Tracking pixels in emails
from trilobite@lemmy.ml to privacy@lemmy.ml on 31 Oct 08:02
https://lemmy.ml/post/54720647
from trilobite@lemmy.ml to privacy@lemmy.ml on 31 Oct 08:02
https://lemmy.ml/post/54720647
i’m getting a lot of emails from my bank and other services that make me aware that they use tracking pixels in emails. apparently they are obliged by the privacy regulator that is enforcing a recent EU directive. i didn’t even know that i was sending ip and client info simply by reading my emails in thunderbird or k9 on my mobile. is there a way to deactivate these? and is there a risk that by doing so the bank thinks the email is compromised or non existant. its incredibile to see how sophisticated data hoovering technology has become. the internet has become a real mess …
threaded - newest
I think Thunderbird by default does not load external content. Mine always warns me whether I want to allow for remote content when I open a new email, and possibly whether I want to always allow it for a particular sender. I never do.
Check the settings, and possibly reset that option.
There are add-ons (and i think there even is a setting option noe) to not load html but display the message in Plain Text: Allow HTML Temp.
Highly recommend to just show(and use) plain text.
Indeed, there is a built-in setting to show messages as ‘original html’ or ‘simplified html’ or ‘plain text’.
But even if you choose ‘original html’, external elements are not downloaded, unless you positively answer the warning (above the message) to download them. Any images you might still see are embedded in the message itself, not externally downloaded.
FairEmail shows these kind of pixels very obviously and gives customisation options too.
Most email clients don’t fetch remote resources like images embedded in emails unless you specifically ask them to. If you’re seeing pictures in your emails without having to tap something extra after opening the email, you likely need to change your settings.
As someone else pointed out, FairEmail for android additionally blocks tracking pixels even if you want to load other images.
Loading other images or resources can still track you. For example, rather than using a tracking pixel, a company could create (let’s be honest, generate 🙄) a unique image for each email campaign they do, and make that a visually important part of the email, such as a title banner, and then track who loads that to see who opened the email. They could even add tracking metadata to the URL like
https://example.com/email-resources/october-newsletter-header.jpg?user=your-email%40your-domain.comimages attached to the email can also be embedded, which I think most clients will show by default. those don’t have privacy implications as they don’t need extra network requests.
Good point
Never load images in emails 😘
Set your client to not download/show embedded images, so only the text part gets loaded.
Email aliasing services, which are genuinely good services to use, strip those pixels from inbound emails. At least Firefox Relay, Addy and SimpleLogin do
Would something like pihole also strip out all this crap? I’ve been meaning to get it on my network for a while.
I’m not too sure, maybe? If the tracking pixel is on a domain known to serve ads or trackers, it might, but if it’s on a legitimate domain (e.g. your ISP’s) I don’t think it can, since you’d have to have added the ISP’s domain to the Pi-hole blacklist
As far as I know pihole filters on the DNS level, so if the tracking pixel is on a domain it trusts (e.g., the bank’s) it won’t filter it, no.
It’ll stop a lot of them, some will slip through though.
I have all of my email clients set to not load internet content. Probably why one of my banks, Navy Federal, keeps saying my email address is invalid despite the fact I get their emails.
How does it work? Like a read receipt? I thought the likes of thunderbird were essentially offline after initial loading?
I assume it’s an img tag pointing at a one pixel image (every mail has its own querystring or URL), when you load it the server logs the time, requesting IP, and so on.
Obviously it’ll only work if you tell the mail client to download the images.
(It doesn’t need to be a single pixel, could be the bank’s logo or whatever, but since it has to be unique to ID you and avoid caching and whatnot I assume making it only one pixel is more efficient.)
They only load if you load images, every email client I’ve used does not load them by default for this reason.
You can also run an DNS adblocker like Adguard Home or PiHole and that will block a lot of the domains commonly used for tracking pixel images.
I view all my emails as plain text, no html.