How to Stop Email Tracking: Block Spy Pixels in 2026

To stop email tracking, disable automatic image loading in your email client, switch to a provider that strips trackers by default like Proton Mail, and use email aliases when you sign up for anything. Blocking images kills open-tracking pixels — but it does nothing to tracked links, so you need both layers to be genuinely protected.

Now, here's the longer version.

Something I wish someone had told me years ago: the moment you open a marketing email, a tiny invisible image quietly phones home and tells the sender you did it.

Not "someone opened this." You opened it. At 9:14 a.m. On an iPhone. Roughly in your neighborhood.

I found that genuinely unsettling. So I spent weeks testing every setting, extension, and provider I could get my hands on — and this guide is the result.

What Email Tracking Actually Is (And Why It's Worse Than You Think)

Before you can block something, you need to understand it. Most people assume email tracking just means "the sender knows I opened it." That's the polite version. In reality, a single tracking pixel can hand over your IP address, your approximate location, your device type, how many times you re-read the message, and whether you forwarded it. Worse, that data rarely stays with the sender. It flows to a network of third parties running behavioral profiling on you.

Let me break down the mechanics.

A tracking pixel — also called a spy pixel or web beacon — is a 1×1 transparent image embedded in HTML email. According to Privacy International, when your email client loads that image, the request itself acts as the notification. Because the pixel URL is unique to you, the server knows precisely who opened the message.

Simple. Invisible. Ruthlessly effective.

If you're serious about locking down your whole digital footprint rather than just your inbox, it's worth reading our complete guide to digital security and privacy alongside this one. Email is one leak among many.

The Research That Made Me Change Every Setting

Don't take my word for any of this. The definitive academic work is the 2018 Princeton study "I never signed up for this! Privacy implications of email tracking" by Steven Englehardt, Jeffrey Han, and Arvind Narayanan, published at PETS 2018. They crawled 15,700 websites and signed up to over 12,000 mailing lists to find out what's really inside your inbox.

The 2018 numbers are rough reading.

As Help Net Security reported, 85% of emails contained embedded third-party content, 70% contained resources classified as trackers, and roughly 29% leaked the recipient's email address to at least one third party — with an average of 5.2 third parties per email.

And CSO Online notes that 62% of those leaks were intentional on the sender's part.

Not accidents. Design choices.

It hasn't improved since. More recent 2026 analysis puts the figure at roughly 68% of all email carrying a tracking pixel, most placed with no notice to the recipient.

The One Distinction Almost Every Guide Gets Wrong

This is the part I really need you to sit with, because it's where most advice falls apart. Two completely different protections get used interchangeably, and they shouldn't. Hiding your IP address and blocking the open event are not the same thing. Confusing them is how you end up feeling protected while still being counted. Let me separate them cleanly.

Proxying (what Gmail and Apple do) hides where you are. The open still registers.

Blocking remote content stops the pixel loading at all. The open never fires.

Big difference, right?

Then there's a third thing: tracked links. These need no images. They use unique UTM parameters and redirects to log clicks. As one detailed teardown puts it, image blocking does not stop click tracking — if you disable images, senders can still track you the moment you click.

And read receipts are a fourth, separate thing entirely. Those are an explicit protocol-level request that you must actively consent to send — so if you never click "send receipt," you're fine there.

So you need layers. One switch won't save you.

How to Tell If an Email Is Tracked

Before you block anything, it helps to see the problem. Honestly, watching the counter tick up is what convinced me to overhaul my whole setup. Detection tools sit quietly in your browser and flag messages containing third-party trackers before you ever open them — which means you get to decide whether a sender deserves the open at all.

Here's what works:

• Ugly Email — scans your inbox and adds a small eye icon to any email containing trackers, visible in the inbox list before you click
• PixelBlock — blocks the pixel and alerts you which emails contained tracking code
• Trocker — works across Gmail, Outlook.com and Yahoo, blocking both tracking pixels and link trackers, showing a shield icon when it stops something
• Proton Mail's badge — displays a number showing exactly how many trackers were blocked and links cleaned

Step-by-Step: How to Block Email Tracking on Every Platform

Enough theory. Let's fix this. Below is the exact sequence I used, platform by platform. Work through whichever apply — and honestly, do all of them if you use multiple devices. Disabling remote content on your laptop means nothing if your phone is happily loading every pixel in the background. That was my mistake for a solid year.

Step 1: Lock Down Gmail

Gmail loads images through a proxy by default, which helps a little — but not enough.

1. Click the gear icon, then See All Settings
2. Scroll to the Images section
3. Select "Ask before displaying external images"
4. Hit Save Changes at the bottom

Done. Your inbox looks plainer. Your privacy improves immediately.

Step 2: Turn On Apple Mail Privacy Protection

Apple did well here. Per Apple's own support documentation, go to Mail → Settings → Privacy → Protect Mail Activity. Your IP address is hidden from senders, and remote content downloads privately in the background when you receive a message rather than when you view it. Deselect it and you can separately choose Hide IP Address and Block All Remote Content.

On iPhone? Settings → Apps → Mail → Privacy Protection → Protect Mail Activity.

Apple's legal disclosure is refreshingly blunt — senders may otherwise learn when and how many times you opened, whether you forwarded, and your IP address.

Step 3: Fix Thunderbird and Outlook

For Mozilla Thunderbird, go to Settings → Privacy & Security and disable "Allow remote content in messages."

Outlook.com is friendlier out of the box. It routes online images through a proxy, blocking tracking pixels while still loading legitimate remote images.

Step 4: Add a Pixel Blocker Extension

Install PixelBlock, Ugly Email, or Trocker. One caveat: extensions only protect you in desktop browsers — they don't work in mobile apps or desktop email clients.

Step 5: Use Aliases and Plain Text

Sign up for things using a disposable email address or alias so your real inbox never enters the data broker ecosystem. And for maximum protection, switch to plain text — turning off HTML email entirely stops most trackers, though it's a rough user experience.

Email Privacy Tools Compared

Every option below does something, but they don't all do the same something. Here's how they actually stack up on the four things that matter, and notice how few tick every box — that gap is the whole reason I ended up switching providers rather than just toggling settings.

Proton Mail is the only genuinely complete option. It blocks pixels by default, proxies your IP, cleans tracking links on the web app, and works properly on mobile.

Apple Mail with Mail Privacy Protection hides your IP and works everywhere Apple does, but pixel blocking is optional rather than automatic, and it does nothing about tracking links.

Gmail proxies your IP but doesn't block pixels by default and ignores link trackers entirely. Same broad story for Outlook.com, which blocks trackers via its image proxy but leaves links untouched.

DuckDuckGo Email Protection strips trackers and cleans links across mobile and desktop, with partial IP protection through its forwarding layer.

Browser extensions block pixels reliably and handle some link trackers, but they collapse the moment you pick up your phone.

Why I Recommend Switching to Proton Mail

Toggling settings works, but it's manual, fragile, and breaks the moment you sign in on a new device. If you want email tracker protection that just works, switching providers is the highest-leverage move available. I moved my newsletter and signup traffic to Proton Mail and never looked back.

Proton's Block email tracking feature removes known spy pixels on web, iOS, iPadOS and Android, preloads other remote images through a proxy with a generic IP address, and — on the web app — strips known trackers from links inside your emails.

You still see your images. You just stop being the product.

Now, the honest trade-offs. Migrating means updating your address across dozens of services, and Proton's ecosystem is smaller than Google's. Proton itself admits advertisers change tracking parameters to evade blocking, and stripping parameters occasionally breaks a link — in which case they leave it intact.

That transparency is exactly why I trust them. A weekend of migration versus years of silent surveillance? Easy trade.

Want to keep your current inbox? DuckDuckGo Email Protection is a strong free alternative — a forwarding service that strips trackers and generates unlimited private addresses.

And if you lean on AI assistants to summarise or triage your inbox, layer on a privacy tool built for that specific risk. Our breakdown of Dicloak, the privacy sidekick for AI tools, covers how real-time anonymisation keeps your email content out of third-party training pipelines.

The Law Is Finally Catching Up (But Don't Wait for It)

Something significant shifted in 2026. Regulators stopped treating email open tracking as harmless measurement and started treating it like cookies — meaning consent is required. That's seismic for the industry and validating for you. But enforcement is slow, and your inbox is being tracked today.

France moved first. Per Covington's Inside Privacy, the CNIL adopted a recommendation on 12 March 2026 and published it on 14 April 2026, generally requiring prior consent for tracking pixels, with existing contacts to be informed by 14 July 2026.

Italy followed, with its own transitional window running to late October 2026.

In the US, CIPA wiretapping claims are stacking up — carrying statutory damages of up to $5,000 per violation.

Frequently Asked Questions

Does turning off images stop all email tracking?

No. Disabling remote images stops open-tracking pixels, but tracked links still work. Those use unique URL parameters and redirects that fire the moment you click, regardless of your image settings. You need a link-cleaning provider or extension for full coverage.

Can senders tell I blocked their pixel?

Not directly. A blocked pixel simply never loads, so the sender sees no open event — indistinguishable from you deleting the email unread. There's no notification telling them you're blocking.

Does a VPN stop email tracking?

Partially. A VPN masks your real IP address and location if a pixel does load, but it doesn't stop the open event registering. Treat it as a complement to pixel blocking, never a replacement.

Is Apple Mail Privacy Protection enough on its own?

For location privacy, yes. For open privacy, no. MPP loads remote content in the background, which means the pixel still fires — the sender just can't tell where you are. Enable Block All Remote Content if you want opens hidden too.

Do tracking pixels work in plain-text email?

No. Pixels require HTML rendering to load remote images. Reading in plain text eliminates them entirely, though you'll lose formatting, images, and layout in every message.

Is email tracking legal?

Increasingly restricted. France's CNIL now requires prior consent for most tracking pixels, Italy has parallel binding guidance, and US class actions are proceeding under state wiretapping statutes.

My Honest Bottom Line

Blocking images is your floor, not your ceiling.

Because the Princeton team found something that still sticks with me: after analysing 16 mail servers and clients, no single setup offered complete protection.

So layer up. Kill remote images. Use aliases. Install a blocker. And if you want it handled quietly in the background, get Proton Mail and stop managing it yourself.

Your inbox should be your space.

Go take it back.