Email Tracking Pixels: What They Track and How to Block

What Is an Email Tracking Pixel?

An email tracking pixel is a tiny, invisible image — typically just 1x1 pixel — embedded in an email. When you open the email and your email client loads images, it sends a request to the sender's server to fetch that image. That request tells the sender that you opened the email, along with a surprising amount of additional information.

Tracking pixels are not new. They have been used in web analytics since the late 1990s and migrated to email marketing in the early 2000s. Today, they are nearly ubiquitous in commercial email. Research published by Princeton's Center for Information Technology Policy found that tracking pixels are present in the vast majority of marketing emails, and a significant number of non-marketing emails include them as well.

The technology is simple, but its implications are substantial. A single invisible image can reveal your location, your device, your operating system, how many times you opened an email, and exactly when you read it. For privacy-conscious users, understanding how tracking pixels work is the first step toward controlling what information you share when you open your inbox.

How Tracking Pixels Work: The Technical Mechanism

The mechanics of a tracking pixel rely on the way email clients render HTML content. Here is the step-by-step process:

Step 1: Embedding the Pixel

The sender includes a tiny image in the email's HTML body. The image URL is unique to each recipient, typically containing an identifier that ties the request back to a specific email address. A simplified version might look like this:

<img src="https://tracking.example.com/pixel/abc123-unique-id.gif" width="1" height="1" />

The image is 1x1 pixel and is often transparent, making it invisible to the reader. Some senders also set the image to match the background color or position it off-screen.

Step 2: The Email Is Opened

When you open the email, your email client parses the HTML and attempts to load all images — including the tracking pixel. Your client sends an HTTP request to the tracking server, asking for the image file at that unique URL.

Step 3: Data Collection

The tracking server receives the HTTP request and logs the associated data. Because the URL is unique to your email, the server now knows:

• That you opened the email — the request itself is the signal
• When you opened it — the server records the timestamp
• Your IP address — included in every HTTP request
• Your approximate location — derived from your IP address via geolocation databases
• Your device and operating system — extracted from the User-Agent header your email client sends
• Your email client — also from the User-Agent header (Gmail, Outlook, Apple Mail, etc.)

Step 4: Repeated Tracking

Every time you reopen the email, the image is requested again (unless it has been cached). This means the sender can see how many times you opened the email and when each open occurred.

What Data Do Tracking Pixels Reveal?

The amount of information a single tracking pixel can expose is broader than most people expect. Here is a detailed breakdown:

IP Address and Location Tracking

The IP address is arguably the most sensitive piece of data a tracking pixel collects. IP addresses can be resolved to a geographic location — typically accurate to the city level, and sometimes to the neighborhood level. For users on fixed broadband connections, the same IP address may persist for weeks or months, making it a semi-stable identifier.

Combined with other data, IP addresses can also be used for:

• Identifying your employer — if you open email at work, your corporate IP may identify your company
• Detecting VPN usage — known VPN IP ranges are catalogued by tracking services
• Cross-referencing with web browsing data — advertising networks can match your email activity to your browsing history using shared IP addresses

Behavioral Profiling

Individually, each piece of data from a tracking pixel seems modest. Combined over dozens or hundreds of emails, the picture becomes detailed. A sender who tracks your opens over time can build a profile that includes:

• What time of day you typically read email
• Whether you read email on your phone during commutes and on your computer at work
• Which topics you engage with (based on which emails you open)
• Your approximate daily location pattern
• How responsive you are to different types of messaging

This behavioral data is valuable for marketing optimization, but it is collected without most users' awareness or meaningful consent.

How Common Are Tracking Pixels?

Tracking pixels are not a fringe technique — they are the default in email marketing.

A 2017 study published at the ACM Internet Measurement Conference analyzed a large email corpus and found that approximately 70% of mailing list emails contained at least one tracking pixel. A follow-up analysis by the email privacy service Hey.com in 2021 reported that roughly two-thirds of all emails sent to their platform contained trackers.

Research from Princeton's Web Transparency and Accountability Project identified that major email marketing platforms — including Mailchimp, SendGrid, HubSpot, Salesforce Marketing Cloud, and Constant Contact — embed tracking pixels by default. In most cases, senders must actively opt out of tracking, which few do.

The prevalence extends beyond marketing. Tracking pixels appear in:

• Transactional emails — order confirmations, shipping notifications, password resets
• Personal emails sent through tracked platforms — some CRM tools track emails sent by sales representatives
• Newsletters from news organizations — major publications track open rates for editorial and advertising purposes
• Political campaign emails — used to measure voter engagement and optimize messaging

The Regulatory Landscape

UK: PECR and ICO Guidance

In the United Kingdom, email tracking pixels fall under the Privacy and Electronic Communications Regulations 2003 (PECR), as well as the broader data protection framework of the UK GDPR.

The Information Commissioner's Office (ICO) has addressed tracking pixels directly. In a 2021 investigation into the use of tracking pixels by the Department for Education, the ICO concluded that the use of email tracking pixels to collect personal data without clear notice or consent raised significant concerns under PECR.

The key regulatory points under UK law:

• PECR Regulation 6 governs the storage of and access to information on a user's device. Tracking pixels that set cookies or rely on cached data may fall under this regulation, requiring consent.
• Legitimate interest under UK GDPR is sometimes claimed as a basis for tracking, but the ICO has indicated that the privacy impact of invisible tracking is difficult to justify under a legitimate interest assessment.
• Transparency requirements under UK GDPR mean that senders must inform recipients that tracking is taking place. Many senders bury this information in privacy policies that recipients never read.

The ICO's guidance on direct marketing makes clear that organizations should be transparent about the use of tracking technologies in emails and should consider whether consent is required.

EU: ePrivacy Directive and GDPR

Under EU law, the situation is similar. The ePrivacy Directive (which PECR implemented in the UK) requires consent for tracking technologies. The GDPR adds requirements for transparency and lawful basis. In practice, enforcement has been limited, but the legal framework clearly applies to tracking pixels.

United States: FTC and CAN-SPAM

The United States does not have a comprehensive federal privacy law equivalent to GDPR. The CAN-SPAM Act regulates commercial email but does not specifically address tracking pixels. However, the Federal Trade Commission (FTC) has authority over deceptive practices, and the use of invisible tracking without disclosure could be challenged as deceptive under Section 5 of the FTC Act.

Several US state privacy laws — including the California Consumer Privacy Act (CCPA) and its amendment, the California Privacy Rights Act (CPRA) — grant consumers rights over their personal information, which includes data collected via tracking pixels.

Regulatory Summary Table

How to Detect Tracking Pixels

Before you can block tracking pixels, it helps to know how to identify them.

Manual Detection

If you view the HTML source of an email (most email clients allow this through a "View Source" or "Show Original" option), you can search for tracking indicators:

• Look for <img> tags with width="1" and height="1" or similar very small dimensions
• Look for image URLs containing long unique identifiers, random strings, or parameters like ?id= or ?uid=
• Look for image URLs hosted on known tracking domains (many email marketing platforms use recognizable subdomains)

Browser Extensions and Tools

Several tools exist to detect tracking pixels automatically:

• Ugly Email (Gmail browser extension) — scans incoming emails and flags those containing tracking pixels
• Trocker (browser extension) — identifies and blocks tracking pixels in webmail
• PixelBlock (Gmail extension) — blocks tracking pixels in Gmail

These tools work by intercepting image requests before they are sent, identifying known tracking patterns, and either blocking the requests or alerting you to their presence.

How to Block or Reduce Email Tracking

There is no single solution that eliminates all email tracking while preserving full email functionality. However, a layered approach can significantly reduce your exposure.

1. Disable Automatic Image Loading

The most effective single step you can take is to configure your email client to not load remote images by default. Since tracking pixels rely on your client requesting an image from the sender's server, blocking that request blocks the tracking.

How to disable remote images in common email clients:

• Apple Mail (macOS): Settings > Privacy > enable "Protect Mail Activity" (or disable "Load remote content in messages")
• Apple Mail (iOS): Settings > Mail > Privacy Protection > enable "Protect Mail Activity"
• Gmail (web): Settings > General > Images > select "Ask before displaying external images"
• Outlook (desktop): File > Options > Trust Center > Trust Center Settings > Automatic Download > check "Don't download pictures automatically"
• Thunderbird: Settings > Privacy & Security > uncheck "Allow remote content in messages"

Trade-off: Some emails will look incomplete without images. You can always choose to load images for specific emails from trusted senders.

2. Use Apple Mail Privacy Protection

Apple introduced Mail Privacy Protection in iOS 15 and macOS Monterey. When enabled, this feature:

• Routes image loading through Apple's proxy servers, hiding your IP address from senders
• Preloads all remote content in the background, regardless of whether you open the email, which makes open tracking unreliable
• Hides your location and device information from the tracking server

This is currently one of the most effective built-in protections against email tracking, though it is only available to Apple Mail users.

3. Use a Privacy-Focused Email Provider

Some email providers build tracking protection into their service:

• Proton Mail — blocks tracking pixels by default and loads remote images through a proxy
• Tuta (formerly Tutanota) — blocks external content loading by default
• Hey.com — explicitly identifies and blocks tracking pixels, showing you which senders are tracking you

4. Use a VPN or Proxy

If you do load remote images, using a VPN masks your real IP address from the tracking server. This prevents location tracking and makes it harder to correlate your email activity with your browsing activity.

5. Use Disposable or Alias Email Addresses

Tracking pixels tie tracking data to your email address. If you use a unique disposable address for each service — via a service like ExpressMail — the tracking data is tied to a temporary address that cannot be correlated with your real identity or with other services.

This approach is particularly effective against cross-service profiling. If a data broker or advertising network receives tracking data from multiple senders, they cannot merge those profiles if each one is associated with a different disposable address.

6. Use Browser Extensions for Webmail

If you access email through a web browser (Gmail, Outlook.com, Yahoo Mail), browser extensions can intercept tracking pixel requests:

• uBlock Origin — a general-purpose content blocker that can block known tracking domains
• PixelBlock — specifically designed to block email tracking pixels in Gmail
• Ugly Email — identifies tracked emails with a visual indicator in Gmail

Protection Methods Comparison

The most robust approach combines multiple methods. For example: use a privacy-focused email provider with remote images disabled, access email through a VPN, and use disposable addresses for services you do not fully trust.

The Limitations of Tracking Pixel Blocking

It is important to understand that blocking tracking pixels is not a complete privacy solution.

Link tracking still works. Even if you block images, most marketing emails use redirected links. When you click a link in an email, it typically goes through the sender's tracking server before redirecting you to the destination. This tells the sender you engaged with the email, what you clicked, and when.

Some tracking does not use pixels. Advanced email tracking techniques include using CSS-based tracking (loading fonts or stylesheets from remote servers), embedded content that phones home, and AMP for Email interactive elements.

Server-side tracking is invisible. If a sender uses server-side logs to track email delivery (as opposed to opens), no client-side blocking can prevent it.

Blocking may affect email functionality. Some emails rely on remote images for legitimate purposes — product photos, charts, logos. Blocking all remote content means you may miss visual information.

What Companies See When You Block Tracking

When you successfully block a tracking pixel, the sender's analytics show one of two things:

1. No open recorded — if you blocked the image request entirely, you simply do not appear in their open statistics. You look like someone who never opened the email.

2. Proxy or generic data — if you used Apple Mail Privacy Protection or a proxy-based email provider, the sender may record an "open" but with Apple's IP address and generic device information instead of yours.

Either outcome is a win for your privacy. The sender cannot build an accurate behavioral profile if they cannot reliably determine when, where, and how you read their emails.

Practical Recommendations

For most people, a combination of two or three measures provides strong protection without significant inconvenience:

1. Enable your email client's built-in privacy features — Apple Mail Privacy Protection, Gmail's image blocking, or equivalent settings in your client. This is the minimum baseline.

2. Use disposable addresses for low-trust interactions — when you sign up for a newsletter, download gated content, or try a free trial, use a temporary address from ExpressMail. Even if tracking pixels are present, the data is tied to a disposable address with no connection to your identity.

3. Be selective about loading images — when you receive an email from an unfamiliar sender, do not load remote images unless you need to see them. Most text-based emails are fully readable without images.

4. Consider a privacy-focused email provider for your primary inbox — if email privacy is a priority for you, providers like Proton Mail or Tuta offer built-in tracking protection that works automatically.

Conclusion

Email tracking pixels are simple technology with outsized privacy implications. A 1x1 invisible image can reveal your location, your device, your schedule, and your level of interest in a message — all without your knowledge or explicit consent.

The good news is that effective countermeasures exist and are easy to implement. Disabling remote image loading, using privacy-focused email features, and routing low-trust interactions through disposable addresses collectively reduce the data that email senders can collect about you.

Regulators in the UK, EU, and increasingly in the US are paying attention to email tracking, and the legal landscape is shifting toward requiring transparency and consent. But regulatory enforcement is slow, and the technology is deployed at massive scale. For now, the most reliable protection is the one you implement yourself — by understanding what tracking pixels do and taking practical steps to limit their reach.