Somebody who wants to track you can do two things; they can either send an email with a read receipt, or they can send an email with an embedded image (sometimes referred to as a bug or beacon).
Read receipt requests are included in an email’s meta data (its headers). Because the meta data is passive it amounts to no more than a plea to your email software to please ask for a read receipt.
Different email clients don’t agree on what a read receipt header should look like so there’s no guarantee your read receipt will even be recognised as one.
If it is recognised then, overwhelmingly, email clients will prompt users and ask if they want to let the sender know that they’ve read the email. It’s not a great technique for email marketeers trying to keep your tracking secret.
You are much more likely to be tracked by embedded images.
A tracking email has to be written in HTML. This allows it to reference an image on a remote server owned by the sender (this part isn’t underhand, it’s just how HTML works).
When the email is opened, the email software loads the image from the remote server by sending it an HTTP request.
A spammer or marketeer sending a mass mailing can choose to give each email an image with a unique URL so they can tell which recipients have opened their emails.
Like all HTTP requests, the one sent by your email software will contain your IP address. Because IP addresses are allocated geographically, that’s tantamount to providing location data accurate to what city you’re in.
The HTTP request will also contain a user-agent header which provides a brief description of your browser and operating system.
So, from one embedded image systems like Streak can determine:
- Who opened their email
- What time the email was opened
- Where it was opened
- What sort of device it was opened on
The answer to protecting yourself from this kind of tracking is straightforward – don’t load the images.
You can do this by forcing all your email to render as plain text or by allowing it to render HTML without images.
Most email clients are well disposed to help you with this and will actually do the latter by default, giving you the option to download the images if you decide you want them.
The most notable exception to this is Gmail which loads remote content automatically unless you take back control of your images.
For your part you need only understand that loading images in emails means “tell the sender you’ve just opened their email and you’d like them to send you the rest of the message”.
So, if you don’t trust marketers and stalkers with your location and email-reading schedule, it’s time to take back remote content loading.
Below are instructions on how to switch off image loading in seven of the most popular email clients: