PSA: Turn off email tracking — here’s how

Emails make the world go round. Whether you’re shooting off a life-changing job application or finally receiving a long-awaited alert notifying you about a PS5 restock, emails are a powerful tool for information. They are the lifeblood of companies big and small, and are sometimes the only means to keep in contact with those we care about.

If cult classic You’ve Got Mail has taught us anything (other than Tom Hanks’ Joe Fox being a ruthless businessman), it’s that receiving and replying to messages can make or break businesses — and hearts. But Meg Ryan’s Kathleen Kelly could have conquered the trials and tribulations of modern electronic communication far sooner if she turned to email tracking. 

With email tracking, users can dispatch an email and know if their message has been opened or clicked on; it’s similar to the oft-dreaded two blue ticks on WhatsApp messages that were sent days ago without a reply. However, email tracking takes it a step further by offering the tools to capture data on how many times the email is opened, when it’s opened, where it’s opened, the time spent reading it, as well as click-throughs on links and attachments. 

While this sounds intrusive, it is generally a harmless tool used by the most well-known companies and brands to gain valuable insight into what their recipients enjoy reading and if their products are a hit. Heck, the company you work at is in all likelihood tracking those weekly newsletters.

In the hands of mischievous minds, however, email tracking can be used to fill your inbox with annoying spam and malicious phishing emails. What’s more, it can be used to delve into personal data with a simple click, and all it takes is one invisible pixel. That is a very “Joe Fox” move. 

What is email tracking?

Email tracking is the process of tracking sent emails and monitoring the recipient’s activity with them. Often used via your inbox or browser extensions, the tracking software adds a small .GIF or .PNG file in the form of a 1×1 pixel into an email or HTML code of a website. This “spy pixel,” as messaging service Hey puts it, can be found in the header, footer or body of an email. They are impossible to see with the naked eye, meaning anyone can use email tracking without you even batting an eyelid.

As soon as the receiver opens the bugged email, this tiny image is downloaded from the sender’s server, effectively notifying them that the email has been opened and, more importantly, that the email account is active. This practice isn’t hard to come by, as a Princeton University study on email tracking points out that as many as 70% of corporate mailing lists contain tracking technology, with many being from Google-owned third parties.

“We assembled a corpus of commercial mailing-list emails, and [found] a network of hundreds of third parties that track email recipients via methods such as embedded pixels,” the study states. “About 30% of emails leak the recipient’s email address to one or more of these third parties when they are viewed. In the majority of cases, these leaks are intentional on the part of email senders, and further leaks occur if the recipient clicks links in emails.”

From British Airways to HSBC, many companies have been detected to use tracking pixels in sent emails, but pixel tracking can be more problematic when used in combination with Javascript. As ExpressVPN explains, email tracking software has the ability to obtain your IP address, the browser you’re using, what plugins are in use, and even makes it possible to see the exact street you live on.

You can track email, too

Email tracking is found everywhere because it is easily accessible. Install an email tracking app and voilà, you’ll know exactly who is ignoring your emails and how long it takes for them to reply on Gmail, Outlook, or Office 365. Moreover, many of the best ones are completely free to use.

For example, HubSpot’s SalesHub extension offers “live notifications when someone opens or clicks your emails,” and even offers real-time updates on when and the amount of times an email has been clicked on. By simply clicking on the “Track” checkbox placed on your email’s toolbar, you’ll get further insight into a recipient’s email habits.

Thankfully, HubSpot does make it clear that its free service should be used responsibly, and that companies should “define proper use of email tracking tools in your company’s privacy policy and disclose when people sign up for email subscriptions.” Although, there’s nothing stopping anyone that uses this service to abide by this rule, so take this statement as more of a cautionary remark rather than strict policy.

Other free tracking software, including Mailtrack, Streak, and Mailalert, are commonly used to benefit the sender and recipient to boost email efficiency and the brand, but cybercriminals may have more malicious benefits in mind. According to the Electronic Frontier Foundation (EFF), “bad email tracking is ubiquitous, secretive, pervasive, and leaky.

“It can expose sensitive information to third parties and sometimes even others on your network,” the article states. Threat actors that send out mass spam emails can obtain a wealth of personal information from a receiver by simply opening an email, and because it’s been opened, they will know this data is relatively current since the email account is active. By knowing your email, IP address, name, interests and possibly even your home address, a low-level hacker can unfortunately do wonders with this information.

So, instead of going down the email tracking rabbit hole, a safer option is to stop it altogether.

How to turn off email tracking

Thankfully, it is extremely easy to stop unwanted senders knowing your email-clicking routines. In fact, if you have a virtual private network (VPN), you’ll already be protected.

From ExpressVPN to CyberGhost, a VPN not only hides your original IP address, but can also constantly change to make it virtually impossible for threat actors to obtain important personal information via email tracking. Any of the best VPN services can fix any privacy issue, but there’s a significantly cheaper way to stop email tracking in its, erm, tracks.

Whether you’re using Gmail or Outlook, there’s a way to disable image loading in emails. Since email tracking uses image files, regardless of its 1×1 pixel size, the spy pixel won’t automatically load in the first place. No pixel, no tracking. Here’s a few steps to keep you secure: