Email Privacy: Tracking Pixels, Encryption and Safer Habits

Email is closer to a postcard than a sealed letter: messages are usually readable by providers and can include hidden trackers that report when you open them. You can improve email privacy by blocking remote images, using aliases, choosing a provider carefully and encrypting only what truly needs it.

How email exposes you

Standard email passes through several servers, and most links between them use transport encryption, which protects contents in transit but not from the servers themselves. Your provider generally stores messages in a form it can read, and it can access them as the service’s terms and the law permit.

Beyond content, there is metadata: sender, recipient, subject line, timestamps and sizes. Even if you encrypt the body, much of this remains visible.

Tracking pixels and link tracking

A tracking pixel is a tiny, usually invisible image embedded in an email. When your email client loads it, the sender’s server records that you opened the message, when, your approximate location from the IP address and the type of device you use. Links can also carry unique identifiers so senders know who clicked.

Marketers use this to measure campaigns, but it is also used for surveillance-style tracking by anyone who sends you an email.

To limit it:

• Block remote images by default in your email client. Messages still display text, and you can load images for senders you trust.
• Use a client or provider with built-in tracker protection, which proxies or strips pixels.
• Be cautious with links, and consider copying the destination rather than clicking in unknown messages.

Aliases and separate addresses

Using a unique address for each service reveals who leaked or sold your details, limits spam and prevents a single address from linking all your accounts. Many providers support plus-style addressing or alias features; some offer dedicated alias tools.

Keep a main address for important accounts, such as banking, and separate addresses for newsletters, shopping and sign-ups.

When to use end-to-end encrypted email

Standard tools such as PGP and S/MIME can encrypt the message body so only the recipient can read it, but they are awkward to set up and both parties must use them. Some privacy-focused providers offer built-in encryption between their own users and password-protected messages to outsiders.

Use it for genuinely sensitive information, such as legal or medical documents. Remember that subject lines and metadata often remain unencrypted, so do not put secrets in a subject.

Safer everyday habits

• Secure the account with a unique password and two-factor authentication.
• Do not use work email for personal matters, since employers may have access.
• Review connected apps and forwarding rules regularly. Hidden forwarding rules are a way attackers quietly copy your mail.
• Unsubscribe through the legitimate link of known senders, and avoid replying to spam.
• Consider deleting old mail you no longer need, since a breach exposes whatever is stored.

Choosing a provider

Compare how a provider earns money, whether it scans messages for advertising, what encryption it offers, how it handles legal requests and what it does with logs. A privacy-oriented provider is useful, but your habits and settings matter just as much.

A thirty-minute email privacy tune-up

Turn on two-factor authentication, switch off automatic remote image loading, review forwarding rules and connected apps, and create aliases for the three services that email you most. Then unsubscribe from newsletters you never read and delete old sensitive attachments. Half an hour spent this way closes the most common leaks.

Business email and personal email

Work accounts are managed by an organisation that may retain, scan or review messages. Keep personal subjects, such as health, job hunting and family matters, out of work email. Likewise, avoid forwarding work documents to a personal address, since that can breach policy and move sensitive data to a less protected place.

Spotting tracking in practice

If an email shows a blank space or loads images only when you click “show images”, it likely contains remote content. Tracking links often contain long strings of random characters after the domain. When you see these, you can type the known website address yourself instead of clicking.

Privacy-friendly email workflow

Read mail with images off, reply from the right alias, and keep sensitive attachments in an encrypted file rather than loose in the inbox. Use filters to sort newsletters away from important mail, and archive or delete threads containing identity documents once they are no longer needed. A tidy mailbox is also easier to protect, since a breach exposes only what is stored there.

Frequently asked questions

Can people tell when I open their email?

Yes, if the email contains a tracking pixel and your client loads remote images. Blocking remote images prevents most of this.

Is Gmail-style webmail private?

Webmail providers can access stored messages under their terms. Review the provider’s privacy settings and policies, and use end-to-end encryption for truly sensitive content.

What is an email alias?

An alias is an alternative address that forwards to your inbox. It hides your real address and can be switched off if it attracts spam.

Key takeaways

• Standard email is readable by providers and exposes metadata.
• Block remote images to defeat tracking pixels.
• Use unique aliases per service.
• Reserve end-to-end encryption for sensitive messages and secure the account itself.