what is a tracking pixel how do tracking pixels work meta pixel tracking pixel email online tracking web privacy

What is a tracking pixel? How the invisible image tracks you

Adrian Maverick · · 9 min read

There is probably an image on most pages you visit today that you will never see. One pixel wide, one pixel tall, usually transparent. It does nothing for you. It exists to tell a company that you arrived, when, and on what device.

A tracking pixel is a tiny, usually invisible image or snippet of code embedded in a web page or email. When your device loads it, it sends a request to a tracking server, which logs your IP address, device, the time, and often a unique ID tied to you. It fires automatically, with no click needed.

Most explanations of tracking pixels are written for the marketers who install them. This one is written for the person being tracked: how the trick works, who ends up with the data, and how to watch one fire in your own browser.

How do tracking pixels work?

A tracking pixel works by exploiting how browsers and mail apps load images. The pixel is a line of HTML pointing at an image file on someone else's server. Your device sees the reference and fetches the file, the way it fetches every picture. To fetch it, your device has to introduce itself.

That request carries:

  • Your IP address, which maps to your rough location and your internet provider.
  • Your device and browser, including operating system and language.
  • A timestamp for when you loaded the page or opened the email.
  • Usually a unique ID in the image address, so the server knows it was you specifically.

The image that comes back is worthless to look at, often a single transparent pixel. The picture is the bait. The request is the catch.

On websites, the "pixel" is often a small JavaScript snippet that sends richer data, with a plain image tag as a fallback for browsers that block scripts. The name stuck from the image version.

See one fire in your own browser

You do not have to take anyone's word for this. On a desktop browser:

  1. Open a large online store or news site.
  2. Press F12 (or Cmd+Option+I on a Mac) to open developer tools, and click the Network tab.
  3. Reload the page and type facebook.com/tr into the filter box. Each line is the Meta Pixel reporting an event, often PageView. Now try collect, which usually catches Google Analytics requests.
  4. Click any matching request and look at its parameters. You will typically see the page address you are on, an event name, and an ID.

If nothing shows up, either the site does not use those trackers or your browser or an extension already blocked them. Both are good outcomes. When it does show up, you are watching a third party learn what page you are reading, in real time.

What is a Facebook (Meta) tracking pixel?

The Meta Pixel is the best-known website pixel. In Meta's developer documentation, it is code a business adds to its site to record "standard events," such as viewing content, searching, adding to cart, or purchasing. Those events flow into Meta's ad system. Meta's docs describe what happens once a business builds custom audiences from those tracked conversions: "we can use them to identify other Facebook users who are likely to convert and target them with your ads."

That is the machinery behind two things you have seen. Retargeting, where a product you looked at follows you around the web. And lookalike audiences, where Meta finds people who behave like you and shows them the same ads. Google, TikTok, and others run their own versions.

What is an email tracking pixel?

In email, the pixel is simpler and more personal. The sender puts a unique invisible image in the message. When your mail app loads it, the sender learns you opened it, roughly when, roughly where, and on what device. Marketers call it an open rate. It also quietly confirms your address is real and read.

The settings to shut that down are different in every mail app, so we wrote a separate, step-by-step guide on how to stop email tracking in Gmail, Outlook, Apple Mail, and Thunderbird.

Who actually gets the data?

The tidy definitions leave one impression in place: that the pixel reports to the website you visited. Often it reports to a third party, an ad network or analytics company, not the site you are on. The site pastes in the tracker. The data goes to the tracker's owner.

That matters because the same few companies have pixels on a huge share of the web. When one company's pixel sits on the shoe store, the news site, the pharmacy, and the airline, it does not see four unrelated visits. It sees one person, linked by an ID or cookie, moving from shoes to news to medication to travel. You never handed anyone that profile. You loaded some pages.

Real cases: hospital and tax sites sent data to Meta

If that sounds abstract, it has been documented. The Markup, a nonprofit newsroom, ran a multi-year investigation it called the Pixel Hunt.

In June 2022, The Markup tested the websites of Newsweek's top 100 hospitals and found the Meta Pixel on 33 of them, sending information such as appointment details, doctors' names, and search terms to Facebook, alongside IP addresses. On seven health systems the pixel sat inside password-protected patient portals, and on five of those The Markup documented real patients' medication names and details about allergic reactions being sent. The 33 hospitals together reported more than 26 million patient admissions and outpatient visits in 2020.

In November 2022, The Markup reported that tax-filing sites including H&R Block, TaxAct, and TaxSlayer were sending Facebook financial details through the pixel, such as income, filing status, and refund amounts. A congressional investigation followed, and in July 2023 lawmakers concluded the tax-prep companies and Meta had "recklessly" shared taxpayers' data. Whether this kind of tracking is legal is now being fought in court; we covered that in are tracking pixels illegal.

Tracking pixel vs cookie: what is the difference?

A cookie is a small file your browser stores so a site can recognize you later. A tracking pixel is a request that fires the instant content loads and reports back right away. They usually work together: the pixel reads or sets a cookie to link your visits over time. But a pixel still captures your IP address, device, and timing where cookies are blocked or do not exist, which is why pixels are the standard tool in email.

How to block tracking pixels

  1. Install a content blocker. A reputable blocker such as uBlock Origin stops known tracking pixels and scripts from loading. Run the DevTools test again afterward and the facebook.com/tr requests should be gone.
  2. Use a browser that blocks cross-site trackers by default. Firefox, Brave, and Safari all ship tracking protection. Choose the stricter setting.
  3. Reject marketing cookies on consent banners. "Reject all" often disables the marketing pixels the site wanted to fire.
  4. Stop your inbox from loading remote images automatically. That is the whole fix for email pixels, covered client by client in the guide linked above.
  5. Clear or partition cookies. Pixels rely on cookies to link visits over time. A browser that isolates cookies per site breaks that thread. If you want to go further, fingerprinting is the next technique to deal with; see how to stop browser fingerprinting.

Where your email provider fits

On the web you are playing defense with extensions. In email, the provider decides a lot for you. In Secria Mail, images that behave like tracking pixels (1 by 1 or hidden) are stripped before a message is shown, and the sender never sees your IP address. There is nothing to configure, and it is on for every plan, including the free one.

Pixels are only the outside watchers. Your mail provider could be the bigger one if it reads your inbox to profile you. Secria stores your mail under zero-access encryption, sealed with keys we never hold, so we cannot read it to build a profile, and we cannot hand readable copies to an advertiser or a court.

Frequently asked questions

Are tracking pixels harmful?

The pixel itself cannot infect your device. The harm is what it reports: your visits and email opens, linked into a profile by a third party. The Markup's hospital and tax investigations show how sensitive that data can get.

Can you tell if a website has a tracking pixel?

Yes. Use the DevTools test above, or a blocker extension that lists what it blocked on each page. Both show the tracker's domain.

Do tracking pixels work if I block cookies?

Partly. The request still carries your IP address, device details, and timing. Blocking cookies makes it harder to link your visits across days, but it does not stop the pixel from firing.

Can you block every tracking pixel?

Not every one. A site can route tracking through its own servers to slip past blockers. A content blocker, a tracker-blocking browser, and no automatic images in email still stop the large majority.

The pixel works because you cannot see it. Now you know where to look, and the fixes take about ten minutes.

Sources

Secria fact-checks every post against primary sources. Spotted something wrong or out of date? Email hq@secria.me and we will correct it.

Back to all posts