Email Tracking Pixel

Email tracking pixels are the standard mechanism behind email open tracking. The technology has been in use since the early 2000s and is the underlying technique behind every commercial email tracking tool: Mailtrack, Yesware, Mixmax, HubSpot Sales Hub, Outsolvi, and others.

How the mechanism works

The sender's tracking tool inserts an HTML image tag into the outgoing email's HTML body. The image source URL points at a tracker server with a unique identifier for that specific send. The image itself is a 1x1 transparent pixel — essentially invisible visually.

When the recipient's mail client renders the email's HTML body, it fetches every image referenced in the body, including the tracking pixel. The fetch hits the tracker server, which logs:

• The unique identifier (mapping back to which message and recipient)
• The timestamp of the fetch
• The IP address of the fetching client
• The User-Agent string (which mail client, which OS)
• Sometimes additional headers (Accept-Language, Referer)

The server registers this as an "open event" and surfaces it in the sender's dashboard.

What the pixel is NOT

The pixel does not read the email content. It does not see the recipient's screen, mouse, or keyboard. It does not track time spent reading. It does not know whether the recipient actually looked at the email after opening it. The pixel only registers the moment the mail client fetched the image — which may or may not correlate with the human reading the message.

Why raw pixel-load counts are unreliable in 2026

Three forces fire pixel loads that are not human reads:

Apple Mail Privacy Protection. Since iOS 15 in September 2021, Apple pre-loads every remote image — including tracking pixels — on Apple-controlled relay servers before the recipient opens the email. The pixel fires, the sender sees an "open," but the human may never open the message. See the Apple Mail Privacy Protection definition.

Gmail's image proxy. Since December 2013, Gmail routes every embedded image through googleusercontent.com servers. Google's image-fetching bot loads the pixel before the human opens the email, and the cached image can be re-fetched as the user scrolls.

Corporate email scanners. Mimecast, Proofpoint, Microsoft Defender for Office 365, and similar gateways pre-fetch every link and image to scan for malware before delivery. The pixel fires from the scanner's IP, generating a false-positive open event.

A tracker that counts every pixel load as an open will report inflated open counts. Modern confidence-scoring trackers (Outsolvi) analyse the IP block, User-Agent, and timing signature to classify each pixel load by likely-human-versus-machine confidence.

Can recipients detect tracking pixels?

Yes, if they look. The HTML email source contains the image tag pointing at the tracker's domain. Privacy-aware recipients using a mail client that lets them inspect source (or using extensions like Ugly Email, PixelBlock, or Trocker for Gmail) can see the pixel before opening the message.

Most B2B recipients do not actively check, but the share that does is growing. Recipients who specifically block remote images (a setting in most mail clients) will not trigger the pixel. Recipients on Apple Mail with MPP have the pre-fetch happen on Apple's servers, so the open registers regardless.

Privacy and legal considerations

In most jurisdictions, tracking pixels in B2B email are legal under legitimate-interest provisions (GDPR Article 6 in the EU, similar provisions elsewhere). The standard B2B sales-outreach use case is covered, provided the recipient can opt out. CAN-SPAM in the US applies to bulk commercial email and requires a clear opt-out; one-to-one B2B email is in a fuzzier zone but most legal teams treat opt-out availability as the safe posture.

The privacy considerations vary by tracking tool. Some tools store the email body (Yesware, Saleshandy, Streak, HubSpot Sales, Mailbutler) because their product features require it. Others (Outsolvi) store metadata only — the open event, the timestamp, the engagement signal — without retaining the message body. For procurement reviews in regulated industries, the metadata-only architecture is typically easier to clear.