How Email Tracking Pixels Work and How to Block Them

By State of Surveillance Published: 2026-09-16 Last Updated: 2026-09-16

The Quick Read

An email tracking pixel is a tiny invisible image embedded in a message. The sender's server logs a request every time your mail client loads it. That request leaks when you opened the mail, how many times, on what device, and your rough location from your IP address. [2] [4]

Prevalence is the part most readers miss. Proton, summarizing academic research, says "almost 50% of all emails contain spy pixels" and "over 166 billion emails are sent with trackers every day." [4] Princeton research referenced in that same post found "70% of emails from mailing lists contain at least one tracker." [4]

Apple Mail Privacy Protection now pre-fetches remote images through a relay so your real IP never reaches the sender. [1] Gmail, Outlook, Proton, and Hey each have their own toggle. You do not need to install anything to block most of this.

What a Tracking Pixel Actually Is

An email tracking pixel is a one-by-one pixel transparent GIF image embedded in the HTML body of an email. The technical writer Julia Evans describes it plainly: "A tracking pixel is a 1x1 transparent gif that sites use to track you." [2] The image is effectively invisible in the message, but it is still a real image that the email client has to fetch.

Every tracking pixel has a unique URL the sender controls. The URL usually carries an identifier tied to your email address, plus query parameters the sender uses to track the campaign. When your mail client loads the image, your computer makes an HTTP request for that URL. The sender's web server logs the request.

That single request is enough. The sender's server now knows:

  • That your email address is active and reachable.
  • The exact time you opened the message.
  • How many times you have re-opened it.
  • Your IP address, which geolocates to a city or neighborhood.
  • Your user agent string, which identifies your device, operating system, and email client.
  • Any cookies already set for that domain, which can link the open to other activity the sender knows about you.

Proton's documentation lists the same set of disclosures: "Whether you opened an email and how many times," "The date and time you opened it," "What device and operating system you used," and "Your internet service provider (ISP) and rough location inferred from your IP address." [4]

Who Embeds Pixels and Why

The bulk use case is marketing automation. When you get a promotional email from a retailer, a SaaS product, or a newsletter, there is a fair chance it contains a tracking pixel. The sender uses it to measure open rates, decide when to follow up, and score your "engagement."

Sales tools are the second big category. Email tracking platforms aimed at salespeople let a sender embed a tracking pixel in a one-to-one email so they can see when a prospect has opened the message and from where. The salesperson never tells the prospect the mail is being tracked.

Recruiters, real estate agents, banks, and political campaigns use the same tooling. In all of these cases the recipient is a real person who never opted in to being tracked, and the only way they could know is to inspect the raw HTML of the message.

Attackers also use the technique. Confirming that an email address is active and that the recipient is reading their mail at a particular IP range is valuable pre-attack reconnaissance for spear phishing and credential theft.

The Superhuman Controversy (July 2019)

The most visible public fight over email tracking was Superhuman, a premium email client. Superhuman embedded tracking pixels in every outgoing message by default and showed the sender the recipient's location, when they opened the message, and how many times. The recipient never agreed to any of this.

In July 2019, researchers and journalists including Bruce Schneier raised the alarm. The Verge and other outlets covered the controversy, and within a day Superhuman reversed course. The company's own blog post, written by CEO Rahul Vohra on July 3, 2019, listed five changes made "effective immediately":

  1. Superhuman stopped logging location information for new emails "effective immediately." [5]
  2. New versions released the same day no longer show location information. [5]
  3. Superhuman committed to deleting "all historical location data" from its apps. [5]
  4. Read status remained a feature but was turned off by default. Users would have to "explicitly turn it on." [5]
  5. Superhuman built an option to disable remote image loading while still showing other images. The setting is reached via Cmd+K then Images. [5]

The post closes with: "The team and I are committed to this now more than ever. We need to consider not only our customers, but also future users, the people they communicate with, and the Internet at large." [5]

Superhuman is the exception. Most senders still embed pixels by default and most recipients never know.

How Apple Mail Privacy Protection Works

Apple's Mail Privacy Protection is a feature in Apple Mail on iPhone, iPad, Mac, and iCloud.com. Apple's legal description is specific about what the feature actually does.

On pre-fetching: "Protect Mail Activity downloads remote content in the background by default, regardless of whether you engage with the email." [1] In other words, Apple Mail loads every remote image in every message automatically, without you opening the message and without telling the sender.

On hiding your IP: "Protect Mail Activity routes all remote content downloaded by Mail through two separate relays operated by different entities. The first knows your IP address, but not any third-party Mail content you receive. The second knows the remote Mail content you receive, but not your IP address, instead providing a generalized identity to the destination. No single entity has the information to identify both you and the third-party Mail content you receive." [1]

The practical effect is that the sender's pixel server logs a request from Apple's relay instead of from your device. It cannot match the open to your IP, your precise time, or your user agent, so the open signal becomes almost useless for tracking.

The same Apple page notes users can disable the feature from the same settings location. [1] You can confirm or change the toggle yourself:

  • iPhone, iPad, and Vision Pro: Settings, then Apps, then Mail, then Privacy Protection. [1]
  • Mac: Mail, then Settings, then Privacy. [1]
  • iCloud.com: Settings, then Privacy and Security. [1]

How to Block Pixels in Other Email Clients

Most major email clients have a remote image toggle. They differ in where the setting lives and whether it is on by default. The exact menu paths below are the documented ones from each vendor's own product.

Gmail on the web

  1. Open Gmail, then click the gear icon, then See all settings.
  2. Under the General tab, scroll to Images.
  3. Choose "Ask before displaying external images" instead of "Always display external images."
  4. Scroll to the bottom and click Save Changes.

From then on Gmail shows a placeholder image with a "Display images below" link in each message. Clicking the link loads every remote image in that one message, including any tracking pixel. The click is the moment the sender learns the address is active, so the default is the safer choice.

Gmail on Android and iPhone

The Gmail mobile app exposes images only when you tap to show them, which is the safer default. There is no global setting to change.

Outlook on Windows or Mac

  1. Open Outlook, then File, then Options, then Trust Center, then Trust Center Settings.
  2. Under Automatic Download, check "Don't download pictures automatically in standard HTML email messages or RSS items."
  3. Click OK twice.

Outlook still lets you load images per message with a click, the same way Gmail does. The setting path is the same in Outlook for Mac under Preferences, then Reading.

Thunderbird

  1. Open Thunderbird, then View, then Toolbars, then Menu Bar if the menu bar is hidden.
  2. Open View, then Display Attachments Inline. Uncheck it.

With this off, Thunderbird never renders inline images in HTML mail. Plain text email clients do not load remote images at all.

Proton Mail

Proton Mail blocks tracking pixels by default in its web, iPhone, and iPad apps. Enhanced tracking protection is described in Proton's own blog as: "Removing known spy pixels every time you receive an email," "Preloading other remote images using a proxy with a generic IP address to hide your IP address and location," and "Cleaning tracking links to remove known UTM or other tracking parameters." [4]

A shield icon in Proton's interface alerts you to blocked trackers, with the number showing "the total number of trackers (spy pixels) blocked and links cleaned." [4]

Hey

Hey, the privacy-focused mail service, blocks tracking pixels by default. The BBC's investigation in February 2021, summarized by John Gruber at Daring Fireball, found that "roughly two-thirds of emails sent to users' personal accounts contained a spy pixel" in Hey's own traffic and praised Hey for default-blocking pixels and "shaming senders" in the interface. [6]

Browser Extensions and Plugins

For webmail that you cannot or do not want to reconfigure, browser extensions can strip tracking pixels at the inbox. The three that have been around long enough to be worth a serious look are:

  • Ugly Email (Chrome, Firefox): Scans your inbox and surfaces a small icon on any message that contains a known tracker. It also actively blocks the tracking pixel. All detection happens locally in your browser, and it does not work cross-platform to mobile. [3]
  • PixelBlock (Chrome, Firefox, Gmail only): Blocks tracking pixels inside Gmail in the browser and shows a count next to each message.
  • Trocker (Chrome, Firefox): Blocks pixel-based open tracking in Gmail, Yahoo, and Outlook.com webmail.

These tools do not catch every pixel and they do not protect you on your phone. Treat them as a layer on top of a privacy-respecting email client, not a substitute.

DNS-Level Blocking (Pi-hole and AdGuard)

A Pi-hole or a network-wide DNS sinkhole can block tracking domains by resolving them to nothing. The image fetch fails, the sender's pixel server never logs a hit, and you never see a broken-image placeholder.

Two practical caveats. First, the technique is only as good as the blocklist, and trackers rotate domains often. Second, many senders embed their pixel on their own corporate domain rather than a third-party tracker domain. If your bank uses a pixel hosted at its own domain, a DNS blocker cannot tell the difference between the legitimate homepage image and the tracking pixel and you will break legitimate images across the board.

DNS-level blocking works best against third-party marketing trackers and worst against first-party senders who embed on their own infrastructure.

What Blocking Cannot Hide

Stopping the pixel from loading protects you from the open-time leak. It does not protect you from what mail servers already see by design.

When an email is delivered, the receiving mail server (your employer's, your provider's, your self-hosted one) sees the sender, the recipient, the subject line, the timestamp, your IP address, and the message size. The sender's mail server sees the same from the other side. None of this requires a tracking pixel.

If you use a corporate mail relay, your employer may also see every message you receive and send. That is a separate threat model.

Pixel blocking is also not the same as end-to-end encryption. Even after you block the pixel, the sender knows the address is valid (because the SMTP delivery succeeded) and the receiver learns who is emailing you and when. To hide message content, you need Proton Mail, Tutanota, or PGP. To hide metadata, you need a different network protocol entirely.

The Comparison At a Glance

Apple Mail

  • Blocks remote images for tracking: Yes, pre-fetches through two-relay proxy [1]
  • Default state: On for new users
  • Covers: iPhone, iPad, Mac, iCloud.com

Gmail (web)

  • Blocks remote images for tracking: Yes, ask-before-display
  • Default state: Always display external images
  • Covers: Web only, mobile already asks

Outlook

  • Blocks remote images for tracking: Yes, in Trust Center
  • Default state: Download pictures automatically on
  • Covers: Windows, Mac

Thunderbird

  • Blocks remote images for tracking: Yes, off by default
  • Default state: Display Attachments Inline on
  • Covers: Windows, Mac, Linux

Proton Mail

  • Blocks tracking pixels: Yes, by default [4]
  • Pre-loads images through proxy: Yes [4]
  • Shows blocked count: Yes, with shield icon [4]

Hey

  • Blocks tracking pixels: Yes, by default [6]
  • Surfaces senders: Yes, in inbox view [6]
  • Public free tier: No

The Bottom Line

Email tracking is the kind of surveillance that survives because nobody sees it. The pixel is one pixel tall and one pixel wide. You never consent. You never get a notification. The sender walks away knowing when you opened, where you were, and what you were using.

The single most useful step is to turn on Apple Mail Privacy Protection if you are on iOS 15 or later, or to switch your Gmail and Outlook settings to ask-before-display. Both take under a minute. Both block the most common form of email tracking on the open internet.

If you only remember three things from this article, make them these.

  1. The pixel works because your mail client fetches a hidden image. Block the image and the pixel cannot phone home. [2]
  2. Apple Mail Privacy Protection goes further: it loads the image for you through a relay, so the sender never sees your real IP. [1]
  3. Pixel blocking does not hide who emailed you or when. For that you still need a privacy-respecting mail provider or end-to-end encryption.

References

  1. Apple Legal: Mail Privacy Protection
  2. Julia Evans: How tracking pixels work
  3. Ugly Email: Gmail tracker blocker for Chrome and Firefox
  4. Proton Mail blog: How to stop email trackers and protect your inbox
  5. Superhuman blog: Read Statuses in Superhuman Mail (Rahul Vohra, July 3, 2019)
  6. Daring Fireball: BBC investigation "Spy pixels in emails have become endemic" (February 23, 2021)

Related Reading