Email Pixel Tracking: What It Reveals and How to Block It

Email pixel tracking is how a sender finds out that you opened their message. The email contains a tiny, usually invisible image stored on the sender’s server, at a web address made for you. When your mail app loads it, the server logs that you opened the message, when, on what kind of device, and from which IP address. The IP address points to a rough location.

To block it, turn off automatic image loading in your mail app (steps for each app). An image proxy like Gmail’s hides your IP address and device, but usually not the open. Apple Mail’s Protect Mail Activity makes every message look opened. Links are tracked separately. Pixels are also called spy pixels or web beacons, and mail apps call the images remote content or external images. CatchNone, an email alias app for iPhone, iPad, and Mac, keeps remote images, including most tracking pixels, blocked until you load them, and gives each signup its own address, so a confirmed open points to one alias, not your main email.

How email pixel tracking works

A tracking pixel in email is an ordinary image tag. Here is an illustrative one on a placeholder domain, not any real platform’s format:

<img src="https://t.example.com/open/8f2c41d7e9.gif?m=autumn-sale"
     width="1" height="1" alt="">

• t.example.com is a server run by the sender or its email platform. The image isn’t inside the email, so your app has to fetch it.
• 8f2c41d7e9 is an ID made for you and this message. It turns “someone opened this” into “you opened this.” The CNIL, France’s data protection regulator, says a pixel’s address usually has “individualised settings relating to the user or context in which the image appears.”
• width="1" height="1" and the empty alt keep it out of sight.

When your app fetches the image, the server logs the ID, the time, your IP address, and the app and system named in the request’s User-Agent header. The sender’s report then shows you as having opened the email. Mailchimp’s help pages confirm it from the sender’s side: open tracking doesn’t work in plain-text email, or when the recipient’s app doesn’t display images. That’s why blocking images works.

A tracker doesn’t have to be 1×1. Any remote image with an address unique to you, such as a logo or a banner, can do the same job.

What an email tracking pixel reveals

The UK’s Information Commissioner’s Office (ICO), the CNIL, Apple, and Mailchimp describe much the same list. A sender can learn:

• whether you opened the message, when, and how many times;
• your device type, operating system, and mail app;
• your IP address, and from it an approximate location;
• whether you forwarded it, because the forwarded copy still carries your pixel.

The CNIL adds that pixels don’t give access to your other emails or your mailbox. They can reach beyond the sender, though: a 2018 Princeton study of commercial mailing lists found that about 30% of emails leaked the recipient’s email address to third parties when viewed.

Can an email track your location or IP address?

Only roughly, and only if your device fetches the image itself, you click a tracked link, or you open an attachment that fetches something from the internet. MaxMind, a major IP geolocation vendor, says its data is “never precise enough to identify or locate a specific household, individual, or street address.” For US IP addresses, it estimates about 66% accuracy at city level, within 50 km (about 30 miles). Expect your city or region and your internet provider. A VPN changes which IP address the sender sees, but it doesn’t hide the open.

Gmail works differently. Since 2013, Gmail has fetched images through Google’s own servers, and Google says senders “can’t use image loading to get information about your computer or location.” It also says “sometimes, senders may know whether you’ve opened an email that has an image.” Litmus, which measures opens for senders, still records Gmail opens “via Gmail’s image cache.” The proxy hides your IP address, device, and location. It usually doesn’t hide that you opened the message.

What each mail app reveals

Checked against each vendor’s help pages (iOS 27, macOS 27) and Thunderbird’s default settings, September 2026. Apple’s IP hiding depends on Limit IP Address Tracking being on for the network you use.

How to block tracking pixels

You rarely need a separate email pixel blocker: the image setting in your mail app is the blocker. If your app already fetches images through a proxy (Gmail, Outlook.com, Fastmail), turning images off adds one thing: the sender no longer learns that you opened.

Apple Mail

On iPhone and iPad (iOS 27 and iPadOS 27), go to Settings → Apps → Mail → Privacy Protection and turn on Protect Mail Activity. Apple says it also needs Limit IP Address Tracking, which is set for each network: go to Settings → Wi-Fi and tap the info button next to your network (Apple’s steps). On a Mac, choose Mail → Settings → Privacy and select Protect Mail Activity. Block All Remote Content, with Hide IP Address, is the alternative if you’d rather nothing loads until you ask. How Mail Privacy Protection works on iPhone and Mac covers the steps and trade-offs.

Gmail

Google documents a separate setting for the web, Android, and iPhone, so change each one you use (Google’s steps).

On a computer:

1. In Gmail, click Settings at the top right, then See all settings.
2. On the General tab, scroll to Images and select Ask before displaying external images.
3. Click Save Changes at the bottom of the page.

On Android:

1. In the Gmail app, tap Menu, then Settings, then your account.
2. Under Data usage, tap Images, then Ask before showing.

On iPhone and iPad:

1. In the Gmail app, tap Menu, then Settings.
2. Under Inbox, tap Email preferences, then Images, then Ask before displaying external images.

On the web, click Display images below to load the images in one message.

Outlook

• Classic Outlook for Windows blocks automatic picture downloads by default, and Microsoft lists “helping you avoid tracking pixels” as a reason. To check, go to File → Options → Trust Center → Trust Center Settings and make sure the check box starting “Don’t download pictures automatically” is selected. In Outlook for Microsoft 365 the options are on the Automatic Download tab. Adding a sender to Safe Senders unblocks their pictures, pixels included, and your Outlook contacts count as safe senders by default.
• New Outlook for Windows: as of September 2026, Microsoft’s help pages don’t describe an image-download setting for it. If you want images off by default on Windows, classic Outlook and Thunderbird block them.
• Outlook for Mac doesn’t download internet pictures by default. In new Outlook for Mac, choose Outlook → Settings, select Reading under Email, and under Download external images choose Ask before downloading.
• Outlook for iPhone and Android download images unless you choose Block external images or Load images for safe senders. Tap the banner in a message to load its images.
• Outlook.com loads images through Microsoft’s image proxy. In Settings → General → Privacy and data, leave Always use the Outlook service to load images selected. Microsoft warns that without it “your personal data might be at risk.” To stop images from senders you haven’t approved, go to Settings → Mail → Junk email and, under Security options, select Block attachments, pictures, and links from anyone not in my Safe senders and domains list. That also blocks links and attachments from those senders.

Other apps and services

• CatchNone keeps remote images, including most tracking pixels, blocked in every message until you tap Load images, and its Load remote images switch under Settings → Appearance is off by default.
• Fastmail fetches remote images through its own servers, so “the image host still won’t know your IP address or browser.” This applies only in Fastmail’s web interface and mobile app, not when you read Fastmail mail in another app. To be asked first, go to Settings → Mail preferences, then under Reading → Remote images choose Always ask before showing remote images.
• Proton Mail has Block email tracking on by default. It’s set per device: Settings → Email privacy on the web and desktop, and Settings → Privacy and security in the mobile apps.
• Thunderbird blocks remote content by default.
• Yahoo Mail last documented the choice for its old desktop version: Settings → More Settings → Viewing email → Show images in messages → Ask before showing external images. Check the current menu before relying on it.
• Forwarding alias services such as addy.io (on paid plans), Firefox Relay, and DuckDuckGo Email Protection can strip known pixels before they forward mail to your inbox. Removing pixels doesn’t change how links are tracked.
• Browser extensions that flag trackers in Gmail exist. Check what access to your mail they ask for; your mail app’s image setting is the more dependable control.

Does blocking images stop all tracking?

No. Blocking images stops pixels, but links are tracked separately. Newsletter platforms swap each link for one that goes through their own server. Mailchimp says a click “redirects them through Mailchimp’s servers” to the real address, and the redirect is logged. The click opens in your browser, so that server sees your real IP address even if your mail app proxies images. Mailchimp also counts a click as an open, and uses “click data” to locate contacts whose opens Apple hides.

Apple says Mail Privacy Protection “does not extend to links or email attachments.” Proton Mail strips known tracking parameters from links on the web, but says companies’ own parameters can be hard for it to detect. If you just want the shop’s website, type its address instead of clicking.

Do spammers know if you open their email?

Sometimes. If your app loads images straight from the sender’s server, a pixel tells them the address works. Microsoft explains that downloading an internet picture “can alert the sender that your email address is active and that you received the message.”

• Images load directly: they learn the address is live, when you opened it, and roughly where you are.
• Images load through a proxy (Gmail, Outlook.com, Fastmail): usually the open, not your IP address or device.
• Apple Mail with Protect Mail Activity: every delivered message looks opened, so the sender can’t tell whether you read it, though the background fetch still shows the message reached a mailbox in use.
• Images blocked: the pixel sends nothing.

Many apps also hold back images in spam. Gmail doesn’t show images in messages it finds suspicious, Fastmail always blocks remote images in Spam, and Mail on the Mac never shows remote content in messages marked as junk.

In any app, replying or clicking a link confirms your address, unsubscribe links included. How they got the address in the first place is covered in how spammers get email addresses.

Are email tracking pixels legal?

It depends on where you and the sender are. The short version: UK and EU regulators apply their rules on storing or reading information on your device (the same rules behind cookie banners, alongside the GDPR) to email pixels, so a sender that tracks your opens individually generally needs your consent there, with narrow exceptions. The US has no federal rule aimed at email pixels.

UK

The ICO finalized its guidance on storage and access technologies on April 29, 2026, after the Data (Use and Access) Act changed the Privacy and Electronic Communications Regulations (PECR). It covers tracking pixels by name. Most email marketing falls under regulation 22, but “where tracking pixels store information (or gain access to information stored) on a user’s device, regulation 6 applies.” Regulation 6 requires consent to the UK GDPR standard unless an exception applies. The new exception for statistics “does not allow you to monitor or track individual visitors.”

EU and France

The European Data Protection Board (EDPB), in its Guidelines 2/2023 (version 2.0, adopted October 7, 2024), says Article 5(3) of the ePrivacy Directive applies to tracking pixels and tracking links in email. That’s the rule that storing or reading information on your device needs your consent unless it’s strictly necessary for a service you asked for.

The CNIL’s final recommendation (French original), adopted on March 12, 2026, and published on April 14, 2026, is the most specific. It says that under French law, senders need your consent to use pixels to analyze open rates and improve campaigns, to build profiles for targeting you elsewhere, or to detect fraud. Only two uses are exempt: authentication security, and a deliverability check that keeps just the date of your last open, in emails you asked for, such as order confirmations. Ignoring a consent request counts as refusing, and you can complain to the CNIL.

US

The federal commercial-email law, CAN-SPAM, doesn’t mention open tracking: the requirements in the FTC’s compliance guide cover things like honest headers, a postal address, and a working opt-out. Lawsuits have tried older privacy laws instead. In Smith v. Target (November 13, 2025), the Arizona Court of Appeals held that data from “spy pixels” in marketing emails falls outside Arizona’s communication-records statute. That ruling covers one state’s law.

Is it safe to open spam or junk email?

In an up-to-date mail app, opening spam is low risk. The harm comes from clicking links, opening attachments, and typing passwords or card details. The FTC warns that “scammers sometimes send phishing emails with attachments or links that, if opened or clicked, install harmful malware on the device.” Apple advises: “Don’t follow links or open or save attachments in suspicious or unsolicited messages.”

Opening has two smaller risks. If images load directly, it can confirm your address, so keep automatic images off and don’t reply. And rare security bugs have been triggered just by receiving or opening a message. Microsoft’s Outlook flaw CVE-2023-23397 could be exploited as soon as Outlook retrieved and processed the message, before it appeared in the Preview Pane. In 2020, iOS 13.5 fixed two Mail bugs triggered by a crafted message. All three were fixed long ago, which is why updates matter.

In Gmail, the risk is lower still: Google scans every message for suspicious content and checks images for known harmful software.

Skip the unsubscribe link in obvious spam. The archived phishing guidance from the US Cybersecurity and Infrastructure Security Agency (CISA) says not to click any link, “including any ‘unsubscribe’ link.” The exceptions are covered in when unsubscribe links are safe to click. Mark the message as spam or junk instead; what actually cuts spam goes further.

Opening spam on an iPhone

Keep iOS updated. In Mail, keep Protect Mail Activity or Block All Remote Content on (steps above). Don’t tap links in spam; Apple suggests touching and holding a link to see where it really goes. Move spam to Junk, which for iCloud Mail is also how Apple asks you to report it.

If you already opened it or clicked a link

If you only opened it, mark it as spam or junk and delete it. If you clicked a link, downloaded something, or typed a password, card number, or other personal details, follow what to do after clicking a suspicious link.

How CatchNone keeps pixels quiet

CatchNone is an email alias app for iPhone, iPad, and Mac that keeps pixels quiet by default. Messages open with their JavaScript off, and remote images, including most tracking pixels, stay blocked until you tap Load images for that message. The Load remote images switch under Settings → Appearance is off by default. Each shop, newsletter, or account also gets its own address, either a random @catchnone.com address, which needs Premium, or one on a domain you own, and each message shows which alias it reached. If a pixel does confirm an address, it’s one alias, not your main email; what to use for signups covers why that helps.

It blocks all remote content rather than detecting pixels, so loading a message’s images tells the sender you opened it, and links are left as they are, tracked ones included. It covers mail you read in CatchNone, which is receive-only: it never sends, replies, or forwards. Download CatchNone, available for iPhone, iPad, and Mac.

FAQ

How can I tell if an email has a tracking pixel?

Usually you can’t by looking. The BBC noted in 2021 that “without special software, it is not easy to spot which emails contain a tracking pixel.” With automatic images off, a message that asks to load remote content may contain one. In Gmail on the web, More → Show original shows the raw message, where a 1×1 image with a long, unique address is a strong hint.

Can people see if I open their email?

Often, yes. If your mail app loads images, even through a proxy like Gmail’s, anyone who adds a pixel can usually see that you opened the message, and when. Individuals do this too: in 2021, Hey’s co-founder told the BBC that salespeople and consultants can say, “I saw you open my email yesterday, but you haven’t replied yet.” Read receipts are different: the standard (RFC 8098) recommends asking you first, personal Gmail accounts can’t request them, and Outlook.com can do so only from Outlook for Windows. Blocking images, or turning on Protect Mail Activity, stops pixels from showing your opens.

Is a tracking pixel the same as a cookie?

No. A cookie is stored by your browser, while a pixel is an image your app fetches. Regulators apply the same rules to both, though. The ICO lists tracking pixels alongside cookies under PECR, and the EDPB applies the same ePrivacy article to both.

Do email trackers still work?

Yes, with less detail than before. In Litmus’s July 2026 figures, Apple accounted for 62% of the opens it tracked and Gmail for 27%. Litmus recorded every Gmail open through Google’s image cache and doesn’t count opens from Apple’s Mail Privacy Protection as reliable. When Hey checked its traffic for the BBC in 2021, two-thirds of email sent to its users’ personal accounts contained a pixel, even after excluding spam.