Tracking Pixels: What They Are and How to Block Them

The Short Version

A tracking pixel is a 1x1 invisible image embedded in an email or web page. When your device loads it, the sender's server logs your IP address, open time, device type, and approximate location. To stop email pixels: enable Apple Mail Privacy Protection (iOS: Settings > Apps > Mail > Privacy Protection; macOS: Mail > Settings > Privacy), or set Gmail to "Ask before displaying external images." To stop web pixels: use uBlock Origin on Firefox with the EasyPrivacy list enabled, or switch to Brave with Shields set to Aggressive.

What Is a Tracking Pixel?

A tracking pixel is a tiny image, often exactly 1x1 pixel in size, embedded invisibly in an email or web page. The image file is not stored on your device. It loads from a remote server each time the email is opened or the page is visited. The moment your client fetches that image, the remote server logs the request.

That log captures:

• Your IP address (which reveals your approximate location)
• The exact date and time the email was opened or page was visited
• Your email client or browser
• Your operating system and device type
• In some cases, screen resolution and language settings

The sender set this up by inserting an image with a unique URL into the email. That unique URL identifies your specific copy of the message, before you have taken any deliberate action.

How Email Tracking Pixels Work

Here is the process from the sender's perspective:

1. The sender generates a unique tracking URL for each recipient: https://track.example.com/open?id=abc123&user=456
2. They embed it as an invisible image in the email HTML (a 1x1 image tag with display set to none)
3. The email is delivered to your inbox
4. When you open it, your email client automatically fetches all images, including the invisible one
5. The tracking server logs everything about the request
6. The sender's dashboard shows: "Opened at 9:14 AM, New York area, iPhone, iOS 18, Apple Mail"

The entire process takes milliseconds and requires no interaction beyond opening the email.

How Web Tracking Pixels Work

Email is the most-discussed use, but web pages carry tracking pixels just as widely. Every major advertising network provides a pixel that website owners add to their pages:

• Meta Pixel: tracks page views, product views, purchases, and links them back to Meta ad profiles. It fires invisibly every time a visitor lands on a page, even if they are not logged in to Facebook.
• Google Ads conversion tag: records when you visit a site after clicking a Google ad
• TikTok Pixel, Pinterest Tag, LinkedIn Insight Tag: same concept, different platforms

Web pixels typically run as JavaScript snippets rather than pure image tags, but the underlying mechanics are identical: a request fires to a third-party server, and that server logs your session.

You can see how much of a fingerprint your own browser leaves with our Browser Fingerprint tool. The combination of that fingerprint and web pixels gives advertisers a detailed behavioral profile across sites you visit.

What Data Each Pixel Type Collects

Who Uses Tracking Pixels?

Email marketing platforms including Mailchimp, Klaviyo, HubSpot, Brevo, and Constant Contact embed tracking pixels by default in every campaign they send. Most disclose this in their privacy policies, but few senders surface it prominently.

Advertising networks: Meta, Google, TikTok, LinkedIn, and Pinterest each offer their own pixel for advertisers to install on external websites. These connect your behavior on third-party sites back to your ad platform profile.

Newsletter publishers: individual writers on Substack, Beehiiv, and similar platforms track open rates through their email service provider's built-in pixel.

Data brokers: third-party data companies embed pixels across partner websites to aggregate behavioral profiles that are then sold to advertisers.

Malicious actors: scammers use tracking pixels to confirm which email addresses are actively monitored, to refine phishing target lists, and to harvest location data for social engineering. A confirmed-active address is worth more to a spam operation than an unverified one.

Blocking Email Tracking Pixels

Apple Mail: Mail Privacy Protection

Apple Mail Privacy Protection (MPP) is the most aggressive consumer-level email privacy shield currently available. When enabled, Apple routes all remote image requests through two separate relay servers before they reach your device. The first relay knows your IP address but not the content being fetched. The second knows the content but not your IP. Neither relay knows both, so no single party can link you to the email you opened.

The side effect for senders: MPP pre-fetches images at delivery time regardless of whether you actually open the email. This makes open rates meaningless as a metric for senders, but protects your real IP and open time.

Enable it:

• iOS 18: Settings > Apps > Mail > Privacy Protection, toggle on "Protect Mail Activity"
• macOS Sequoia: Mail > Settings > Privacy, check "Protect Mail Activity"

Note that MPP only applies when you read email in Apple's native Mail app. If you use the Gmail app on iPhone or access Gmail through Safari, MPP does not apply to those sessions.

Gmail: Image Proxy and the "Ask" Setting

Gmail has proxied remote images through Google's own servers since 2013. When a tracking pixel fires in Gmail, the request comes from Google's infrastructure instead of your device. This masks your real IP address. However, Google's proxy does not block the open event: it still tells the sender their email was opened, along with a timestamp. Gmail hides your location but confirms your read.

To prevent the open from being recorded at all, disable automatic image loading:

1. Open Gmail in a browser
2. Click the gear icon (top right) > "See all settings"
3. Under the "General" tab, scroll to "Images"
4. Select "Ask before displaying external images"
5. Save Changes

With this setting active, images including tracking pixels only load when you explicitly approve them for a given email.

Outlook

Classic Outlook (desktop): File > Options > Trust Center > Trust Center Settings > Automatic Download > check "Don't download pictures automatically in HTML email messages."

New Outlook for Windows / Outlook on the web: Settings > Mail > Junk Email > Block external content. The new Outlook added explicit external-image controls in 2024.

Thunderbird

By default, Thunderbird blocks remote content and shows a notification bar when it has done so. If you have allowed remote content previously and want to re-enable blocking: click the menu (three horizontal lines) > Settings > Privacy & Security > uncheck "Allow remote content in messages."

Blocking Web Tracking Pixels

Browser Extensions

uBlock Origin is the most effective option for blocking web-based tracking pixels, but its status differs by browser as of mid-2026:

• Firefox: The full uBlock Origin extension works. In the extension settings, go to "Filter Lists" and enable "EasyPrivacy" (under Privacy). EasyPrivacy specifically targets tracking scripts and pixel domains. This combination blocks the majority of advertising and analytics pixels.
• Chrome: Google permanently disabled Manifest V2 extensions in Chrome 138 (July 2025). The full uBlock Origin no longer works in Chrome. uBlock Origin Lite is available but has substantially reduced blocking capability.
• Brave and Edge: The full uBlock Origin extension is available and works.

In my testing, switching from Chrome to Firefox with uBlock Origin and EasyPrivacy enabled is the single highest-impact step most users can take for web tracking.

Privacy Badger (from the EFF) is a useful complement. It automatically learns to block domains it detects behaving as cross-site trackers.

Browser Built-In Protections

• Brave Browser: Set Shields to "Aggressive" (click the Brave lion icon on any page > change "Trackers & ads blocked" from Standard to Aggressive). This blocks most pixels without any extension.
• Firefox: Settings > Privacy & Security > Enhanced Tracking Protection > select "Strict." Note that Strict mode can occasionally break some site functionality.

DNS-Level Blocking

DNS blocking stops tracker requests before they reach your browser or email client by refusing to resolve known tracking domains. This applies to every app on your device simultaneously.

Self-hosted:

• Pi-hole: runs on a Raspberry Pi or small server, blocks tracking domains for every device on your home network
• AdGuard Home: similar to Pi-hole with a more streamlined interface

Cloud-based:

• NextDNS: configure blocklists via a web dashboard, then change your device's DNS address to apply the rules everywhere. Supports native tracking protection lists that catch domains masquerading as first-party to evade browser protections.

A VPN with built-in tracker blocking handles this at the network level, protecting all applications at once. Check our VPN Leak Test to see if your VPN is actually intercepting these requests.

Tracking Pixels vs Cookies

Both technologies track behavior, but they work differently:

The key distinction: cookies can be cleared from your browser. Tracking pixel records exist on the sender's server regardless of what you do on your end. The record of your open is permanent once logged.

Legal Landscape

The regulatory picture for email pixels has sharpened significantly. The UK ICO published final updated guidance in April 2026 that explicitly lists tracking pixels as covered technologies under PECR (the UK's ePrivacy rules). Both PECR and UK GDPR consent requirements apply to email pixels, and consent must be freely given, specific, informed, and unambiguous.

France's CNIL launched a public consultation in June 2025 proposing that email recipients must give separate consent for receiving marketing emails and for tracking pixels embedded in those emails. That would be stricter than current practice anywhere.

In the United States, no comprehensive federal law specifically targets tracking pixels, though the FTC has acted against deceptive tracking under general consumer protection authority. California's CCPA gives consumers the right to opt out of the sale and sharing of behavioral data collected by advertising pixels.

In practice, most marketing email tracking operates without explicit opt-in consent globally. European enforcement has increased, but remains inconsistent.

For a broader look at what metadata your emails reveal beyond pixels, see Email Metadata Privacy: What Your Emails Reveal.

How to Detect Pixels Already Tracking You

In email:

• Apple Mail: Tap or click the lock icon next to a sender's name to see how many trackers were blocked for that message
• Gmail: Three-dot menu > "Show original" and search the raw HTML for 1x1 image tags pointing to third-party domains
• Browser extensions: Ugly Email, Trocker, and PixelBlock flag tracked emails directly in your Gmail inbox

On web pages:

• Open browser Developer Tools > Network tab > filter by "Img" and look for tiny images loading from third-party domains
• uBlock Origin: click the extension icon to see how many requests were blocked and from which domains

You can also run our IP Lookup to see exactly what your IP address reveals about your location, which is the same data a tracking pixel collects about you.

FAQ

Do tracking pixels work if I have images turned off in my email client?

Yes, that is the point of turning images off. If your email client does not fetch remote images, the tracking pixel never loads, and the sender's server never receives a request. The open goes unrecorded. The trade-off is that legitimate images in emails also do not display until you approve them.

Does Apple Mail Privacy Protection actually prevent tracking?

It prevents IP-based location tracking and hides the real time you opened an email, because Apple pre-fetches images through its proxy at delivery time rather than at open time. However, it does not make you invisible to senders. Senders still see that the email was delivered to an Apple Mail user, and Apple's proxy registers a request for each email, which inflates open rates.

Can a tracking pixel reveal my exact home address?

No. Pixels collect your IP address, which maps to a city or region, not a street address. Your ISP knows which customer was assigned a given IP at a given time, but marketers do not have access to that mapping. The location data from pixels is approximate, typically accurate to within 25-50 miles for residential connections. See our IP Geolocation Accuracy post for more detail on what IP-based location can and cannot determine.

Do tracking pixels work in webmail like Gmail and Yahoo Mail?

Gmail proxies all images through Google's servers, so your real IP is hidden, but the open event is still recorded. Yahoo Mail does not offer the same default proxy protection. Webmail accessed through a browser is also subject to web-based tracking pixels from the webmail service itself, tracked through cookies and browser fingerprinting in addition to any pixels in individual emails.

Will a VPN block tracking pixels?

A VPN replaces your real IP address with the VPN server's IP in the pixel's log, hiding your physical location. However, the pixel still fires and the open is still recorded. A VPN with built-in DNS-level tracker blocking (some providers include this as an optional feature) can go further by blocking requests to known tracking domains before they are sent. Check whether yours is actually working with our VPN Leak Test.

Sources

• Apple Mail Privacy Protection - Apple Legal
• Use Mail Privacy Protection on iPhone - Apple Support
• Turn images on or off in Gmail - Google Support
• uBlock Origin - Wikipedia
• Enhanced Tracking Protection in Firefox - Mozilla Support
• ICO Guidance on Storage and Access Technologies - ICO