Skip to content
EML-030 Email Evidence

What is a tracking pixel?

title: What is a tracking pixel? subtitle: It is usually remote content designed to generate a request when an email is displayed or processed. slug: what-is-a-tracking-pixel series: email-evidence section: content-and-attachments card_type: question_card pathway_order: 25 section_order: 3 status: draft public_safe: true video_ready: true word_count: 616 estimated_read_time_seconds: 255 audiences: - investigator - supervisor - fraud and compliance practitioner tags: - email evidence - tracking pixel - remote content - open tracking - privacy sources: - title: 'Gmail Help: Turn images on or off' url: https://support.google.com/mail/answer/145919?hl=en-GB - title: 'Apple Support: Protect email privacy in Mail' url: https://support.apple.com/en-gb/guide/mail/mlhlp1205/mac - title: 'RFC 2045: Multipurpose Internet Mail Extensions (MIME) Part One' url: https://www.rfc-editor.org/info/rfc2045/ - title: 'RFC 2387: The MIME Multipart/Related Content-Type' url: https://www.rfc-editor.org/info/rfc2387/

What is a tracking pixel?

It is usually remote content designed to generate a request when an email is displayed or processed.

Script

A tracking pixel is usually a very small or invisible image loaded from a remote server when an email is displayed.

The image may be one pixel across, transparent, hidden through styling or presented as an ordinary part of the message.

The important feature isn’t its size.

It is that the content is fetched from somewhere outside the email.

The image address may contain a unique identifier for the recipient, campaign or message. When a mail client requests it, the sender or platform may record the time, requesting IP address, user agent and the identifier in the URL.

That can be used to estimate whether an email was opened.

But “open tracking” is not the same as proof that a particular person read the message.

Remote content may be fetched automatically.

A security gateway may scan it.

An email provider may proxy it.

A privacy service may preload it.

A mail client may download it in the background.

Several people may access the same mailbox.

The message may be displayed in a preview pane without being read carefully.

Modern privacy protections can also make the recorded IP address belong to a provider or relay rather than the recipient’s actual connection.

Apple’s Mail Privacy Protection, for example, can privately download remote content and hide the user’s IP address. Gmail may serve images through its own systems and apply scanning or privacy controls.

So a tracking record may support:

“A request was made for remote content uniquely associated with this message.”

It may not safely support:

“The recipient personally opened and read the email at this location and time.”

Start with the message itself.

Preserve the HTML and identify references to remote content.

Look for image sources beginning with HTTP or HTTPS, unusually small dimensions, hidden styling, unique identifiers and domains associated with marketing, analytics or customer-management services.

Don’t assume every remote image is a tracking pixel.

Company logos, signatures, product images, social-media icons and ordinary page content may also load remotely.

Equally, a tracking mechanism doesn’t have to be a literal one-pixel GIF. Any uniquely addressed remote resource can perform a similar role.

Avoid opening the message repeatedly in a way that loads remote content.

Your own examination may generate a new request and create a misleading “open” event.

Work from a preserved copy in a controlled environment, block remote content where appropriate, and record whether the recipient’s client was already configured to load it.

If provider or sender-side tracking records are available, ask what the service actually records.

Does the event represent a direct request, a proxy fetch, a privacy preload or a click?

How does the platform handle repeated loads?

Does it suppress automated security scans?

Which identifier links the event to the recipient?

Don’t treat a vendor label such as “opened” as a complete evidential explanation.

The platform may be applying its own rules to network requests.

The common mistake is:

“The tracking system says opened, so the recipient definitely read it.”

The opposite mistake is:

“Privacy protection exists, so the tracking record is worthless.”

The record may still show when remote content was fetched, which campaign identifier was used and how the provider processed the request.

It simply needs careful interpretation.

A useful conclusion might be:

“The sender’s tracking system recorded a request for the unique remote image associated with this message. The available data doesn’t establish whether the request was caused by the recipient, their mail provider, a security system or another mailbox user.”

A tracking pixel is a network request hidden inside the presentation of an email.

Preserve the message before loading it, identify who may have made the request, and don’t turn an automated fetch into proof of human attention.

Key takeaway

A tracking request may show that remote content was fetched. It doesn’t always prove that the named recipient personally opened and read the email.

Source notes

Keep moving

Where this question leads

These links explain why the next page may matter, rather than presenting an undifferentiated list.