, a demo request, or similar forms).

• Contact data: the first section is dedicated to collecting the contact’s identifying information.
• Privacy policy acknowledgment: the second section allows the user to declare that they have read and understood the notice, which also describes how interactions with messages are tracked.
• Privacy consents for marketing and profiling purposes, which may also include pixel-based tracking: the third section covers consent for sending promotional communications and consent for profiling purposes, within which the processing of personal data performed through email tracking pixels may be included.

Contact information and privacy fields

The form fields used to collect the contact’s information could include, for example:

• Name
• Surname
• Email
• County

To demonstrate that data subjects have been properly informed, the form can include a checkbox that allows the user to:

• declare that they have read the Privacy Policy and accepted the site’s Terms of Use, if provided;
• give consent to the processing of data for sending promotional communications;
• give consent to the processing of data for profiling purposes, which may also include tracking via pixels, should the customer choose not to follow the instructions provided in the article How to set up a form with Privacy Policy notice and dedicated management of marketing consent.

In addition, the Privacy Policy must clearly and explicitly set out the processing activities performed and the tracking carried out through pixels.

You may also add further fields to collect additional consents (e.g., for sharing data with third parties, etc.).

A control field of type CAPTCHA is also present:

If needed, you can map form fields to specific database fields to save contact data and preferences.

To map a form field value to a database field, in the General tab of the field properties, simply select the desired field from the Connect to contact field dropdown where the value will be saved:

Learn more in the article How to create a signup form for detailed steps and information on creating a signup form from scratch.

Privacy policy

The full text of the Privacy Policy must be available on the same page as the form or on a page linked from it.

In this scenario, the policy must also clearly describe the tracking features for interactions with messages, such as email opens and clicks, specifying the purposes of the processing and how such information is collected and used.

Consent for sending promotional communications

Contact data may be collected for different purposes.
For each of these, you may decide to carry out the activity based on the data subject’s specific consent. In this case, this need translates into adding a dedicated checkbox (or a single-choice question, also known as a radio button) for each consent you intend to collect.

Consent for profiling purposes

When a contact gives or withdraws consent to the profiling of their data, within which the customer chooses to include tracking via pixels, their preference can be saved to a specific shared system field, native to magnews. This field is called Denies consent to tracking (ID: NOTRACK) and it can take the following values:

• Yes: the contact’s opens and clicks will not be considered;
• No: the contact’s activities will be tracked;
• Not defined: this is the default value set in magnews. In this case, no desired behavior is explicitly specified, but the contact’s activities are tracked.

Note
The default value will be used for new contacts when no different value is provided. For example, if you associate a value for the Denies consent to tracking field during a contact import, the value specified in the file will be used.

In the contact profile you can view its value in the Settings section. The field is named Denies consent to tracking:

By navigating to Profile Studio > Global database > Dashboard > Setup you can access the general default database settings, where you will find the Privacy section.
The preferences under Contact tracking, in particular, are tied to the values of the Denies consent to tracking field.

If the value of the Denies consent to tracking field is Yes, on this page you can choose between:

• Record events without making them visible to the user
  contact data will be used only for aggregate reports, which will not allow the contact to be identified.
  In the contact profile, some tabs will be hidden (e.g., Conversions, Activity, …) where their aggregated data appears, along with the values of fields for which the option Anonymize field values upon unsubscribe request has been enabled (in the screenshot below, the option has been enabled for the email field):

• Do not record events
  no data related to the individual contact will be tracked, neither for profiling purposes nor as aggregated data for reports or statistics.

Configure the privacy policy field

For the checkbox related to acknowledging the Privacy Policy, open the form field settings and ensure that:

• the field is not prefilled;
• the text clearly links to the Privacy Policy;
• the field is required if acknowledging the Privacy Policy is necessary to complete the signup.

Configure the profiling consent field

Unlike a standard checkbox for a privacy consent, the one related to consent for profiling and tracking requires additional steps, since it must save a specific value to the Denies consent to tracking system field.

To achieve this, open the settings of the checkbox “I consent to profiling of my data, including interactions with communications (e.g., opens and clicks), to receive personalized content and offers” and configure it as follows:

• Set Prefilled value to “Yes (selected)”
• Enable the Connect to contact field option
• Select the Denies consent to tracking field
• Enable the Reverse the checkbox function option

Now open the confirmation button “Submit” and make sure the following actions are present:

• Subscribe contact
• Save connected fields on the contact
• Complete response
• Go to the final page
• Send email: this action is optional; add it if you want to send the contact an email confirming the successful signup

Remember to read the article How to create a signup form for detailed steps and information on creating a signup form from scratch.