how to stop email tracking block email tracking pixels stop email tracking gmail block email tracking outlook email privacy tracked links

How to stop email tracking in Gmail, Outlook, and Apple Mail

Adrian Maverick · · 9 min read

Open a marketing email and, before you have read a word, the sender often knows you opened it, when, and roughly where you were. That is a tracking pixel at work, and in most mail apps the off switch is a single setting.

To stop email tracking, turn off automatic loading of remote images in your mail app. A tracking pixel is a remote image, so if images wait for your permission, the pixel never reports your open, time, or IP address. Then stop clicking wrapped links, because blocking images does nothing against click tracking.

Below: the setting for each major client, a quick test to see a tracker in a real email, and the two places the popular advice gets it wrong.

How email tracking works, in two sentences

A sender hides a tiny image with a unique address in the message, and when your app fetches it, their server logs the open along with your IP address and device details. (Our explainer on what a tracking pixel is covers the mechanics and who ends up with the data.)

Step 1: Turn off image loading in your mail app

Gmail (web). Click the gear, then See all settings. On the General tab, find Images and choose "Ask before displaying external images." Scroll down and save. Gmail now asks before loading anything remote, and you can load images per message for senders you trust.

Gmail (Android and iPhone app). Tap the menu, then Settings, pick your account, then Images, and choose "Ask before displaying external images."

Apple Mail (iPhone and iPad). Go to Settings, then Apps, then Mail, then Privacy Protection. "Protect Mail Activity" hides your IP address and pre-loads content for every message. For a hard block, turn Protect Mail Activity off, then turn on "Block All Remote Content" and keep "Hide IP Address" on.

Apple Mail (Mac). Choose Mail, then Settings, then Privacy. Deselect "Protect Mail Activity," then select "Block All Remote Content" and keep "Hide IP Address" selected.

Outlook (classic desktop app). Microsoft says classic Outlook blocks automatic picture downloads by default. To confirm, go to File, Options, Trust Center, Trust Center Settings, Automatic Download, and make sure "Don't download pictures automatically in HTML e-mail messages or RSS items" is ticked.

Outlook.com and the new Outlook. Open Settings, then Mail, and look for the external images option. Choose the strictest setting available so external images are not loaded automatically.

Thunderbird. Open Settings, then Privacy and Security, and uncheck "Allow remote content in messages." Thunderbird then shows a bar that lets you load content for senders you trust.

That handles opens. A couple of minutes, once per app.

Step 2: Check it worked (the 2-minute test)

Most guides stop at the setting. It is worth seeing a tracker with your own eyes once, because it makes the rest of this obvious.

  1. Pick a recent newsletter or a shop's promo email.
  2. Open the raw source. In Gmail, open the message, click the three dots, then "Show original." In Apple Mail on a Mac, choose View, then Message, then Raw Source. In Thunderbird, press Ctrl+U (Cmd+U on a Mac). In Outlook on the web, open the three dots, then View, then "View message source."
  3. Search the source for height. Raw email often encodes the equals sign as =3D, so a pixel can look like width=3D"1" height=3D"1" rather than the tidy HTML you would expect.
  4. Look for an <img> tag that is 1 by 1, set to display:none, or pointing at a long random-looking address on a mailing service's domain. That random string is usually your personal ID.

If you find one, you are looking at the thing that would have told the sender you opened this email. With image loading off, it just sits there, unfetched.

Step 3: Know what a proxy does and does not do

This is where a lot of advice, including some from blocker vendors, blurs two different protections: hiding your IP and hiding the open.

Does Gmail block tracking pixels? Not on its default setting. Gmail fetches remote images through Google's own proxy and caches them. That hides your IP address and rough location from the sender, which is useful. But the pixel still loads, so an open still registers. The email deliverability site Suped puts it plainly: if the pixel address is unique to you, "the first proxied request can still support unique-open reporting." Only "Ask before displaying external images" stops the open.

Does Apple Mail Privacy Protection stop tracking? It blunts it. With Protect Mail Activity on, Mail loads remote content for every incoming message in the background, through Apple's relay, whether or not you read it. That makes "opened" meaningless as a signal and keeps your IP hidden. It only works inside Apple Mail, though, and Apple says it "does not extend to links or email attachments." In some setups, such as certain VPN configurations, Mail cannot load content privately and asks you first.

The rule of thumb: a proxy hides your address, a block stops the fetch. If you want the sender to learn nothing, choose the block.

Step 4: Stop tracked links from reporting your clicks

Turning off images kills the pixel. It does nothing to the links, and this is the gap most "block email tracking" guides leave open.

Most newsletter and marketing links point at a redirect on the sender's mailing platform first. Click "Read more" and the redirect logs the click against your personal ID, then forwards you to the real page. You made that request by clicking, so no image setting can stop it.

  1. Preview before you click. Hover on desktop, or long-press on mobile. A link on a domain like click. or track. or links. something, with a long random path, is a tracked redirect.
  2. Go direct for anything that matters. Type the site's address or search for the page instead of clicking the wrapped link.
  3. Use a link cleaner. Some privacy browser extensions strip tracking parameters and unwrap known redirect domains automatically.
  4. Be careful with unsubscribe links from senders you never signed up with. A click confirms your address is live. For obvious spam, report it as spam instead.

Step 5: Change the default, not just the setting

Every step above is a setting you find, flip, and then find again on the next device or app. That is the real reason tracking works so well: it is on by default and the off switch is buried.

The other fix is a mail provider that treats trackers as a problem to remove rather than a feature to support. In Secria Mail, images that behave like pixels (1 by 1 or hidden with CSS) are stripped before the message is shown, and the app tells you how many it removed. Senders never see your IP address or where you are. When we built that renderer, the point was that nobody should need the raw-source test above to be safe. It works the same way on the free plan.

Pixels are the outside trackers. The other question is whether the provider holding your inbox reads it. Secria stores mail under zero-access encryption, sealed with keys we never hold. If you want the rest of the checklist, including aliases and encryption, see how to make your email more private.

Frequently asked questions

Can I tell if someone opened my email without a tracker?

Not reliably. Without a pixel or a read receipt, a sender has no signal that you opened a message. Read receipts in Outlook and some business tools ask your permission first, and you can decline them.

Does blocking images break my emails?

Newsletters and receipts that lean on images will look plain until you load them. The text, links, and attachments are unchanged, and you can load images for a single message from a trusted sender with one tap.

Is email tracking legal?

It depends where you live. European regulators have been pushing senders to get consent before tracking opens, and US courts are split on whether tracking pixels break wiretap laws. We covered the US fight in are tracking pixels illegal.

Does a VPN stop email tracking?

It hides your real IP address from the pixel's server, so the sender learns less about where you are. The open still registers. To stop the open itself, you still need to block remote images.

Turn off automatic image loading today, run the raw-source test once, and treat wrapped links with suspicion. That covers most of the tracking in a normal inbox.

Sources

Secria fact-checks every post against primary sources. Spotted something wrong or out of date? Email hq@secria.me and we will correct it.

Back to all posts