How does email pixel tracking work, and how do you switch it off

How does email pixel tracking work? The sender puts a tiny image in the message, often one pixel square and invisible, and gives it a web address that belongs to you alone. To show that image your mail app has to fetch it from the sender’s server, and that fetch is the tracking. The request carries your IP address, the time and the name of your mail app, and because that exact URL was mailed to one person, the sender knows which person opened it.

Nothing is installed and no code runs. It is an ordinary image request, the same kind a web page makes for a photo. That is why it works in almost every mail client, and why the defence is unglamorous: if the image never loads, the sender hears nothing.

What a tracking pixel looks like in the source

Strip the marketing HTML away and the tracker is one tag:

<img src="https://track.example-sender.com/o/9f3c1a2b7e.gif"
     width="1" height="1" alt="" style="display:none">

The random looking 9f3c1a2b7e is the whole trick. It is the identifier tied to your address and to that particular send. Mail the same campaign to somebody else and the string changes.

The invisible square is only the obvious case. Any remote image in an email can carry the same identifier, including the logo at the top and the social icons in the footer. A sender who wants open data does not need a hidden pixel at all, just a picture you will load.

What the sender learns, and what it does not

Most people asking “how does email pixel tracking work” really want to know what the sender ends up holding. One load tells them the message was opened, when, and how many times. It hands over your IP address, which gives a rough city and network, and the user agent string of your mail app, which gives the device and the platform. A mailing tool turns that into a per person profile: the hour you usually read, whether you are on a phone, whether you open at all.

What it does not give them is anything about your reading. A pixel cannot see your other mail, run code, or touch your files. It also cannot separate a real open from a preview pane or an automated scan, which is why the number is softer than it looks.

Step 1: find a tracking pixel in mail you already have

Do this once and the mechanism stops being abstract.

1. Open the message in a desktop client and choose the option that shows the raw source. The wording varies (Show original, Message Source, View Source), but every desktop client has one.
2. Search that text for <img.
3. Read each src. Anything with width="1", 1x1, display:none, or a path containing open, pixel, beacon or /o/ is a tracker.
4. Check the hostname. Images served from a tracking subdomain rather than the company’s own site are usually counted, logo included.

Step 2: turn off remote images in your mail app

This is the actual fix, and every major client already ships it.

• Gmail: Google’s help page describes a setting called “Ask before displaying external images”. Gmail also serves images through its own servers, and Google states that senders cannot use image loading to learn about your computer or location, and cannot set or read cookies with it.
• Apple Mail: Mail Privacy Protection. Apple’s documentation says that with it on, your IP address is hidden from senders and remote content is downloaded privately in the background when the message arrives. There is a separate Block All Remote Content option if you would rather nothing was fetched.
• Thunderbird: Mozilla’s documentation says Thunderbird does not load remote content automatically and shows a notification bar instead, so you are blocked by default.

Two caveats are worth knowing. Google’s proxy protects your IP, but the fetch still happens, so the sender still records an open. Apple fetches remote content for every message whether you open it or not, which does not prevent the request either, it drowns it in noise. Only outright blocking stops the pixel firing.

Step 3: stop handing out an address worth tracking

Blocking images kills the open report. It does not change the more valuable thing the sender already holds: a real address, attached to you, worth mailing forever.

For a one time signup, a download or a discount code, a disposable address removes the problem at the source. You can open a free temporary inbox in a click, take the code, and let the address expire. Mail there is kept for 24 hours by default, extendable to at most 7 days, and a cleanup job runs every 15 minutes, so there is no archive left to mine later. Remote images are blocked by default and message HTML renders in a sandboxed frame where scripts, forms and embeds cannot run. The detail sits on the page covering how InboxDome protects an inbox, and the timings are set out in how long a message is kept.

If you need the mail to keep arriving, a throwaway inbox is the wrong tool and an alias is the right one. Email alias services compared walks through the forwarding options, and there is a plainer walkthrough of making a throwaway email address if all you want is the one code.

The links leak more than the pixel does

Blocking images does nothing about the links. In most marketing mail every button is a redirect through the sender’s tracking domain with your identifier sitting in the path, so a single click confirms your address, your IP and your interest at once. Hover before you click and read where the link really goes; if the domain is not the company you are dealing with, the click is being counted. InboxDome keeps the real destination visible rather than rewriting it, and opens links with noopener noreferrer nofollow, so the site you land on is not told which message sent you.

Why open rates are so noisy now

Between Apple fetching content for every message and Gmail proxying every image, an open is a weak signal for anyone counting them. That is the practical end of “how does email pixel tracking work” in 2026: the mechanism runs, but its numbers are mush. As a reader that is quietly good news, because your genuine opens sit in a pile of false positives. As a sender it means the opposite: judge a campaign on clicks and replies, not opens.