Most newsletters know whether you opened them, when, how often and on which device. That takes no consent and no special technology — just an image.
How it works
The message contains an image that is not an image: a dot one pixel by one pixel, transparent, invisible to you. The trick is in the address:
<img src="https://tracking.example.com/o.gif?id=a7f3c9" width="1" height="1">
That identifier is different for every recipient. The moment your program loads the image, the server learns: recipient a7f3c9 opened the message.
What gets transmitted
- The time of opening, to the second — and every subsequent opening
- Your IP address, and from it your approximate location and provider
- Your program and operating system, via the user agent
- The link to your address, because the identifier is unique
Across several messages a pattern emerges: when you read mail, where you are, whether you are on holiday.
The second route: tagged links
Measurement happens without images too. Links in newsletters frequently do not go straight to the destination but through an intermediate server that logs the click and then redirects. You can spot it when the address shown on hover does not match the link text.
What this has to do with the GDPR
Open tracking is processing of personal data. The prevailing view among supervisory authorities is that it requires consent — agreeing to the newsletter alone is not enough, the tracking has to be named separately. In practice, plenty of senders ignore this.
How to switch it off
Do not load images automatically
The most effective measure, available in every program:
- Gmail: Settings → Images → Ask before displaying external images
- Outlook: Trust Center → Automatic Download → block downloads
- Thunderbird: Settings → Privacy → block remote content
- Apple Mail: enable Mail Privacy Protection
A note on Apple's version: it does not block but preloads all images through an intermediary. The sender then sees an open, but not your IP and not the real time. That protects your location, not the fact of delivery.
Display plain text only
Many programs can show the plain text alternative. Then neither images nor tagged links take effect.
A separate address per sender
This does not stop the measurement, but it stops the linking: if every provider knows a different address for you, the profiles cannot be merged. And you see immediately who passed your address on.
How to tell that you are being measured
Look at the message source and search for <img with width and height of 1, for addresses containing words like open, track, beacon or pixel, and for links running through a third-party domain. How to get at the source is covered in our post on message headers.