How can I tell if someone opened my email without a read receipt?

Senders usually find out through a tracking pixel built into their email software or marketing tool. You are on the receiving end of the same technique every time you open a newsletter. If you are asking because someone else seems to know when you read their messages, the fix is on your side: stop your mail app from loading remote images automatically.

Can an email tracking pixel reveal my location?

Roughly. When your mail app fetches the image, the sender’s server sees your IP address, which usually points to a city or region. The BBC reported in 2021 that in some cases it can narrow things down to a street. If your mail app fetches images through a proxy, as Gmail does and Apple Mail does with Mail Privacy Protection on, the sender sees the proxy’s address instead.

Does Gmail block tracking pixels?

Partly. Since 2013 Gmail loads images through Google’s own proxy servers, so senders cannot see your IP address or set cookies. Google’s help page also says senders may sometimes still know whether you opened an email with an image, because the image is fetched when you open it. Setting Gmail to ask before displaying external images closes that gap.

Are read receipts the same as tracking pixels?

No. A read receipt is a visible request. Your mail app normally asks you whether to send it, and you can say no. The technical standard behind it recommends asking for consent and defaulting to not sending. A tracking pixel never asks. It reports back silently as soon as images load.

Email tracking pixels: what opening an email tells the sender

In late June 2019, designer Mike Davidson noticed something odd about Superhuman. It was one of the most hyped new email apps at the time, available by invitation only. Every message its users sent carried a hidden email tracking pixel, switched on by default. If you opened one of those emails nine times, the sender got a log with nine entries, each with a time and a location. You never saw a thing. Davidson published “Superhuman is Spying on You” on July 2. The next day, the company dropped location tracking and turned the feature off by default.

Superhuman did not invent any of this. The same mechanism sits in nearly every marketing email you get, and a Princeton study found it often goes further than a timestamp. In many messages, your email address went straight to ad companies that had nothing to do with the sender. More on that below. Most of what you find when you search this topic is written for senders who want better open rates. This one is written from the inbox side: what an open gives away, how to spot it, and which settings actually change anything.

What is an email tracking pixel?

An email can include images in two ways. They can be attached to the message itself, or the email can simply point to an image hosted on a server somewhere. In the second case your mail app has to download the picture when you open the message, and that download is the whole trick.

The BBC described the typical pixel in 2021: a GIF or PNG file as small as one by one pixel, placed in the header, footer or body of an email. It often matches the background color, so you cannot spot it even if you know it is there. You do not need to click anything. Opening the email is enough.

Close-up of an almost empty pale surface in dim light with one tiny point of warm light resting on it — One pixel, practically invisible. What matters is that your mail app has to fetch it.

What turns a harmless image into a tracker is its address. The URL carries an ID that is different for every recipient. Superhuman’s CEO Rahul Vohra explained it plainly in his public response in July 2019. The app puts a tiny image in sent messages. The image server logs each request and often uses the IP address to guess an approximate location. He compared it to how website analytics count visitors. The difference is that a website visitor chose to visit. An email recipient just opened their inbox.

Read receipts vs. tracking pixels

Many people know read receipts from Outlook or Apple Mail. The sender ticks a box, and your mail app asks whether you want to confirm. Simple enough. That is a formal mechanism, defined in an internet standard called RFC 8098 from February 2017. The standard treats the request as just that, a request the recipient can silently ignore. It strongly recommends that mail apps get the user’s consent first, explicitly to protect privacy, and says the default should be not to send one.

A tracking pixel skips the question entirely. Microsoft’s own Outlook help page goes out of its way to point out that tracking pixels are not the same as a read receipt.

	Read receipt	Tracking pixel
Do you know about it?	yes, your app asks	usually only the sender knows
Can you decline?	yes, one click	only by blocking remote images
What does the sender learn?	that the message was displayed, roughly when	every open, with time, IP address and often device and mail app
How often?	once per recipient	every single time you open it
Who uses it?	individuals, offices	newsletters, retailers, sales teams, spammers

Superhuman, by the way, called its feature “read receipts.” Davidson argued that the label itself was misleading, because people hear that phrase and picture a simple read or unread status that they can opt out of.

What a single open reveals

When your mail app fetches the image, it sends an ordinary web request, the same kind a browser sends when it loads a page. Apple lists the result in the privacy notice for its own countermeasure. Senders, Apple writes, may learn when and how many times you opened their email, whether you forwarded it, your IP address, and other data that can be used to build a profile of your behavior and learn your location.

Data point	where it comes from	what the sender does with it
Time of opening	timestamp of the request	when you read mail, whether you engage
Number of opens	each open is a new request	how interested you seem
IP address	the source of the request	rough location, internet provider, recognizing you later
Device and mail app	the identifier your app sends along	phone or computer, which app
Your email address	often encoded in the image URL	linking you to data held elsewhere

Location deserves a closer look. It is rarely exact. An IP address usually resolves to a city or region, but the BBC reported that in some cases it can point to the street you are on. Our guide on how IP address lookup works explains how precise that really is and why it varies.

For sales teams, the open itself is the point. Hey co-founder David Heinemeier Hansson told the BBC that salespeople use it to follow up with lines like “I saw you open my email yesterday, but you haven’t replied yet. Can I call?” Some, he said, get outright belligerent once they see you opened it three times without answering.

A man seen from behind at a table in a dark apartment with a tablet and a lamp, the muted lights of the city visible through the window — You read in peace. Somewhere else, a log entry with a time and a rough location appears.

How common email tracking is

The most thorough study so far comes from Princeton. Steven Englehardt, Jeffrey Han and Arvind Narayanan published “I never signed up for this!” at the 2018 Privacy Enhancing Technologies Symposium, an academic conference on privacy technology. Their crawler visited 15,700 websites and tried to sign up for every mailing list it could find. The result was a pile of 12,618 emails from 902 senders.

Of those emails, 85 percent loaded content from outside servers, and 70 percent contained resources that popular tracking-protection lists classify as trackers. An email with external content involved 5.2 third parties on average. Nearly 900 different third parties showed up overall, and Google-owned services appeared in a third of all emails.

The finding that matters most is about your address. About 29 percent of the emails leaked the recipient’s email address to at least one third party when opened, often by baking it into an image URL, sometimes hashed. The researchers judged 62 percent of those leaks to be intentional. Once an ad company has your address tied to a browser cookie, it can connect your inbox to your browsing history. The authors put it bluntly: these links undercut the claim that web tracking is anonymous.

In early 2021, the BBC asked the email service Hey to analyze its traffic. Two thirds of emails sent to users’ personal accounts contained a tracking pixel, even after spam was excluded. Hansson said the average Hey customer received 24 such emails a day, and the top 10 percent got more than 50.

How to spot tracking in your own inbox

Most mail apps give you no warning at all. As Hansson put it to the BBC, there is no flag in most email software saying this message includes a spy pixel. You can still find clues.

The easiest one comes from turning off automatic image loading. Many marketing emails then show a bar saying remote content was blocked. Thunderbird, for instance, tells you it blocked remote content to protect your privacy. That does not prove a tracker is present. It does tell you that opening the message would contact outside servers.

To dig deeper, look at the raw message. In Gmail this is “Show original,” in Apple Mail on the Mac it is “Raw Source,” and Outlook and Thunderbird have similar options. Search for images declared with width=“1” and height=“1”, or for image URLs ending in long strings of random-looking characters. That string is often the ID that identifies you. None of this is foolproof, since a tracker can just as well hide in a full-size logo.

What your mail app already does

The big providers handle this very differently. The Princeton team tested 16 mail apps back in 2018. At that time only Gmail and Russia’s Yandex fetched images through their own servers, and most others loaded images automatically unless a message looked like spam. A lot has changed since, mostly thanks to Apple. The table reflects the vendors’ help pages as of October 2026.

Mail app	default behavior	what the sender still sees
Apple Mail with Protect Mail Activity	downloads remote content in the background through two separate relays, opened or not	neither the open nor your real IP address, links and attachments are not covered
Gmail	loads images automatically through Google’s proxy servers	per Google, not your location or computer, but sometimes that you opened it
Outlook (classic desktop)	blocks automatic picture downloads	nothing until you allow pictures
Thunderbird	blocks remote content	nothing until you allow it

Apple announced Mail Privacy Protection in June 2021 alongside iOS 15. The approach is blunt in a good way. Apple Mail downloads remote content when a message arrives, whether you ever open it or not. To the sender every email looks opened, which makes the signal worthless. According to Apple, those downloads run through two relays operated by different companies. The first knows your IP address but not the content, the second knows the content but not your address. On iPhone, the switch is in Settings, Apps, Mail, Privacy Protection, labeled Protect Mail Activity. Apple notes that links and attachments such as PDFs are not covered.

Two translucent glass structures on a misty plain, linked by a single beam of warm light — Two relays run by two companies: one knows your address, the other the content, neither knows both.

Gmail went the other way in December 2013. Google announced on the Gmail blog that images would be displayed automatically again, because all of them would now be served through Google’s own proxy servers. The sender sees Google’s address instead of yours and cannot set cookies. That is real progress. But Google’s help page is honest about the limit: senders may sometimes still know whether you opened an email that has an image. The proxy fetches the image the moment you open the message, so the timing still leaks.

Outlook and Thunderbird block remote images out of the box. It is the strictest setting and the least convenient one, since plenty of newsletters are unreadable without pictures. Both let you allow images for a single message or for senders you trust. Thunderbird adds a sensible warning here: sender addresses are easy to fake. Allowing a website that hosts the images is harder to abuse than allowing an email address.

What actually helps

The most effective fix is also the oldest one. Stop your mail app from loading remote images automatically, then allow them only for messages you choose. In Gmail, open Settings, see all settings, and under “Images” select “Ask before displaying external images.” In Apple Mail, leave Protect Mail Activity on. On iPhone it requires Limit IP Address Tracking to be enabled, which you find in the Wi-Fi settings for each network. For Outlook and Thunderbird, the main thing is not to change the default.

A dark blue curtain drawn almost closed in a quiet room, a narrow strip of warm light falling through the gap onto the wooden floor — Remote images on request only: you decide when someone gets to look in.

Links are the gap no image setting closes. Any link in a newsletter can carry a personal ID, and clicking it identifies you on the spot. The Princeton study found that 11 percent of the links it followed triggered requests that leaked the email address to a third party. If an offer interests you, typing the shop’s address into your browser avoids that, at least for the click itself.

Senders are not about to stop on their own. After the uproar, Superhuman kept its read statuses, it only switched them off by default and removed location. The BBC noted in 2021 that the episode had little impact on how much the marketing industry relies on the technology. Your settings work today, whatever senders decide.

The bottom line

A tracking pixel is technically trivial: an image loads, a server takes notes. What makes it a problem is the combination of invisibility and scale. Nearly every newsletter has one, and almost no mail app tells you when it reports back. Davidson’s nine opens with locations caused an outcry in 2019 because they showed, in one screenshot, what marketing had been doing quietly for years.

Protecting yourself is pleasantly simple. Load remote images only when you choose, keep Mail Privacy Protection on if you use Apple Mail, and think twice before clicking links in newsletters. After that, a sender only hears from you when you decide to answer.

Frequently asked questions

What is an email tracking pixel?: A tiny image, often a single pixel, that is not attached to the email but stored on the sender’s server. When you open the message, your mail app fetches it. The server logs that request, and because the image address usually contains an ID unique to you, the sender knows exactly which recipient opened the email and when.
How can I tell if someone opened my email without a read receipt?: Senders usually find out through a tracking pixel built into their email software or marketing tool. You are on the receiving end of the same technique every time you open a newsletter. If you are asking because someone else seems to know when you read their messages, the fix is on your side: stop your mail app from loading remote images automatically.
Can an email tracking pixel reveal my location?: Roughly. When your mail app fetches the image, the sender’s server sees your IP address, which usually points to a city or region. The BBC reported in 2021 that in some cases it can narrow things down to a street. If your mail app fetches images through a proxy, as Gmail does and Apple Mail does with Mail Privacy Protection on, the sender sees the proxy’s address instead.
Does Gmail block tracking pixels?: Partly. Since 2013 Gmail loads images through Google’s own proxy servers, so senders cannot see your IP address or set cookies. Google’s help page also says senders may sometimes still know whether you opened an email with an image, because the image is fetched when you open it. Setting Gmail to ask before displaying external images closes that gap.
Are read receipts the same as tracking pixels?: No. A read receipt is a visible request. Your mail app normally asks you whether to send it, and you can say no. The technical standard behind it recommends asking for consent and defaulting to not sending. A tracking pixel never asks. It reports back silently as soon as images load.