Report: Most Emails Contain 'Spy Pixel'

Two thirds of emails contain a "spy pixel" according to one provider. The invisible pixel could let companies discover where people live and what devices they own. At the very least, it will report back to spammers that the email has been opened, which then validates your email address and will result in additional spam.

The figures comes from "Hey," an email provider that offers a paid service rather than scanning emails to get information for targeted advertising. That means it's possible its user base isn't reflective of the general public, though that shouldn't distort the results of its audit of emails.

The company said on average its customers get 24 emails a day that contain at least one tracking pixel, while 10 percent of customers get at least 50 such messages. In many cases the senders were reputable, well-known businesses. (Source: techradar.com)

Invisible Tracker

A spy pixel is simply a tiny image (literally one pixel in dimension), usually in white so that it can't be seen by the user. The image isn't actually in the mail itself, but instead retrieved from the sender's email server once the message has been rendered on the user's machine.

That retrieval allows the sender to track which emails have actually been read and whether the recipient reopens the email later on. Both of these help companies test how attractive different subject lines are, or whether sending at a certain time of day means users read messages more quickly. They can also make it more effective to target follow-up messages, for example at people who may be thinking over an offer in a promotional email.

However, the process can mean the senders get additional detail beyond the email being opened. For example, they'll typically be able to see the type of device was used to access the email. They'll also get an IP address, which could theoretically narrow down the user to the nearest street, though accuracy varies.

Consent a Key Issue

While this is all information a company can get when somebody visits a website, Hey argues it's a matter of consent. While users choose to visit a site and could reasonably be expected to know this action provides some data, it's not as clear that this happens when opening an email.

It's also arguably spy pixels breach some privacy laws (particular Europe's GDPR) which require active consent before a company can collect any personal data. (Source: bbc.co.uk)

Some email providers allow users to specifically block spy pixels. With others, a similar effect can be had by blocking images from automatically loading or switching to a plain-text-only mode. This is typically the default action taken for most email clients such as Thunderbird or Outlook.

What's Your Opinion?

Did you know about the use of tracking pixels? Is it acceptable to you or does it go too far? Should companies have to get consent before using tracking pixels?