RadarWave Encrypted Tracking for AcyMailing Plugin

Why

The Italian Data Protection Authority (Garante per la protezione dei dati personali) published guidelines on tracking pixels in emails (decision no. 284 of 17 April 2026, compliance by 29 October 2026). They apply Article 122 of the Italian Privacy Code, which transposes Article 5(3) of the EU ePrivacy Directive 2002/58/EC. The EDPB Guidelines 2/2023 on the technical scope of that article confirm that it covers tracking pixels and tracking links in emails. The guidelines also apply data protection by design (Article 25 GDPR) and security of processing (Article 32 GDPR), and among the technical measures they ask for an unintelligible, non-sequential identifier.

AcyMailing measures opens and clicks with an invisible image and with links that carry, in plain text, the email ID and the subscriber ID: sequential numbers that anyone who sees the URL can read, and that are easy to forge.

What it does

This add-on replaces those IDs, at sending time, with a random AES-256-GCM code (different for every email) and decodes it when the open or click comes in. Opens and clicks keep showing up in AcyMailing reports. Nothing to configure: the key is derived from your WordPress salts.

Forged URLs record nothing; the link still leads to the right page.
Links in emails sent before activation keep counting.
If encryption fails, the email is sent anyway.

It covers the identifier part of the guidelines. Privacy notice, consent and the option to stop tracking remain the sender’s responsibility.

Requires AcyMailing 10 or later. Tested on WordPress 7.1 with AcyMailing 11.0 and 11.1.

External services

This plugin does not connect to any external service and sends no data to RadarWave. Opens and clicks are recorded by AcyMailing on your own site, as before; the plugin only encrypts and decrypts the identifiers locally.