How to set up a form with Privacy Policy notice and dedicated management of marketing consent

Disclaimer

Introduction

Proper management of personal data is a cornerstone of the GDPR. To ensure regulatory compliance, collecting information via online forms requires a precise technical and informational structure. Supervisory Authorities have significantly increased their focus on so-called tracking pixels in emails. The Decision of 17 April 2026 by the Italian Data Protection Authority, containing the Guidelines on the use of tracking pixels in email communications (“Guidelines”) sets out strict rules: these invisible technologies capable of recording email opens fall squarely under Article 122 of the Italian Privacy Code (which implements the so‑called ePrivacy Directive in Italy). This means that, subject to any exceptions provided for by the Guidelines, you must obtain the user’s explicit and informed consent to use such trackers; according to the Guidelines, this consent may be encompassed within consent for promotional/marketing purposes.

This guide explains how to practically configure a form in which the user must be able to acknowledge the Privacy Policy, which must clearly and explicitly describe the tracking features for message interactions, such as email opens and clicks. It also describes how to correctly handle profile fields and consent for sending promotional communications and managing tracking within magnews, in line with privacy by design requirements.

In the following example, we describe how to configure a newsletter signup form; however, you can apply the same guidance to other forms that collect an email address and consent for marketing purposes (for example, a website registration form, a demo request, or similar forms).

In this scenario, the form is organized into three main sections:

• Contact data: the first section is dedicated to collecting the contact’s identifying information.
• Privacy policy acknowledgment: the second section allows the user to declare that they have read and understood the notice, which also describes how interactions with messages are tracked.
• Marketing consent, which also includes pixel-based tracking: the third section covers consent for sending promotional communications, within which the processing performed via email tracking pixels may be included.

Contact information and privacy field

The form fields used to collect the contact’s information could include, for example:

• Name
• Surname
• Email
• County

To demonstrate that data subjects have been properly informed, the form can include a checkbox that allows the user to:

• declare that they have read the Privacy Policy and accepted the site’s Terms of Use, if provided;
• give consent to the processing of data for sending promotional communications and for tracking.

In addition, the Privacy Policy must clearly and explicitly set out the processing activities performed and the tracking carried out through pixels.

You may also add further fields to collect additional consents (e.g., for profiling purposes, sharing data with third parties, etc.).

A control field of type CAPTCHA is also present:

If needed, you can map form fields to specific database fields to save contact data and preferences.

To map a form field value to a database field, in the General tab of the field properties, simply select the desired field from the Connect to contact field dropdown where the value will be saved:

Learn more in the article How to create a signup form for detailed steps and information on creating a signup form from scratch.

Privacy policy

The full text of the Privacy Policy must be available on the same page as the form or on a page linked from it.

In this scenario, the policy must also clearly describe the tracking features for interactions with messages, such as email opens and clicks, specifying the purposes of the processing and how such information is collected and used.

Consent for marketing purposes

In magnews, consent related to marketing for a contact’s interactions can be managed via the shared system field Denies consent to tracking (ID: NOTRACK).

This field can take the following values:

• Yes: the contact’s opens and clicks will not be considered;
• No: the contact’s activities will be tracked;
• Not defined: this is the default value set in magnews. In this case, no different behavior is specified and the contact’s activities are tracked.

Note
The default value will be used for new contacts when no different value is provided. For example, if you associate a value for the Denies consent to tracking field during a contact import, the value specified in the file will be used.

In the contact profile you can view the value in the Settings section. The field is named Denies consent to tracking:

By navigating to Profile Studio > Global database > Dashboard > Setup you can access the general default database settings, where you will find the Privacy section.
The preferences under Contact tracking, in particular, are tied to the values of the Denies consent to tracking field.

If the value of Denies consent to tracking is set to Yes, on this page you can choose between:

• Record the events without making them visible to the user
  contact data will be used only for aggregate reports, which will not allow the contact to be identified.
  In the contact profile, some tabs will be hidden (e.g., Conversions, Activity, …) where their aggregated data appears, along with the values of fields for which the option Anonymize field values upon unsubscribe request has been enabled (in the screenshot below, the option has been enabled for the email field:

• Do not record events
  no data related to the individual contact will be tracked, neither for profiling purposes nor as aggregated data for reports or statistics.

Configure the privacy policy field

For the checkbox related to acknowledging the Privacy Policy, open the form field settings and ensure that:

• the field is not prefilled;
• the text clearly links to the Privacy Policy;
• the field is required if acknowledging the Privacy Policy is necessary to complete the signup.

Configure the marketing consent field

For the checkbox related to consent for marketing and tracking, open the form field settings and ensure that:

• the field is not prefilled;
• the field is not required.

In addition, a specific value must be saved to the system field Denies consent to tracking.
When a contact says Yes to tracking interactions (e.g., message opens and/or clicks), the value saved to Denies consent to tracking must be No.

To achieve this, in the settings of the checkbox “I consent to the processing of my personal data for sending promotional communications, including tracking interactions with communications (e.g., opens and clicks)”, you should:

• Set Prefilled value to “Yes (selected)”
• Enable the Connect to contact field option
• Select the Denies consent to tracking field
• Enable the Reverse the checkbox function option

Now open the confirmation button “Submit” and make sure the following actions are present:

• Subscribe contact
• Save connected fields on the contact
• Complete response
• Go to the final page
• Send email: this action is optional; add it if you want to send the contact an email confirming the successful signup

Remember to read the article How to create a signup form for detailed steps and information on creating a signup form from scratch.