Email Tracking Pixels: What They Track and How to Block Them

An email tracking pixel is a tiny invisible image that reports when you open a message, along with your IP address, rough location, and device. To block email tracking, turn off automatic loading of remote images, use Apple Mail Privacy Protection or a provider that blocks trackers, and give low-trust senders a disposable address.

What Is an Email Tracking Pixel?

An email tracking pixel is a tiny, invisible image (typically just 1x1 pixel) embedded in an email. When you open the email and your email client loads images, it sends a request to the sender's server to fetch that image. That request tells the sender that you opened the email, along with a surprising amount of additional information.

Tracking pixels are not new. They have been used in web analytics since the late 1990s and migrated to email marketing in the early 2000s. Today, they are nearly ubiquitous in commercial email. Princeton researchers found hundreds of third-party trackers in the marketing emails they studied, and later analyses have found spy pixels in everyday personal mail as well (details below).

The technology is simple, but its implications are substantial. A single invisible image can reveal your location, your device, your operating system, how many times you opened an email, and exactly when you read it. For privacy-conscious users, understanding how tracking pixels work is the first step toward controlling what information you share when you open your inbox.

How Tracking Pixels Work: The Technical Mechanism

The mechanics of a tracking pixel rely on the way email clients render HTML content. Here is the step-by-step process:

Step 1: Embedding the Pixel

The sender includes a tiny image in the email's HTML body. The image URL is unique to each recipient, typically containing an identifier that ties the request back to a specific email address. A simplified version might look like this:

<img src="https://tracking.example.com/pixel/abc123-unique-id.gif" width="1" height="1" />

The image is 1x1 pixel and is often transparent, making it invisible to the reader. Some senders also set the image to match the background color or position it off-screen.

Step 2: The Email Is Opened

When you open the email, your email client parses the HTML and attempts to load all images, including the tracking pixel. Your client sends an HTTP request to the tracking server, asking for the image file at that unique URL.

Step 3: Data Collection

The tracking server receives the HTTP request and logs the associated data. Because the URL is unique to your email, the server now knows:

• That you opened the email: the request itself is the signal
• When you opened it: the server records the timestamp
• Your IP address: included in every HTTP request
• Your approximate location: derived from your IP address via geolocation databases
• Your device and operating system: extracted from the User-Agent header your email client sends
• Your email client: also from the User-Agent header (Gmail, Outlook, Apple Mail, etc.)

Step 4: Repeated Tracking

Every time you reopen the email, the image is requested again (unless it has been cached). This means the sender can see how many times you opened the email and when each open occurred.

What Data Do Tracking Pixels Reveal?

The amount of information a single tracking pixel can expose is broader than most people expect. Here is a detailed breakdown:

IP Address and Location Tracking

The IP address is arguably the most sensitive piece of data a tracking pixel collects. IP addresses can be resolved to a geographic location, typically accurate to the city level and sometimes to the neighborhood level. For users on fixed broadband connections, the same IP address may persist for weeks or months, making it a semi-stable identifier.

Combined with other data, IP addresses can also be used for:

• Identifying your employer: if you open email at work, your corporate IP may identify your company
• Detecting VPN usage: known VPN IP ranges are catalogued by tracking services
• Cross-referencing with web browsing data: advertising networks can match your email activity to your browsing history using shared IP addresses

Behavioral Profiling

Individually, each piece of data from a tracking pixel seems modest. Combined over dozens or hundreds of emails, the picture becomes detailed. A sender who tracks your opens over time can build a profile that includes:

• What time of day you typically read email
• Whether you read email on your phone during commutes and on your computer at work
• Which topics you engage with (based on which emails you open)
• Your approximate daily location pattern
• How responsive you are to different types of messaging

This behavioral data is valuable for marketing optimization, but it is collected without most users' awareness or meaningful consent.

How Common Are Tracking Pixels?

Tracking pixels are not a fringe technique; they are the default in email marketing.

A Princeton study of commercial mailing-list emails, published at PETS 2018, found hundreds of third parties tracking recipients through embedded pixels and similar methods, and about 30% of the emails leaked the recipient's email address to third parties as soon as they were opened. In 2021, the email service Hey analyzed its traffic for a BBC investigation and found spy pixels in two-thirds of the emails sent to its users' personal accounts, even after excluding spam.

Major email marketing platforms, including Mailchimp, HubSpot, Salesforce Marketing Cloud, and Constant Contact, build open tracking in, and it is usually switched on by default. In most cases, senders must actively opt out of tracking, which few do.

The prevalence extends beyond marketing. Tracking pixels appear in:

• Transactional emails: order confirmations, shipping notifications, password resets
• Personal emails sent through tracked platforms: some CRM tools track emails sent by sales representatives
• Newsletters from news organizations: major publications track open rates for editorial and advertising purposes
• Political campaign emails: used to measure voter engagement and optimize messaging

Are Email Tracking Pixels Legal?

UK: PECR and ICO Guidance

In the United Kingdom, email tracking pixels fall under the Privacy and Electronic Communications Regulations 2003 (PECR), as well as the broader data protection framework of the UK GDPR.

The Information Commissioner's Office (ICO) has addressed tracking pixels directly. Its guidance on storage and access technologies, finalized in April 2026, uses a marketing email with a tracking pixel as an example: where the pixel stores or accesses information on the reader's device, PECR's regulation 6 applies. Spy pixels also made UK headlines in 2021, when the BBC investigation above named major brands that were using them.

The key regulatory points under UK law:

• PECR Regulation 6 governs the storage of and access to information on a user's device. Tracking pixels that set cookies or rely on cached data may fall under this regulation, which requires consent unless a narrow exception applies.
• Legitimate interest under UK GDPR is sometimes claimed as a basis for tracking, but it does not replace PECR: where regulation 6 applies, you need consent or one of its specific exceptions.
• Transparency requirements under UK GDPR mean that senders must inform recipients that tracking is taking place. Many senders bury this information in privacy policies that recipients never read.

The ICO's direct marketing guidance adds that PECR's email marketing rules cover the email itself, not the pixel inside it, and points senders to the storage and access rules for any pixels they use. If you send marketing email yourself, our guide to email tracking pixels and consent covers the sender's side.

EU: ePrivacy Directive and GDPR

Under EU law, the situation is similar. The ePrivacy Directive (which PECR implemented in the UK) requires consent for tracking technologies. The GDPR adds requirements for transparency and lawful basis. In practice, enforcement has been limited, but the legal framework clearly applies to tracking pixels.

United States: FTC and CAN-SPAM

The United States does not have a broad federal privacy law equivalent to GDPR. The CAN-SPAM Act regulates commercial email but does not specifically address tracking pixels. However, the Federal Trade Commission (FTC) has authority over deceptive practices, and the use of invisible tracking without disclosure could be challenged as deceptive under Section 5 of the FTC Act.

Several US state privacy laws, including the California Consumer Privacy Act (CCPA) and its amendment, the California Privacy Rights Act (CPRA), grant consumers rights over their personal information, which includes data collected via tracking pixels.

Regulatory Summary Table

How to Detect Tracking Pixels

Before you can block tracking pixels, it helps to know how to identify them.

Manual Detection

If you view the HTML source of an email (most email clients allow this through a "View Source" or "Show Original" option), you can search for tracking indicators:

• Look for <img> tags with width="1" and height="1" or similar tiny dimensions
• Look for image URLs containing long unique identifiers, random strings, or parameters like ?id= or ?uid=
• Look for image URLs hosted on known tracking domains (many email marketing platforms use recognizable subdomains)

Browser Extensions and Tools

Several tools exist to detect tracking pixels automatically:

• Ugly Email (Gmail browser extension): scans incoming emails and flags those containing tracking pixels
• Trocker (browser extension): identifies and blocks tracking pixels in webmail
• PixelBlock (Gmail extension): blocks tracking pixels in Gmail

These tools work by intercepting image requests before they are sent, identifying known tracking patterns, and either blocking the requests or alerting you to their presence.

How to Block or Reduce Email Tracking

There is no single solution that eliminates all email tracking while preserving full email functionality. However, a layered approach can significantly reduce your exposure.

1. Disable Automatic Image Loading

The most effective single step you can take is to configure your email client to not load remote images by default. Since tracking pixels rely on your client requesting an image from the sender's server, blocking that request blocks the tracking.

How to disable remote images in common email clients:

• Apple Mail (macOS): Settings > Privacy > enable "Protect Mail Activity" (or disable "Load remote content in messages")
• Apple Mail (iOS): Settings > Apps > Mail > Privacy Protection > enable "Protect Mail Activity" (on iOS 17 and earlier, Settings > Mail)
• Gmail (web): Settings > General > Images > select "Ask before displaying external images"
• Outlook (desktop): File > Options > Trust Center > Trust Center Settings > Automatic Download > check "Don't download pictures automatically"
• Thunderbird: Settings > Privacy & Security > uncheck "Allow remote content in messages"

Trade-off: Some emails will look incomplete without images. You can always choose to load images for specific emails from trusted senders.

2. Use Apple Mail Privacy Protection

Apple introduced Mail Privacy Protection in iOS 15 and macOS Monterey. When enabled, this feature:

• Routes image loading through Apple's proxy servers, hiding your IP address from senders
• Preloads all remote content in the background, regardless of whether you open the email, which makes open tracking unreliable
• Hides your location and device information from the tracking server

This is currently one of the most effective built-in protections against email tracking, though it is only available to Apple Mail users.

3. Use a Privacy-Focused Email Provider

Some email providers build tracking protection into their service:

• Proton Mail: blocks tracking pixels by default and loads remote images through a proxy
• Tuta (formerly Tutanota): blocks external content loading by default
• Hey.com: explicitly identifies and blocks tracking pixels, showing you which senders are tracking you

4. Use a VPN or Proxy

If you do load remote images, using a VPN masks your real IP address from the tracking server. This prevents location tracking and makes it harder to correlate your email activity with your browsing activity.

5. Use Disposable or Alias Email Addresses

Tracking pixels tie tracking data to your email address. If you use a unique disposable address for each service, for example a free temporary email address from ILoveTempMail, the tracking data is tied to a temporary address instead of your real one, and it cannot be matched to your other accounts by email.

This approach is particularly effective against cross-service profiling, because your email address otherwise works as an identity key across sites. If a data broker or advertising network receives tracking data from multiple senders, they cannot merge those profiles if each one is associated with a different disposable address.

One caveat: ILoveTempMail shows HTML emails in a sandbox with scripts blocked, but it loads remote images so messages display properly. A pixel in an email you open still fires and still sees your IP address, so pair a disposable address with a VPN if you also want to hide your IP.

6. Use Browser Extensions for Webmail

If you access email through a web browser (Gmail, Outlook.com, Yahoo Mail), browser extensions can intercept tracking pixel requests:

• uBlock Origin: a general-purpose content blocker that can block known tracking domains
• PixelBlock: specifically designed to block email tracking pixels in Gmail
• Ugly Email: identifies tracked emails with a visual indicator in Gmail

Protection Methods Comparison

The strongest approach combines multiple methods. For example: use a privacy-focused email provider with remote images disabled, access email through a VPN, and use disposable addresses for services you do not fully trust.

The Limitations of Tracking Pixel Blocking

Blocking tracking pixels is not a complete privacy solution.

Link tracking still works. Even if you block images, most marketing emails use redirected links. When you click a link in an email, it typically goes through the sender's tracking server before redirecting you to the destination. This tells the sender you engaged with the email, what you clicked, and when.

Some tracking does not use pixels. Advanced email tracking techniques include using CSS-based tracking (loading fonts or stylesheets from remote servers), embedded content that phones home, and AMP for Email interactive elements.

Server-side tracking is invisible. If a sender uses server-side logs to track email delivery (as opposed to opens), no client-side blocking can prevent it.

Blocking may affect email functionality. Some emails rely on remote images for legitimate purposes: product photos, charts, logos. Blocking all remote content means you may miss visual information.

What Companies See When You Block Tracking

When you successfully block a tracking pixel, the sender's analytics show one of two things:

1. No open recorded: if you blocked the image request entirely, you do not appear in their open statistics. You look like someone who never opened the email.

2. Proxy or generic data: if you used Apple Mail Privacy Protection or a proxy-based email provider, the sender may record an "open" but with Apple's IP address and generic device information instead of yours.

Either outcome is a win for your privacy. The sender cannot build an accurate behavioral profile if they cannot reliably determine when, where, and how you read their emails.

Practical Recommendations

For most people, a combination of two or three measures provides strong protection without significant inconvenience:

1. Enable your email client's built-in privacy features: Apple Mail Privacy Protection, Gmail's image blocking, or equivalent settings in your client. This is the minimum baseline.

2. Use disposable addresses for low-trust interactions: when you sign up for a newsletter, download gated content, or try a free trial, use a temporary address from ILoveTempMail. Even if tracking pixels are present, the opens are tied to a disposable address rather than your real one (your IP address still shows unless you use a VPN).

3. Be selective about loading images: when you receive an email from an unfamiliar sender, do not load remote images unless you need to see them. Most text-based emails are fully readable without images.

4. Consider a privacy-focused email provider for your primary inbox: if email privacy is a priority for you, providers like Proton Mail or Tuta offer built-in tracking protection that works automatically.

Conclusion

Email tracking pixels are simple technology with outsized privacy implications. A 1x1 invisible image can reveal your location, your device, your schedule, and your level of interest in a message, all without your knowledge or explicit consent.

The good news is that effective countermeasures exist and are easy to implement. Disabling remote image loading, using privacy-focused email features, and routing low-trust interactions through disposable addresses collectively reduce the data that email senders can collect about you.

Regulators in the UK, EU, and increasingly in the US are paying attention to email tracking, and the law is moving toward requiring transparency and consent. But regulatory enforcement is slow, and the technology is deployed at massive scale. For now, the most reliable protection is the one you implement yourself: understand what tracking pixels do and take practical steps to limit their reach.