A tracking pixel is a tiny image, usually 1 pixel by 1 pixel and invisible, embedded in an email with a unique address. When your mail app loads that image, the sender’s server records the request. That single request reveals that the message was opened, when it was opened, and often the device and rough location behind the request. The email looked like text. It behaved like a beacon.
How the Pixel Works
Every image in an HTML email is fetched from a server when the message is displayed. A tracking pixel uses that normal mechanism with one twist: its image address is unique to you. A newsletter sent to ten thousand people contains ten thousand different pixel addresses, each tied to one recipient.
When the image loads, the server logs the request and marks that recipient’s copy as opened. Repeat opens show up too, so senders can see how many times a message was reopened and at what hours. Some pixels sit inside a company logo or signature image rather than standing alone, which makes them harder to spot and no different in effect.
The data collected is modest per message and powerful in aggregate: open rates per campaign, the best hour to send, which subject lines got opened, and which recipients never open anything. That is why the technique survives every privacy trend. It is cheap, invisible, and built on a mechanism email needs to display pictures at all.
What Senders Actually Learn
| Signal | What it tells the sender |
|---|---|
| Open event | The message was displayed, at least once |
| Timestamp | The hour and day you read mail, useful for timing future sends |
| IP address | Rough location and network, unless a proxy hides it |
| Device details | Mail app and device type from the request headers |
| Repeat opens | How often you return to the message |
What a pixel cannot do matters too. It cannot read other mail, see your contacts, or track you after the message closes. Its power is narrow: it reports the open, and it reports it reliably as long as images load automatically.
Proxies Change the Signal, Not the Fact
Two major providers blunt pixel tracking with image proxies. Gmail routes remote images through its own proxy servers, so the sender sees Google’s network instead of your IP address and cannot set or read cookies through the image. Apple Mail Privacy Protection goes further: with Protect Mail Activity on, Apple preloads remote content through proxies, so the sender’s open record becomes unreliable — the pixel may fire before you ever read the message.
Both are improvements, not fixes. The sender still learns that someone associated with the message loaded images, and Gmail’s own help notes that senders may still know a message with an image was opened. The only control that fully stops the signal is stopping the image from loading at all.
Block Remote Images, Client by Client
Gmail
On the web, open Settings, then See all settings. On the General tab, find the Images section and select “Ask before displaying external images”, then scroll down and click Save Changes. New messages will show a “Display images below” prompt instead of loading pictures automatically.
In the Gmail app, the setting is separate: open Settings, tap the account, find Images, and choose “Ask before displaying external images” (on Android the wording is “Ask before showing”). Set it on each device and each account you use.
Outlook
On the desktop app, go to File, then Options, then Trust Center, then Trust Center Settings. Under Automatic Download, check “Don’t download pictures automatically in HTML e-mail messages or RSS items”. Outlook will then show a “Download Pictures” bar on messages instead of fetching images on its own.
In Outlook on the web, open Settings, then View all Outlook settings, and find the external-images control under the Mail settings. Set it to block external images or ask before downloading them. The web control is separate from the desktop one, so set both if you use both.
Apple Mail
On a Mac, open Mail, then Settings, then the Privacy tab. Turn off Protect Mail Activity to reveal the granular controls, then check “Block All Remote Content” and keep “Hide IP Address” checked. Messages will show a “Load Remote Content” button instead of loading images automatically.
On an iPhone or iPad, open Settings, then Apps, then Mail, then Privacy Protection. Turn off Protect Mail Activity, then turn on “Block All Remote Content”. The older path, Settings, then Mail, then turning off “Load Remote Images”, achieves the same block on older iOS versions.
What Image Blocking Does Not Stop
Blocking images stops open tracking. It does not stop link tracking. A tracked link in a message still reports the click when tapped, because the click travels through the sender’s redirect server before reaching the destination. Read the destination address before tapping, and for sensitive actions, type the site address yourself instead of following the link.
Attachments are a separate channel too. A document or file attached to a message can carry its own remote content or macros. Image blocking does not inspect attachments, so the usual rule stands: open attachments only from senders you trust.
Finally, plain-text mail has no images to block and no pixels to fire. Switching a newsletter to its plain-text version, where the sender offers one, removes the tracking mechanism entirely without changing any setting.
Final Verdict
Tracking pixels work because images load by default, and they stop working the moment images stop loading by default. Set the image control in each mail app you use, accept the small extra tap for pictures from senders you trust, and remember that link clicks still report back. The open is the cheapest signal senders collect, and it is also the easiest one to take away.
