A newsletter says "See the offer", and behind it sits an address that has nothing to do with the offer. It leads to a service that notes the click and then forwards. The detour takes milliseconds, is invisible — and happens on practically every commercially sent link.
The detour
Why this weighs differently from a tracking pixel
A tracking pixel reports that a message was opened. That report has become unreliable: clients no longer load images automatically, others load all of them pre-emptively, and the two distort the figure in opposite directions.
A counted click does not have this problem. A click is a deliberate act, and calling the tracking address is not optional — it stands in the way. Whoever clicks is counted, and counted correctly.
Which makes link tracking the more valuable measurement from the sender's point of view, and the more revealing disclosure from the recipient's. A loaded image says "message displayed". A click says "this person is interested in this subject", together with a time and a network location.
How to spot it
The link text says nothing — it is freely chosen. What matters is the address behind it, and every client shows that when you hold the pointer over the link without clicking. On a phone: press and hold without letting go.
Typical signs of a tracking address:
- A name with no relation to the sender, or a subdomain such as
click.,link.,t.,e. - A long random value in the path or query — that is the token identifying you and this link.
- The real destination sometimes visible as a parameter, but often only in the service's database.
The second point is the important one. The token is different per recipient. Pass the same link on to somebody else and you pass on a token that points at you — and the second click is attributed to you.
The side effects nobody plans for
The links expire. A link in a newsletter works only as long as the tracking service is running and under contract. Change provider and you render every link in every message ever sent unusable — retroactively, all at once. Archives, saved messages, forwarded recommendations: all dead.
The tracking domain has a reputation of its own. At many providers it is the same for all customers. Another customer using it for something dubious lands it on a blocklist — and then your messages are delivered worse too, although there is nothing wrong with your conduct.
Security filters can no longer check. A filter judging links in incoming mail sees only the service at a tracking address, not the destination. Some follow the redirect to look anyway — which counts a click no human made. That is precisely why open and click figures are systematically too high in corporate environments.
The detour outlives the message. Keep the tracking address and call it a year later, and you are still counted.
What you can do as a reader
- Look before you click. The pointer over the link shows the actual address.
- Type the destination yourself when it is recognisable. With "your invoice is in your account" the safe route is to open the account directly anyway.
- Do not forward links out of newsletters without removing the token. Otherwise the recipient's action counts against your name.
- For sign-ups you do not want to keep, use a short-lived address. That does not prevent the measurement, but it decouples it from everything else you do.
What does not help: turning images off. That only affects the tracking pixel. A click on a link is a connection of its own from your device to the sender's service, and no image setting has any bearing on it.
What you should do as a sender
Set up your own tracking domain. Almost every service allows a subdomain of your own by CNAME instead of the shared one — click.company.com rather than click.sender.example. That solves three problems at once: the reputation is yours, the links point at your domain, and at least the name survives a change of provider.
Do not track everything. In a password reset, an invoice or a shipping confirmation, click rate is not a figure anybody needs. There, tracking addresses are pure downside: they make checking harder, they look suspicious, and they contribute to the message not landing where it belongs.
Keep the boundary in view. Per-person click data is personal data. It needs a legal basis, a mention in the privacy notice and a retention period. An anonymous counter across all recipients needs none of that — and answers the question of whether a campaign worked just as well.