8 ms·

Email read-tracking is not GDPR compliant

48 points by albertgoeswoof 6y ago

draw_down 6y ago
Yeah, how's that GDPR working out? I feel like it was meant to do more than spur blog posts such as this one
- Nextgrid 6y ago
  The spirit of it is good, the enforcement has been significantly lacking and the regulators who are supposed to enforce it appear incompetent or unwilling to do so.
  - draw_down 6y ago
    Ah, well, as long as the spirit is good.
- SiempreViernes 6y ago
  You can check here https://www.enforcementtracker.com/ https://www.enforcementtracker.com/
  - Nextgrid 6y ago
    That link gets posted all the time, often as a rebuttal to the "no enforcement" claim but the web being littered by non-compliant tracking consent flows clearly shows there is not enough enforcement. As a reminder, I don't believe the majority of consent flows on the web are compliant with the regulation. As per the ICO's guidelines (the UK data protection regulator) https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/ https://ico.org.uk/for-organisations/guide-to-data-protectio...: > Consent requires a positive opt-in. Don’t use pre-ticked boxes or any other method of default consent. > Keep your consent requests separate from other terms and conditions. > Make it easy for people to withdraw consent and tell them how. > Avoid making consent to processing a precondition of a service. The majority of consent flows out there don't comply with at least one of these points, so the fact they're still out there 3 years after the regulation went into effect suggests enforcement is indeed lacking.
- Daho0n 6y ago
  Not perfect but much much better than before. I can give you two personal examples of how even small stuff that used to be ignored now demand attention: I installed a game that had a bug (opt-in to tracking wasn't working so tracking was always on). Lots and lots of users complained in the game developers forum but nothing happened. Not even a reply. I and a few others wrote emails to the support mail and nothing. Then I threatened with GDPR months later and two days later support was on my case and my data was deleted from both their system and the third party they used for tracking. Here in Denmark businesses aren't allowed to receive updates from the CPR registry (like SSN) if you aren't a customer anymore. It's used for stuff like banks automatically getting your new address if you move. Historically sending mails to those that didn't remove you from their updates didn't do anything. Now they run quickly as soon as they read "GDPR". There are big businesses that get away with things they shouldn't but by far the most problems can now be resolved, even small stuff that big businesses before didn't lift a finger to fix where the little man had no chance in hell. Now they (we!) do.
NDizzle 6y ago
Excessive. I don't care what the EU thinks.
- Nextgrid 6y ago
  Then you are welcome to opt into tracking. I think the EU's approach of default being "no tracking" is good - you can always decide to opt-in, but the default is safe.
  - pc86 6y ago
    Which is fine for companies located in the EU. The EU has absolutely zero authority to tell business located outside of the EU what to do. The fact that someone reading a blog post happens to be in Europe does not all of a sudden put the owner of that blog under EU jurisdiction.
    - lanternfish 6y ago
      But it does put that access transaction under EU jurisdiction, no?
      - snowwrestler 6y ago
        No. A company needs to be legally present in an EU jurisdiction to be exposed to liability under GDPR.
    - OJFord 6y ago
      Of course it does if those businesses want to operate in the EU.
    - deleted 6y ago
      [deleted]
  - jpttsn 6y ago
    Life in the EU is wonderful. It’s like waking up every morning wearing a helmet. You can take the helmet off at any time, but the default is safe.
n3storm 6y ago
While I support projects like ohmysmtp.com, I don't like the misinformation the post contains. There is not a single MUA that does not block, alert, warn user when hidden pixel is found, and also when any link in the message doesn't start with https...
- proactivesvcs 6y ago
  Not sure why you're being downvoted - I can't remember coming across an email client that doesn't support this, and many seem to do it by default these days.
  - mijamo 6y ago
    Gmail does not. And even those who do are not warning you about the tracking part, only about loading resources. Most users will just think that they want to see the nice images and accept and have no idea that it means they are tracked.
gwd 6y ago
> "Thanks for opening this email. We’ve logged that you read it, we’ll log again next time you open the email. We know where you’re located, and what device you’re on. We’re using this information to tweak our emails to get you to open and read more of our emails in the future" Nice
- Spivak 6y ago
  I think the paragraph after it kinda undermines their thesis though. There's nothing meaningfully different about an email and a website. They're both documents that you render locally on your client. The delivery mechanism doesn't really matter. You would probably find it really weird that a NYT article archive HTML page you have on your machine still tracks you because you client runs the JS if it wasn't already the norm. But then why does downloading that same document on-demand change your expectation of being tracked? Or if we were in a alternate universe where web pages were hyperlinked PDFs I bet you would find it odd that opening one in Acrobat sends all your interactions to some server somewhere. It's fine that by convention we have some places where it's not kosher to track people but we at least have to admit that the distinction is arbitrary and that being upset about email tracking but not website tracking is inherently inconsistent. Because sure you can name differences between emails and websites but nothing really fundamental.
  - mijamo 6y ago
    It is fundamentally different because when I track and email I know who I'm tracking and I will look at the data on and individual basis. For instance "great, that client has opened my contract email 5 times. Means they are interested.I can adapt my negotiating position based on that". For websites I would look as the data in aggregate. Sure that aggregation can be pretty precise but still it is not on the personal level. I suppose technically speaking you could checks the individual use of a website for logged in users but even Google Analytics is very explicit on hat not being OK for instance, and there is no UI for it in any tool that I know.
ddevault 6y ago
>Do you send emails through a service that let’s you see if the email was opened? No.
ryandrake 6y ago
The sad thing is we already have a privacy friendlier alternative to spy pixels: Read Receipts, defined in RFC 2298. They are already user opt-in. Don’t most mail agents support them?
- ncallaway 6y ago
  Sure, but most users don't or won't opt in to those, so the advertisers want to find a way to track people that isn't opt-in.
  - thekyle 6y ago
    It's not like only advertisers would benefit from read recipes in email. It would be very useful to know when your friend opens your message, which I assume is why basically every mainstream messaging app has the feature.
    - Nextgrid 6y ago
      Messaging apps make it explicitly clear and offer a way to opt-out. In e-mails it isn't clear at all and unless you're tech-savvy you might not immediately realize that "remote content" means "read receipts". Also, messenger read receipts don't leak your IP address and what kind of client you're using (via the user-agent header) whereas e-mails do.
      - thekyle 6y ago
        In this context, we're talking about RFC 2298, which doesn't leak your IP address and is opt-in. It is completely unrelated to "remote content" settings.
    - ncallaway 6y ago
      > It would be very useful to know when your friend opens your message Sure, it might be useful for them, but I'd still like to have to opt-in to it. If my friend embedded a tracking pixel in my email because I didn't have read receipts and they wanted to know if I'd opened their email, I'd be having a real serious conversation about boundaries and privacy with that "friend". Advertisers that do the same thing are being shitty people, in exactly the same way it'd be shitty if a friend did it. To be clear, I'm not arguing against read receipts. I'm arguing against _working around_ opt-in read receipts.
captainmuon 6y ago
Why would you want to track whether an email is read? That's creepy and obnoxious. Part of the social contract with mail is that it shouldn't matter if you haven't read it yet or if you read it and decide to answer later. Mail is an asyncronous medium and you should respect that and not micromanage your customers IMHO.
- GhostVII 6y ago
  Because if you send emails to people who don't read them, eventually they will flag you as spam (even if they signed up for the emails in the first place), and then you will start getting blocked as spam by Gmail. Also it's generally useful to know if a particular email is read so you can test out different formats and whatnot.
  - forgetfulness 6y ago
    > Because if you send emails to people who don't read them, eventually they will flag you as spam (even if they signed up for the emails in the first place), and then you will start getting blocked as spam by Gmail. Probably because those email newsletters are spam sent to people who interacted with a form once.
  - inetknght 6y ago
    > if you send emails to people who don't read them, eventually they will flag you as spam That's because you're spamming them. > even if they signed up for the emails in the first place Users can change their mind. Clicking anything in an email leads to susceptibility of phishing. So they shouldn't need to click an unsubscribe link to do so. Reporting you for spam is the safest option from their perspective. And I would argue that most users didn't sign up for the emails. They were conned into giving their email and usually for a completely different purpose. > Also it's generally useful to know if a particular email is read so you can test out different formats and whatnot. That's a very dubious assertion. Formats are in the content of the email. Different formats won't tell you why one email was opened while another was not.
    - 6y ago
qwerty456127 6y ago
My e-mail client always tells me the sender wants a read receipt and also asks if I want to load external resources. If yours doesn't let you control this I strongly recommend to look for an alternative.
robinjfisher 6y ago
> "In the UK and the EU, the GDPR requires organisations to inform recipients of the pixels, and in most cases to obtain consent for them. It’s not enough to just have a privacy policy somewhere that details this." No it doesn't and yes it is. Nowhere in the GDPR or in the UK implementation does it say that recipients need to be informed of pixels in and of themselves. What it does say is that when you obtain the recipients' personal details you must provide them with a privacy notice setting out what data you collect and what you do with it. The privacy notice needs to be provided on collection of their data (when directly collected) or within 30 days of collection if from a third party. There is no reason to not obtain consent to tracking but to suggest it's the only lawful basis on which to process the data is not correct. Subject to completion of an impact assessment, one could make a case that it falls under legitimate interests depending on the degree of processing of the tracking data e.g. the more that such data is used to inform further targeting of the individual vs. say aggregation of data for improving engagement. I agree with your underlying point though - I turned off tracking (I use Postmark for transactional emails) because I don't really care about open rate and click rate etc. If my customers want to ignore the emails from the service it's up to them.
- DisjointedHunt 6y ago
  The GDPR delegates the specifics of the requirements to the DPA of member countries. The French CNIL, for example, has already fined Google and Amazon $100M+ for this very issue: https://www.huntonprivacyblog.com/2020/12/14/cnil-fines-google-and-amazon-135-million-euros-for-alleged-cookie-violations/ https://www.huntonprivacyblog.com/2020/12/14/cnil-fines-goog... GDPR is a nightmare and a case study in how regulations can terrorize entire industries or the abilities of individuals to innovate freely. Just read the chronology of events in that link above and try playing devils advocate that the CNIL did not amend those laws to specifically target these two companies. It's scary.
  - alisonkisk 6y ago
    They amended "rules", not "laws", which is what rulemakers do when they discover behaviors that violate the law (subject to interpretation, as intended) but not the rules.
dpedu 6y ago
At the risk of conflating Gmail and email - doesn't gmail download automatically and serve images in emails from a google-owned server? Seems like this would completely defeat this kind of tracking.
- alkonaut 6y ago
  They do. So the big splash image which is the same for everyone gets cached and served from google. The tracking pixel has a unique url per recipient (that’s the point) so can’t be cached.
  - alisonkisk 6y ago
    What do you mean? Google caches the tracking pixel, too, unless the email is executing client-side JavaScript, which is extremely rare.
    - jsmith99 6y ago
      Not OP, but Gmail's use of a proxy prevents them getting your IP address. It doesn't stop marketers getting alerted you read the email.
      - dpedu 6y ago
        I'd expect that google has something significantly more advanced than simply fetching every linked image in an email and storing it separately. Additionally, I'd guess they're doing this ahead of time, before you open the email. But it's a guess.
        plorkyeran 6y ago
        Gmail potentially could defeat tracking pixels by loading all linked images regardless of if the user actually opens the email, but they do not.
        snowwrestler 6y ago
nness 6y ago
This seems completely mute if the user has opted-in to the email in the first place, you can just condition this data-capture in the T&C?
- alisonkisk 6y ago
  No, (it's not a moot point), because GDPR cannot be superseded by T&C.
- albertgoeswoof 6y ago
  Opting into receiving an email is not the same as opting into being tracked by the email. Burying this in T&Cs that no one reads doesn't let the user know this is happening, and continues to violate their privacy.
- finnthehuman 6y ago
  >if the user has opted-in to the email in the first place A burner email address I gave out exactly once to a vendor at defcon 2 years ago has been "opting into" all sorts of new marketing campaigns from many different companies, and as recently as this February. Explain to me how tracking pixels in those emails are consistent with GDPR's informed consent.
the_gipsy 6y ago
Doesn't gmail block this since ever? IIRC gmail doesn't allow any outgoing requests of email stylings. It strips it out or rewrites it to a re-hosted URL.
- jsmith99 6y ago
  It doesn't block them but it proxies them. They can still see that you read it and when.
- mijamo 6y ago
  Email tracking works perfectly with Gmail users. You get get the precise time for when the mail is opened, even for repeated opening. Tested with regular accounts and google workspace. No idea where this rumor came.
fredsted 6y ago
Like most of the problems EU has tried (and failed) to solve with legislation, like cookie laws, this is an issue that is already entirely solved by the client. If you don't like having external images in your emails, most clients these days support turning it off. Whether it's a header image or a "spy pixel", both of these things can be used to track you. Therefore the solution is to disable it entirely if you do not like being tracked.
- eythian 6y ago
  > this is an issue that is already entirely solved by the client No it isn't. What if I want to see the images in an email newsletter, but don't want to be tracked? The client can't give me a button "open images except tracking pixels" because it doesn't have enough information to know the difference.
  - fredsted 6y ago
    >What if I want to see the images in an email newsletter, but don't want to be tracked? That would be nice, but as I already wrote, it's not possible. The only way to have images (or any form of remote resource) in emails, and at the same time avoid tracking, is attaching them.
networkimprov 6y ago
Both hey.com[1] (from the Basecamp folks) and TMTP from the mnm project[2] (proposed successor to SMTP) disallow background downloading of remote URLs. TMTP also specifies Markdown formatting (not HTML), fwiw. [1] https://hey.com https://hey.com [2] https://mnmnotmail.org https://mnmnotmail.org
Proven 6y ago
Who gives a crap. When I want personalized updates, I subscribe. When I don't, I do not subscribe and follow the news using some other method.
atoav 6y ago
I am not using any html emails. People should send me text. If pics are important attach them. External (embedded) pictures are deactivated per default, if you want to get at least a tiny chance I see your picture, attach it or gain my trust (and even then, attach it). JS in mails is completely ignored, it has no business of being there. It would be nice to live in a world where you could trust sizeable companies not to break the law (or my trust) with every other email they send. It would be nice to have html and css in a mail and not have people abuse it. But as things stand now, not using html is the way to go.
denton-scratch 6y ago
Set your mailer to just use text/plain for displaying message bodies. No HTML == no tracking cookies. Any decent mailer will prompt you before sending a read confirmation. Oh, wait - you're using gmail? I'm afraid you're beyond help.

draw_down 6y ago

Yeah, how's that GDPR working out? I feel like it was meant to do more than spur blog posts such as this one

Nextgrid 6y ago
The spirit of it is good, the enforcement has been significantly lacking and the regulators who are supposed to enforce it appear incompetent or unwilling to do so.
- draw_down 6y ago
  Ah, well, as long as the spirit is good.
SiempreViernes 6y ago
You can check here https://www.enforcementtracker.com/ https://www.enforcementtracker.com/
- Nextgrid 6y ago
  That link gets posted all the time, often as a rebuttal to the "no enforcement" claim but the web being littered by non-compliant tracking consent flows clearly shows there is not enough enforcement. As a reminder, I don't believe the majority of consent flows on the web are compliant with the regulation. As per the ICO's guidelines (the UK data protection regulator) https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/ https://ico.org.uk/for-organisations/guide-to-data-protectio...: > Consent requires a positive opt-in. Don’t use pre-ticked boxes or any other method of default consent. > Keep your consent requests separate from other terms and conditions. > Make it easy for people to withdraw consent and tell them how. > Avoid making consent to processing a precondition of a service. The majority of consent flows out there don't comply with at least one of these points, so the fact they're still out there 3 years after the regulation went into effect suggests enforcement is indeed lacking.
Daho0n 6y ago
Not perfect but much much better than before. I can give you two personal examples of how even small stuff that used to be ignored now demand attention: I installed a game that had a bug (opt-in to tracking wasn't working so tracking was always on). Lots and lots of users complained in the game developers forum but nothing happened. Not even a reply. I and a few others wrote emails to the support mail and nothing. Then I threatened with GDPR months later and two days later support was on my case and my data was deleted from both their system and the third party they used for tracking. Here in Denmark businesses aren't allowed to receive updates from the CPR registry (like SSN) if you aren't a customer anymore. It's used for stuff like banks automatically getting your new address if you move. Historically sending mails to those that didn't remove you from their updates didn't do anything. Now they run quickly as soon as they read "GDPR". There are big businesses that get away with things they shouldn't but by far the most problems can now be resolved, even small stuff that big businesses before didn't lift a finger to fix where the little man had no chance in hell. Now they (we!) do.

NDizzle 6y ago

Excessive. I don't care what the EU thinks.

Nextgrid 6y ago
Then you are welcome to opt into tracking. I think the EU's approach of default being "no tracking" is good - you can always decide to opt-in, but the default is safe.
- pc86 6y ago
  Which is fine for companies located in the EU. The EU has absolutely zero authority to tell business located outside of the EU what to do. The fact that someone reading a blog post happens to be in Europe does not all of a sudden put the owner of that blog under EU jurisdiction.
  - lanternfish 6y ago
    But it does put that access transaction under EU jurisdiction, no?
    - snowwrestler 6y ago
      No. A company needs to be legally present in an EU jurisdiction to be exposed to liability under GDPR.
  - OJFord 6y ago
    Of course it does if those businesses want to operate in the EU.
  - deleted 6y ago
    [deleted]
- jpttsn 6y ago
  Life in the EU is wonderful. It’s like waking up every morning wearing a helmet. You can take the helmet off at any time, but the default is safe.

n3storm 6y ago

While I support projects like ohmysmtp.com, I don't like the misinformation the post contains. There is not a single MUA that does not block, alert, warn user when hidden pixel is found, and also when any link in the message doesn't start with https...

proactivesvcs 6y ago
Not sure why you're being downvoted - I can't remember coming across an email client that doesn't support this, and many seem to do it by default these days.
- mijamo 6y ago
  Gmail does not. And even those who do are not warning you about the tracking part, only about loading resources. Most users will just think that they want to see the nice images and accept and have no idea that it means they are tracked.

gwd 6y ago

> "Thanks for opening this email. We’ve logged that you read it, we’ll log again next time you open the email. We know where you’re located, and what device you’re on. We’re using this information to tweak our emails to get you to open and read more of our emails in the future" Nice

Spivak 6y ago
I think the paragraph after it kinda undermines their thesis though. There's nothing meaningfully different about an email and a website. They're both documents that you render locally on your client. The delivery mechanism doesn't really matter. You would probably find it really weird that a NYT article archive HTML page you have on your machine still tracks you because you client runs the JS if it wasn't already the norm. But then why does downloading that same document on-demand change your expectation of being tracked? Or if we were in a alternate universe where web pages were hyperlinked PDFs I bet you would find it odd that opening one in Acrobat sends all your interactions to some server somewhere. It's fine that by convention we have some places where it's not kosher to track people but we at least have to admit that the distinction is arbitrary and that being upset about email tracking but not website tracking is inherently inconsistent. Because sure you can name differences between emails and websites but nothing really fundamental.
- mijamo 6y ago
  It is fundamentally different because when I track and email I know who I'm tracking and I will look at the data on and individual basis. For instance "great, that client has opened my contract email 5 times. Means they are interested.I can adapt my negotiating position based on that". For websites I would look as the data in aggregate. Sure that aggregation can be pretty precise but still it is not on the personal level. I suppose technically speaking you could checks the individual use of a website for logged in users but even Google Analytics is very explicit on hat not being OK for instance, and there is no UI for it in any tool that I know.

ddevault 6y ago

>Do you send emails through a service that let’s you see if the email was opened? No.

ryandrake 6y ago

The sad thing is we already have a privacy friendlier alternative to spy pixels: Read Receipts, defined in RFC 2298. They are already user opt-in. Don’t most mail agents support them?

ncallaway 6y ago
Sure, but most users don't or won't opt in to those, so the advertisers want to find a way to track people that isn't opt-in.
- thekyle 6y ago
  It's not like only advertisers would benefit from read recipes in email. It would be very useful to know when your friend opens your message, which I assume is why basically every mainstream messaging app has the feature.
  - Nextgrid 6y ago
    Messaging apps make it explicitly clear and offer a way to opt-out. In e-mails it isn't clear at all and unless you're tech-savvy you might not immediately realize that "remote content" means "read receipts". Also, messenger read receipts don't leak your IP address and what kind of client you're using (via the user-agent header) whereas e-mails do.
    - thekyle 6y ago
      In this context, we're talking about RFC 2298, which doesn't leak your IP address and is opt-in. It is completely unrelated to "remote content" settings.
  - ncallaway 6y ago
    > It would be very useful to know when your friend opens your message Sure, it might be useful for them, but I'd still like to have to opt-in to it. If my friend embedded a tracking pixel in my email because I didn't have read receipts and they wanted to know if I'd opened their email, I'd be having a real serious conversation about boundaries and privacy with that "friend". Advertisers that do the same thing are being shitty people, in exactly the same way it'd be shitty if a friend did it. To be clear, I'm not arguing against read receipts. I'm arguing against _working around_ opt-in read receipts.

captainmuon 6y ago

Why would you want to track whether an email is read? That's creepy and obnoxious. Part of the social contract with mail is that it shouldn't matter if you haven't read it yet or if you read it and decide to answer later. Mail is an asyncronous medium and you should respect that and not micromanage your customers IMHO.

GhostVII 6y ago
Because if you send emails to people who don't read them, eventually they will flag you as spam (even if they signed up for the emails in the first place), and then you will start getting blocked as spam by Gmail. Also it's generally useful to know if a particular email is read so you can test out different formats and whatnot.
- forgetfulness 6y ago
  > Because if you send emails to people who don't read them, eventually they will flag you as spam (even if they signed up for the emails in the first place), and then you will start getting blocked as spam by Gmail. Probably because those email newsletters are spam sent to people who interacted with a form once.
- inetknght 6y ago
  > if you send emails to people who don't read them, eventually they will flag you as spam That's because you're spamming them. > even if they signed up for the emails in the first place Users can change their mind. Clicking anything in an email leads to susceptibility of phishing. So they shouldn't need to click an unsubscribe link to do so. Reporting you for spam is the safest option from their perspective. And I would argue that most users didn't sign up for the emails. They were conned into giving their email and usually for a completely different purpose. > Also it's generally useful to know if a particular email is read so you can test out different formats and whatnot. That's a very dubious assertion. Formats are in the content of the email. Different formats won't tell you why one email was opened while another was not.
  - 6y ago

qwerty456127 6y ago

My e-mail client always tells me the sender wants a read receipt and also asks if I want to load external resources. If yours doesn't let you control this I strongly recommend to look for an alternative.

robinjfisher 6y ago

> "In the UK and the EU, the GDPR requires organisations to inform recipients of the pixels, and in most cases to obtain consent for them. It’s not enough to just have a privacy policy somewhere that details this." No it doesn't and yes it is. Nowhere in the GDPR or in the UK implementation does it say that recipients need to be informed of pixels in and of themselves. What it does say is that when you obtain the recipients' personal details you must provide them with a privacy notice setting out what data you collect and what you do with it. The privacy notice needs to be provided on collection of their data (when directly collected) or within 30 days of collection if from a third party. There is no reason to not obtain consent to tracking but to suggest it's the only lawful basis on which to process the data is not correct. Subject to completion of an impact assessment, one could make a case that it falls under legitimate interests depending on the degree of processing of the tracking data e.g. the more that such data is used to inform further targeting of the individual vs. say aggregation of data for improving engagement. I agree with your underlying point though - I turned off tracking (I use Postmark for transactional emails) because I don't really care about open rate and click rate etc. If my customers want to ignore the emails from the service it's up to them.

DisjointedHunt 6y ago
The GDPR delegates the specifics of the requirements to the DPA of member countries. The French CNIL, for example, has already fined Google and Amazon $100M+ for this very issue: https://www.huntonprivacyblog.com/2020/12/14/cnil-fines-google-and-amazon-135-million-euros-for-alleged-cookie-violations/ https://www.huntonprivacyblog.com/2020/12/14/cnil-fines-goog... GDPR is a nightmare and a case study in how regulations can terrorize entire industries or the abilities of individuals to innovate freely. Just read the chronology of events in that link above and try playing devils advocate that the CNIL did not amend those laws to specifically target these two companies. It's scary.
- alisonkisk 6y ago
  They amended "rules", not "laws", which is what rulemakers do when they discover behaviors that violate the law (subject to interpretation, as intended) but not the rules.

dpedu 6y ago

At the risk of conflating Gmail and email - doesn't gmail download automatically and serve images in emails from a google-owned server? Seems like this would completely defeat this kind of tracking.

alkonaut 6y ago
They do. So the big splash image which is the same for everyone gets cached and served from google. The tracking pixel has a unique url per recipient (that’s the point) so can’t be cached.
- alisonkisk 6y ago
  What do you mean? Google caches the tracking pixel, too, unless the email is executing client-side JavaScript, which is extremely rare.
  - jsmith99 6y ago
    Not OP, but Gmail's use of a proxy prevents them getting your IP address. It doesn't stop marketers getting alerted you read the email.
    - dpedu 6y ago
      I'd expect that google has something significantly more advanced than simply fetching every linked image in an email and storing it separately. Additionally, I'd guess they're doing this ahead of time, before you open the email. But it's a guess.
      - plorkyeran 6y ago
        Gmail potentially could defeat tracking pixels by loading all linked images regardless of if the user actually opens the email, but they do not.
      - snowwrestler 6y ago

nness 6y ago

This seems completely mute if the user has opted-in to the email in the first place, you can just condition this data-capture in the T&C?

alisonkisk 6y ago
No, (it's not a moot point), because GDPR cannot be superseded by T&C.
albertgoeswoof 6y ago
Opting into receiving an email is not the same as opting into being tracked by the email. Burying this in T&Cs that no one reads doesn't let the user know this is happening, and continues to violate their privacy.
finnthehuman 6y ago
>if the user has opted-in to the email in the first place A burner email address I gave out exactly once to a vendor at defcon 2 years ago has been "opting into" all sorts of new marketing campaigns from many different companies, and as recently as this February. Explain to me how tracking pixels in those emails are consistent with GDPR's informed consent.

the_gipsy 6y ago

Doesn't gmail block this since ever? IIRC gmail doesn't allow any outgoing requests of email stylings. It strips it out or rewrites it to a re-hosted URL.

jsmith99 6y ago
It doesn't block them but it proxies them. They can still see that you read it and when.
mijamo 6y ago
Email tracking works perfectly with Gmail users. You get get the precise time for when the mail is opened, even for repeated opening. Tested with regular accounts and google workspace. No idea where this rumor came.

fredsted 6y ago

Like most of the problems EU has tried (and failed) to solve with legislation, like cookie laws, this is an issue that is already entirely solved by the client. If you don't like having external images in your emails, most clients these days support turning it off. Whether it's a header image or a "spy pixel", both of these things can be used to track you. Therefore the solution is to disable it entirely if you do not like being tracked.

eythian 6y ago
> this is an issue that is already entirely solved by the client No it isn't. What if I want to see the images in an email newsletter, but don't want to be tracked? The client can't give me a button "open images except tracking pixels" because it doesn't have enough information to know the difference.
- fredsted 6y ago
  >What if I want to see the images in an email newsletter, but don't want to be tracked? That would be nice, but as I already wrote, it's not possible. The only way to have images (or any form of remote resource) in emails, and at the same time avoid tracking, is attaching them.

networkimprov 6y ago

Both hey.com[1] (from the Basecamp folks) and TMTP from the mnm project[2] (proposed successor to SMTP) disallow background downloading of remote URLs. TMTP also specifies Markdown formatting (not HTML), fwiw. [1] https://hey.com https://hey.com [2] https://mnmnotmail.org https://mnmnotmail.org

Proven 6y ago

Who gives a crap. When I want personalized updates, I subscribe. When I don't, I do not subscribe and follow the news using some other method.

atoav 6y ago

I am not using any html emails. People should send me text. If pics are important attach them. External (embedded) pictures are deactivated per default, if you want to get at least a tiny chance I see your picture, attach it or gain my trust (and even then, attach it). JS in mails is completely ignored, it has no business of being there. It would be nice to live in a world where you could trust sizeable companies not to break the law (or my trust) with every other email they send. It would be nice to have html and css in a mail and not have people abuse it. But as things stand now, not using html is the way to go.

denton-scratch 6y ago

Set your mailer to just use text/plain for displaying message bodies. No HTML == no tracking cookies. Any decent mailer will prompt you before sending a read confirmation. Oh, wait - you're using gmail? I'm afraid you're beyond help.