An email tracking pixel is a small image, usually 1 by 1 pixel and transparent, embedded in a message so that the sender learns when it is opened. It is one of the oldest techniques in bulk mail and is still common in marketing platforms and some one-to-one tools. This article explains how it works, what it reveals, and how to stop it.
How the pixel works
The HTML part of a message contains an image tag whose source is a URL on the sender's server:
<img src="https://track.example.com/o/8f3a1c2e.gif" width="1" height="1" alt="">Each message gets a unique identifier in the path, so the sender can match a request to a specific message and recipient. When your mail client renders the message and fetches the image, the request goes to the sender's server. That request carries:
- Your IP address, which gives an approximate location and network provider.
- The User-Agent header, which identifies the mail client and often the operating system.
- The time of the request.
The sender does not need your cooperation. The image loads because the client loads remote images. That is the whole mechanism.
Variations you will see
Pixels are not the only technique. Related methods include:
- Tracked links. Links are rewritten to pass through a redirect on the sender's domain, which records the click and then forwards you to the real destination. These fire on click, not on open, so blocking images does not stop them.
- CSS or background images that reference remote URLs, which behave the same way as an image tag.
- Apple Mail Privacy Protection. Since iOS 15 and macOS Monterey, Apple Mail fetches remote content through Apple's proxy. The sender sees a fetch from Apple's infrastructure rather than your IP address, and an open is recorded whether or not you read the message. Open tracking still happens, but its meaning has changed: many recorded opens are proxy fetches, not reads.
Spotting a pixel in a message
View the raw source of a message and look for img tags with width and height of 1, or with a style that hides them. Check the hostname of each remote image. A hostname unrelated to the sender's domain, or a long random path, is a strong sign of tracking. Also look for utm_, mc_eid, or similar query parameters on links, which identify campaign tracking.
Blocking remote images
The most effective step is to stop your client loading remote content by default. Most clients have a setting in a privacy or remote content section that blocks remote images until you allow them, either per message or per sender. In Thunderbird, look for the remote content option in the privacy settings and set it so that remote content is not loaded automatically. Webmail clients usually offer a similar "load images" control for each message.
Blocking images does not stop the rest of the tracking surface. For that, combine several measures:
- Use a client that blocks remote content by default. Plain-text viewing is the strongest option for mail from people you do not know.
- Strip tracking parameters from links before you follow them. Browser extensions do this, and some clients offer it.
- Open unknown links in a browser profile or container that holds no cookies from other sites.
- Use a DNS-level or network-level blocker where you control the resolver. This blocks known tracking hostnames for every application, not only mail.
What blocking costs
Some legitimate mail, such as receipts and statements, depends on images, and a blocked image can hide important content. Set a sensible default, then allow images for senders you trust. Blocking also does not hide your address from the sender: when you reply, they learn it. For services you do not fully trust, use an alias, as described in aliases as a privacy strategy.
Where ITProMail fits
ITProMail does not add tracking pixels, and the service has no advertising or analytics. The pixels described here come from senders. Remote-content controls in your client are where you act on them. For a setup that keeps remote content blocked, start with the Thunderbird guide and then review the settings for whichever client you use.