Email tracking pixels tell senders when you opened a message, where you were and what device you used. Here is what they collect, what UK guidance says, and how to block them.”
Email tracking pixels are tiny, invisible images that tell a sender when you opened a message, where you were and what device you used. I used to think they were harmless marketing metrics. A legal threat and a closer look at what they collect changed my mind. This guide explains what tracking pixels (also called web beacons) do, what UK rules say, and how to block them.
I wanted to write this article because the subject is particularly close to me. For many years, I’ve had a deep professional interest in email marketing and, specifically, the mechanics of email deliverability.
Short answer: a tracking pixel is a remote image in an email that, when loaded, reports to the sender’s server. You can stop most of it by blocking or proxying remote images, which Fastmail, Proton and Apple Mail now do in different ways. The ICO’s April 2026 guidance names tracking pixels in emails as covered by UK electronic marketing rules.
| User Profile | Best Fit? | Core Value Drivers / Key Trade-offs |
|---|---|---|
| Privacy-minded reader | Ideal | Use a provider that proxies or blocks remote images. You lose nothing important. |
| Person who wants images shown in every email | Partial fit | Use a proxy so images load without exposing your IP address. |
| Email marketer | Alternative needed | Open data is less reliable, and consent and privacy rules apply. |
| Business with an email list | Strong fit for review | Check your privacy policy and whether you really need open tracking. |
Part of that interest meant working closely with self-service email platforms that tracked email opens and link clicks. Back when I first started exploring the space, I honestly saw nothing wrong with this type of analytics. It was just standard marketing intelligence, helping a campaign manager see which subject lines landed, which content resonated and which campaigns flopped.
When using these platforms myself, I used those metrics for that exact purpose and nothing more. I suppose my understanding of digital privacy back then simply wasn’t as developed as it is today.
What harm could there be in adding a tracking URL into an email? Who would mind an invisible 1x1 transparent image embedded in the HTML code, when its sole purpose was to show that a recipient had opened the message? As it turned out, back then most people didn’t really mind, and most email providers didn’t block them. Was this because the underlying technology was poorly understood? Almost certainly.
When GDPR arrived in the UK, it opened a massive can of worms for the email marketing industry. Suddenly, debate raged over what constituted valid opt-in consent, and what distinguished a generic business contact from a personal email address belonging to an employee. Companies with substantial subscriber lists went into a blind panic. Many had relied on email as their primary revenue engine, and the threat of losing access to those lists felt existential.
Around this time, a client running one of these large lists reached out to me out of the blue. They had just received an aggressive letter from a subscriber claiming they had never explicitly agreed to receive emails containing tracking beacons, alleging their privacy had been violated. They were demanding a substantial financial settlement to prevent a court case.
My client asked if I would write an expert witness statement explaining how email delivery and tracking worked. I was happy to help. In my statement, I explained that tracking beacons were accepted industry standards and that signing up to a commercial mailing list inherently implied consent for the sender to measure campaign engagement. I argued that the beacons themselves were harmless and could easily be avoided by disabling automatic image downloads in any mail client. I was convinced the complainant was simply exploiting a legal loophole for a quick payout.
Confident in my statement, I waited for an update. When I spoke to my client a few weeks later, I was shocked to learn that their business insurer had advised them to pay an out-of-court settlement worth several hundred pounds, alongside a demand to update their website privacy policy to explicitly declare beacon and link tracking.
While I understood why the client followed their insurer’s advice, the outcome left a sour taste in my mouth. My concern was that this individual wouldn’t stop there. They would actively sign up to newsletters just to threaten legal action the moment a tracking pixel fired. My hunch proved right: the same individual repeatedly cropped up in online forums, cited by terrified business owners, while actively encouraging others to follow suit under the guise of fighting for privacy rights.
At that point, my advice to anyone working in email marketing was clear: explicitly update your terms or turn off open tracking altogether.
The ICO’s guidance on storage and access technologies, finalised in April 2026, lists tracking pixels by name. It describes a pixel in an email that records the time, location and operating system of the reader’s device. It says that most electronic mail marketing falls under regulation 22 of PECR, but where a tracking pixel stores or gains access to information on a user’s device, regulation 6 applies as well. PECR allows these technologies in particular circumstances or with valid consent. I’m not a lawyer, so if you send marketing email, read the full guidance or take advice.
In the months and years that followed, email providers, especially privacy-focused ones, began blocking tracking pixels by default or displaying warning banners advising users to block remote images. Initially, I was still confused. I couldn’t understand why people were taking such fierce exception to helping a marketer measure basic campaign metrics.
So I decided to dig deeper into the mechanics of email deliverability software. That research completely changed my outlook. I realised that modern email marketing software wasn’t just logging that a subscriber had opened a message. It was quietly harvesting:
That realisation changed everything. This wasn’t simple engagement tracking. It was silent surveillance used to construct detailed behavioural profiles.
Email tracking beacons (also called tracking pixels, spy pixels or web beacons) are tiny, usually 1x1 transparent images embedded in the HTML code of an email. When an email client loads the image, it sends a request back to the sender’s server, handing over metadata without the recipient ever clicking a link or replying.
When a tracking beacon loads, the sender can receive data that goes well beyond a simple “opened” notification:
| What the sender can learn | Detail |
|---|---|
| Time and frequency | When the message was opened and how many times it was loaded again |
| Location | Your IP address, which can reveal your city, region and approximate location |
| Device details | Mail client, operating system and hardware set-up, which can contribute to fingerprinting your device |
Marketers can combine pixel data across many emails to infer when you work, when you commute and which topics hold your attention. Where that data is shared with third parties, it can feed behavioural advertising. How far this goes depends on the sender and the platform, but the raw material is there in every pixel.
Because tracking beacons rely on remote images loading automatically, privacy-first services use two main defences: proxying remote images and blocking them by default. These details come from each provider’s own help pages, checked 9 October 2026.
| Provider or app | What it does | Caveats |
|---|---|---|
| Fastmail | Loads remote images through its servers, so the image host doesn’t see your IP address or browser. You can choose to always show, show for contacts, or always ask. | Applies in the web and mobile apps. Fastmail’s page doesn’t say whether the sender can still see that an open happened. |
| Proton Mail | Removes known trackers from messages that aren’t end-to-end encrypted, proxies other remote images, and cleans known tracking parameters from links in the web app. Enabled by default. | Companies can use their own tracking parameters that Proton may not detect. The setting doesn’t sync across apps. |
| Apple Mail | Mail Privacy Protection (Mail → Settings → Privacy → Protect Mail Activity) stops senders learning when you viewed a message, how often and your IP address. Remote content downloads in the background when the message arrives. | You can turn it off and instead hide your IP address or block all remote content separately. |
Proxying has a side effect for marketers. Because Apple and Proton fetch images when a message arrives, not when you open it, a recorded “open” may say nothing about whether a person read the message. Open rates are less reliable than they used to be.
If your provider doesn’t proxy images, turn off automatic remote image loading in your mail client. My guides to DuckDuckGo Email Protection and masked email cover other ways to cut tracking and spam.
| Strengths | Weaknesses |
|---|---|
| Hides your IP address and location from the sender | Some newsletters look broken until you load images |
| Stops senders knowing when and how often you open email | Some services rate-limit proxied image requests, so images may not show |
| Reduces the profile built from your reading habits | Link-click tracking can still work if you click |
A tiny, usually transparent image that loads from the sender’s server when you open the message. The request tells the sender you opened it, plus technical details such as your IP address and device.
The ICO says PECR regulation 6 applies where a tracking pixel stores or accesses information on a user’s device, and PECR allows this only in particular circumstances or with valid consent. I’m not a lawyer, so take advice if you send marketing email.
Block remote images and see whether a banner appears. Fastmail, for instance, shows “Remote images blocked to protect your privacy” when it blocks them.
No. It stops pixel-based open tracking, but link clicks can still be tracked through tracking parameters in URLs. Proton removes known parameters in its web app, though not all of them.
Both fetch remote content when the message arrives, so the sender may see an open that doesn’t reflect you reading it. Apple says Mail Privacy Protection stops senders learning when you viewed a message, how often and your IP address.
Yes. Web beacon, tracking pixel and spy pixel are different names for the same technique.
What started for me as a fascination with email deliverability ultimately led to an appreciation for why privacy boundaries matter. Marketers deserve metrics, but not at the expense of turning every inbox into an uninvited tracking station. If you want to understand where this fits in the wider picture, see what “secure email” actually means.
Note: this article contains no affiliate links. Sources: ICO: storage and access technologies (updated 29 April 2026); Proton: email tracker protection; Fastmail: blocking remote images; Apple: Mail Privacy Protection. Checked 9 October 2026.
Get the next post by email. Free, no ads, and you choose which newsletters you get.
Proton is built so your mail is unreadable to the host, and Fastmail so email is fast and dependable. Here is how they compare on encryption, custom domains, price, support and jurisdiction, and who should pick which.
Masked email does the same job as a disposable address but forwards to your real inbox, so you keep password resets and can switch it off. This guide compares the two, explains why sites block disposable addresses and weighs the main services.
QuickInbox.app promises anonymous, tracking-free disposable email. When I checked in October 2026, it loaded PostHog session replay, published no privacy policy or contact details, and tied paid plans to a bank card.
Comments