How Email Tracking Pixels Work (and How to Block Them)
Email tracking pixels are small remote images that can record a request when an email client loads them. To limit that signal, block automatic remote-image loading or use your client's documented privacy protection. Neither method makes tracked links safe or guarantees anonymity. A request is evidence that content was fetched, not reliable proof that a person read and understood the message.
The useful question is not whether you can spot a tiny square. It is which network requests your mailbox permits, which identifiers the sender already holds, and what happens when you click. Those are three separate privacy boundaries.
The invisible image is only the trigger
A tracking pixel is often a transparent 1x1 image hosted outside the email. The sender can put a unique identifier in its URL, then associate requests for that identifier with the recipient of the campaign.
Here is an illustrative example, not an active tracker:
<img src="https://tracker.example.invalid/open/message-123.png" width="1" height="1" alt="">
When a client fetches the image, the server can log the request time and available request metadata. The identifier lets it connect the event to a particular message even if the image contains nothing visible. A large remote banner can perform the same role; deleting only obvious tiny images is not a complete defense.
Mozilla's remote-content documentation describes possible exposure: viewing events, rough application/platform details, approximate location from an IP address, and whether an address is active. What reaches the sender depends on the client and any intermediary, not just the HTML.
For the wider identity question, see whether email can be traced back to you. A pixel is one signal, not a magic identity lookup.
What an open report cannot establish
Do not read a tracking dashboard as a precise diary. A client may fetch content through infrastructure that hides your IP address. Caching may change subsequent requests. Content loading also does not establish how long you paid attention or whether you read the whole email.
Google's Gmail image guidance says image loading cannot give senders information about your computer or location, or let them set or read browser cookies. Importantly, it also says senders may sometimes know whether you opened an email containing an image. These protections are not equivalent to disabling images.
Apple's Mail Privacy Protection guidance for iPhone says it hides your IP address and prevents senders from seeing whether you opened their email. Its protection does not extend to links or attachments such as PDFs.
If a forwarded message retains the original remote-image URL, a later request could remain associated with the original identifier. That does not prove who viewed the forward. Treat exact device, location and forwarding claims cautiously unless the underlying evidence supports them.
Pixels, tracked links and receipts are different
| Mechanism | What triggers the signal | Practical boundary |
|---|---|---|
| Remote image, including a pixel | The client or an intermediary fetches content | Control remote-content loading; do not assume size matters |
| Unique tracked link | You follow a recipient-specific URL, possibly through a redirect | Image blocking does not remove the link's identifier |
| Read-receipt request | A separate mail-client receipt workflow | Review that client's receipt settings; it is not the same as an image |
A plain-text message can still contain a tracked URL. Conversely, an embedded image included within the message does not itself require a remote-image fetch. Focus on the request path rather than whether the email looks simple or attractive.
When a message asks you to sign in, pay or provide credentials, open the known service independently instead of following an unexpected link. Do not manually edit unfamiliar URLs and assume that removing a parameter makes them safe. Our guide to suspicious unsubscribe links explains the same trust problem in another common setting.
Set controls in the client you actually use
The following settings were checked against official documentation on October 14, 2026. Names can differ in localized interfaces and other versions; use the linked guide for your client.
- Gmail on a computer: open Settings, then See all settings. In Images, select Ask before displaying external images and Save Changes. Choosing to display images in a particular message permits that content to load.
- Apple Mail on iPhone: open Settings > Apps > Mail > Privacy Protection and turn on Protect Mail Activity. Apple's current guide also requires Limit IP Address Tracking to be enabled; its Wi-Fi instructions are Settings > Wi-Fi, then the network's information button and Limit IP Address Tracking. This is not a promise to protect links or attachments.
- Thunderbird: remote content is blocked by default. Under Settings > Privacy & Security, keep Allow remote content in messages unchecked and review exceptions. Allowing a particular message, sender or origin weakens that boundary for the permitted content.
Check every client that accesses the mailbox. A desktop setting does not prove a phone or another client behaves the same way. Let images remain blocked when you do not need them; allow them selectively for a message you trust, knowing that the request may disclose a signal.
Inboxto separates an address, not every tracking signal
Editorial product observation, checked October 14, 2026: we compared the public Inboxto product page with its Privacy Policy. Inboxto describes persistent anonymous addresses that remain active until deleted, without mandatory initial registration. Free includes three addresses, seven-day ordinary-message retention and five starred messages. Premium lists unlimited addresses, 90-day ordinary retention and unlimited starred storage; starred messages remain until manual deletion or account closure.
That produces a concrete decision rule: use a separate address for a low-risk newsletter to avoid giving it your primary address, but do not mistake message expiration for tracker blocking. A sender can still associate campaign identifiers with the address you supplied. If you then sign into its site or give it other identifying information, address separation does not erase that relationship.
Inboxto's AI email summaries can help decide which messages deserve attention. We have not verified whether summary generation, previews or full-message viewing fetch remote resources. Therefore, we do not claim that reading a summary prevents pixel requests, that Inboxto blocks every tracker, or that it guarantees anonymity.
This public-page comparison is not a first-hand network test. It distinguishes three controls that marketing copy can blur: address disclosure, message retention and remote-content retrieval. For the wider plan, use our email privacy guide.
A four-step privacy routine
- Choose a remote-content policy. Block automatic loading or enable a documented privacy feature in each client you use.
- Review exceptions. An allowed sender or image origin can reopen requests; allow only what you need.
- Treat clicks separately. Go directly to trusted services for sensitive actions and remember that attachments are another boundary.
- Separate future addresses thoughtfully. Keep low-risk subscriptions away from your primary mailbox, preserve needed records, and check account recovery before retiring an address.
Tracking defenses should reduce exposure without breaking access to accounts you depend on. Do not move banking, healthcare, work administration or your only recovery channel into an inbox whose access guarantees you have not evaluated.
For low-risk receiving with a separate persistent address, open Inboxto. Combine address separation with verified client settings, not assumptions about invisible images or AI summaries.