i’m getting a lot of emails from my bank and other services that make me aware that they use tracking pixels in emails. apparently they are obliged by the privacy regulator that is enforcing a recent EU directive. i didn’t even know that i was sending ip and client info simply by reading my emails in thunderbird or k9 on my mobile. is there a way to deactivate these? and is there a risk that by doing so the bank thinks the email is compromised or non existant. its incredibile to see how sophisticated data hoovering technology has become. the internet has become a real mess …
They only load if you load images, every email client I’ve used does not load them by default for this reason.
You can also run an DNS adblocker like Adguard Home or PiHole and that will block a lot of the domains commonly used for tracking pixel images.
I have all of my email clients set to not load internet content. Probably why one of my banks, Navy Federal, keeps saying my email address is invalid despite the fact I get their emails.
Never load images in emails 😘
Set your client to not download/show embedded images, so only the text part gets loaded.
How does it work? Like a read receipt? I thought the likes of thunderbird were essentially offline after initial loading?
I assume it’s an img tag pointing at a one pixel image (every mail has its own querystring or URL), when you load it the server logs the time, requesting IP, and so on.
Obviously it’ll only work if you tell the mail client to download the images.
(It doesn’t need to be a single pixel, could be the bank’s logo or whatever, but since it has to be unique to ID you and avoid caching and whatnot I assume making it only one pixel is more efficient.)
Most email clients don’t fetch remote resources like images embedded in emails unless you specifically ask them to. If you’re seeing pictures in your emails without having to tap something extra after opening the email, you likely need to change your settings.
As someone else pointed out, FairEmail for android additionally blocks tracking pixels even if you want to load other images.
Loading other images or resources can still track you. For example, rather than using a tracking pixel, a company could create (let’s be honest, generate 🙄) a unique image for each email campaign they do, and make that a visually important part of the email, such as a title banner, and then track who loads that to see who opened the email. They could even add tracking metadata to the URL like
https://example.com/email-resources/october-newsletter-header.jpg?user=your-email%40your-domain.comimages attached to the email can also be embedded, which I think most clients will show by default. those don’t have privacy implications as they don’t need extra network requests.
Good point
I think the best way is to disable loading of external content in your email client, but I’m not 100% sure.
Damn me for clicking on “load external content” then. I thought i wasjust downloading images … ignorance is humanities biggest problem and surely mine …
Tracking pixels are just a 1x1 pixel ‘image’, the way they work is when your client loads the image URL it sends a requests to the server to do so, and the server logs the request and knows you’ve opened/viewed the email.
You were just downloading images. It’s just that one of those images was specific for that particular message, and the server logged your IP and who knows what else when you downloaded it.
I thought i wasjust downloading images
That’s all tracking pixels are, and any image can be used to track you.
But from now on they’ll get shit 💪
I think Thunderbird by default does not load external content. Mine always warns me whether I want to allow for remote content when I open a new email, and possibly whether I want to always allow it for a particular sender. I never do.
Check the settings, and possibly reset that option.
There are add-ons (and i think there even is a setting option noe) to not load html but display the message in Plain Text: Allow HTML Temp.
Highly recommend to just show(and use) plain text.
Yes, plain text is the way to go. Advertising, special offer, promotion emails, reminders from brands you have subscribed to etc filter themselves out in to two categories when you see only text: those who bother to use words to tell you something (and might be worth reading), or brands whose emails contain virtually nothing (apart from a handy unsubscribe link) once the pretty pictures have been expunged.
Indeed, there is a built-in setting to show messages as ‘original html’ or ‘simplified html’ or ‘plain text’.
But even if you choose ‘original html’, external elements are not downloaded, unless you positively answer the warning (above the message) to download them. Any images you might still see are embedded in the message itself, not externally downloaded.
FairEmail shows these kind of pixels very obviously and gives customisation options too.
Email aliasing services, which are genuinely good services to use, strip those pixels from inbound emails. At least Firefox Relay, Addy and SimpleLogin do
100% this!! My aliasing service (Addy) removes tracking pixels and gives me a nice little overview of the pixels it’s removed over the last week.
I can’t recommend an aliasing service enough (in addition to the other benefits they offer).
Would something like pihole also strip out all this crap? I’ve been meaning to get it on my network for a while.
It’ll stop a lot of them, some will slip through though.
As far as I know pihole filters on the DNS level, so if the tracking pixel is on a domain it trusts (e.g., the bank’s) it won’t filter it, no.
I’m not too sure, maybe? If the tracking pixel is on a domain known to serve ads or trackers, it might, but if it’s on a legitimate domain (e.g. your ISP’s) I don’t think it can, since you’d have to have added the ISP’s domain to the Pi-hole blacklist
