Email Tracking Pixels Explained: How Opens Are Tracked

Email tracking pixels explained in one sentence: a tracking pixel is a single transparent image, loaded from the sender's server with a unique code in its address, so that the moment your mail client fetches it the sender knows you opened the email. They also learn roughly when, from which IP address, and often which device and mail app you used. Open it again tomorrow and they know that too.

This is the tracking pixel, and it is in the majority of commercial email. It is also in a surprising amount of personal email, because sales tools and browser extensions add it to ordinary messages so the sender can see when you read them. This guide explains how the technique works, what it can and cannot reveal, and how to block it in Gmail, Apple Mail, Outlook and the rest.

How does a tracking pixel work?

HTML email can include images hosted on remote servers, exactly like a web page. A tracking pixel is simply an image tag whose address is unique to you:

<img src="https://track.example.com/open?u=8f31c2a9&c=spring-sale" width="1" height="1" alt="">

When your mail client renders the message, it requests that address. The server returns a tiny transparent image and logs the request against the identifier 8f31c2a9, which maps to your email address in the sender's database. Because the request comes from your device, the log also contains your IP address, which gives an approximate location, and a user-agent string that identifies your mail client and operating system.

Links in the email are tracked the same way: each one passes through the sender's redirect server, which records the click before sending you on to the real destination. Pixels record opens; redirect links record clicks. Together they produce the "engagement" statistics every marketing platform sells.

What can senders learn?

• Whether and when you opened the message, and how many times.
• Roughly where you were, from the IP address: usually the city, sometimes less precise, sometimes more.
• Which device and client you used: iPhone Mail, Gmail on Android, Outlook on Windows.
• Whether you forwarded it, inferred from opens on new devices in new locations.
• Which links you clicked and in what order.

What a pixel cannot do is read your other mail, see your contacts, or install anything. It is a request for an image, nothing more. The privacy problem is the aggregation: open times across months build a picture of your daily routine, IP addresses map your travel, and the identifier ties it all to your name.

Who uses them

Every mainstream marketing platform turns tracking on by default, so newsletters, receipts, shipping notifications and promotional mail almost always include a pixel. Beyond marketing, sales teams use plugins that add a pixel to one-to-one messages so they can see when a prospect reads a proposal. Some recruiters, journalists and, less happily, some abusive individuals use the same tools to confirm that a target has read a message. Several email clients have begun labelling these tools' pixels, but most still pass through silently.

How to block tracking pixels

The universal fix is to stop your mail client loading remote images automatically. If the image is never fetched, the server never logs anything. Most clients now offer something better than a blanket block: they fetch images through their own proxy, so the sender sees the proxy's address and timing instead of yours.

Gmail

Gmail loads images through Google's proxy by default, which hides your IP address and device, but it still fetches the pixel when you open the message, so the sender learns that you opened it. To stop that: Settings, then "See all settings", then under "Images" choose "Ask before displaying external images". Gmail will then show a bar at the top of each message letting you load images for that message only.

Apple Mail (iPhone, iPad, Mac)

Apple's "Mail Privacy Protection" fetches every remote image in advance through Apple's servers, which hides your IP address and makes open times meaningless, because every message appears to be opened as soon as it arrives. It is on by default on recent systems; check Settings, Mail, Privacy Protection. If you would rather images not load at all, turn Privacy Protection off and enable "Block All Remote Content" instead.

Outlook

Desktop Outlook blocks external images by default in messages from unknown senders and shows a bar to download them. To make that apply to everyone, go to File, Options, Trust Center, Trust Center Settings, Automatic Download, and tick "Don't download pictures automatically". In Outlook on the web and the new Outlook app, the setting lives under Settings, General, Privacy and data, "External images"; choose "Always use the Outlook service to load images", which proxies them, or block them entirely.

Thunderbird and other desktop clients

Thunderbird blocks remote content by default and shows a notification bar per message. Most other desktop clients have an equivalent under Privacy or Security settings; the phrase to look for is "remote content" or "external images".

Privacy-focused providers

Proton Mail, Fastmail, Tuta and similar services block or proxy remote images by default and some strip known tracking pixels and rewrite tracked links before the message reaches you. If tracking bothers you a lot, this is the lowest-effort solution.

The trade-off: images you actually want

Blocking remote images also blocks product photos, logos and the occasional embedded chart until you click to load them. Most people find the one extra click acceptable for newsletters and never miss the images in automated mail. Receipts, tickets and boarding passes generally keep their important content as text or attachments, which are unaffected.

Tracked links are a separate problem

Blocking the pixel stops open tracking, but every link in the message is still a redirect through the sender's server. To avoid being logged when you click, hover over the link, read the real destination at the end of the tracking URL, and type or paste that destination directly. Some clients and privacy extensions do this automatically by unwrapping known tracking redirects.

For newsletters, an alternative is to use the "view in browser" link once and read the archive on the sender's site, where ordinary browser protections apply. If a newsletter you never asked for keeps arriving, see how to stop newsletter spam without unsubscribing.

How to tell whether a message is tracked

You do not have to take it on trust. A few checks reveal a pixel in under a minute:

1. With remote images blocked, look for a placeholder or "load images" bar; its presence means the message contains at least one remote image.
2. View the message source and search for width="1" or height="1", or for an image URL that ends in a long random identifier.
3. Hover over the links: a destination that passes through a domain other than the sender's is a tracked redirect.
4. Paste the raw message into an email header analyzer to see which sending platform it came from; our guide to reading email headers explains the lines.

Reduce the problem at the source

Tracking is only possible for senders who have your address. Give fewer of them a lasting one. For a one-off download, a coupon, or a site you will not use again, a disposable address expires along with the inbox, so every pixel in every follow-up message hits an address that no longer exists. For newsletters you genuinely want, a dedicated address or alias keeps the tracking data away from your main identity, and makes it obvious who sold your address if spam starts arriving. The broader habits are covered in our guide to avoiding spam.

In short

A tracking pixel is an invisible remote image that reports the moment your mail client loads it. Stop your client loading remote images automatically, or let it proxy them, and the open report never happens. Read link destinations before you click, and give throwaway senders a throwaway address so there is nothing lasting for them to track.

Sources

• Gmail Help: Turn images on or off in Gmail, Google's documentation of the external-images setting.
• Apple iPhone User Guide: Use Mail Privacy Protection, Apple's description of how remote content is prefetched and IP addresses hidden.
• Microsoft Support: Block or unblock automatic picture downloads in classic Outlook email messages, the Outlook setting described above.
• HTML Living Standard: Embedded content, the specification of the img element that makes remote images, and therefore pixels, possible.