i’m getting a lot of emails from my bank and other services that make me aware that they use tracking pixels in emails. apparently they are obliged by the privacy regulator that is enforcing a recent EU directive. i didn’t even know that i was sending ip and client info simply by reading my emails in thunderbird or k9 on my mobile. is there a way to deactivate these? and is there a risk that by doing so the bank thinks the email is compromised or non existant. its incredibile to see how sophisticated data hoovering technology has become. the internet has become a real mess …
How does it work? Like a read receipt? I thought the likes of thunderbird were essentially offline after initial loading?
I have all of my email clients set to not load internet content. Probably why one of my banks, Navy Federal, keeps saying my email address is invalid despite the fact I get their emails.
Never load images in emails 😘
Set your client to not download/show embedded images, so only the text part gets loaded.
Most email clients don’t fetch remote resources like images embedded in emails unless you specifically ask them to. If you’re seeing pictures in your emails without having to tap something extra after opening the email, you likely need to change your settings.
As someone else pointed out, FairEmail for android additionally blocks tracking pixels even if you want to load other images.
Loading other images or resources can still track you. For example, rather than using a tracking pixel, a company could create (let’s be honest, generate 🙄) a unique image for each email campaign they do, and make that a visually important part of the email, such as a title banner, and then track who loads that to see who opened the email. They could even add tracking metadata to the URL like
https://example.com/email-resources/october-newsletter-header.jpg?user=your-email%40your-domain.comimages attached to the email can also be embedded, which I think most clients will show by default. those don’t have privacy implications as they don’t need extra network requests.
Good point
I think the best way is to disable loading of external content in your email client, but I’m not 100% sure.
Damn me for clicking on “load external content” then. I thought i wasjust downloading images … ignorance is humanities biggest problem and surely mine …
I thought i wasjust downloading images
That’s all tracking pixels are, and any image can be used to track you.
But from now on they’ll get shit 💪
I think Thunderbird by default does not load external content. Mine always warns me whether I want to allow for remote content when I open a new email, and possibly whether I want to always allow it for a particular sender. I never do.
Check the settings, and possibly reset that option.
There are add-ons (and i think there even is a setting option noe) to not load html but display the message in Plain Text: Allow HTML Temp.
Highly recommend to just show(and use) plain text.
Yes, plain text is the way to go. Advertising, special offer, promotion emails, reminders from brands you have subscribed to etc filter themselves out in to two categories when you see only text: those who bother to use words to tell you something (and might be worth reading), or brands whose emails contain virtually nothing (apart from a handy unsubscribe link) once the pretty pictures have been expunged.
Indeed, there is a built-in setting to show messages as ‘original html’ or ‘simplified html’ or ‘plain text’.
But even if you choose ‘original html’, external elements are not downloaded, unless you positively answer the warning (above the message) to download them. Any images you might still see are embedded in the message itself, not externally downloaded.
FairEmail shows these kind of pixels very obviously and gives customisation options too.
Email aliasing services, which are genuinely good services to use, strip those pixels from inbound emails. At least Firefox Relay, Addy and SimpleLogin do
Would something like pihole also strip out all this crap? I’ve been meaning to get it on my network for a while.
I’m not too sure, maybe? If the tracking pixel is on a domain known to serve ads or trackers, it might, but if it’s on a legitimate domain (e.g. your ISP’s) I don’t think it can, since you’d have to have added the ISP’s domain to the Pi-hole blacklist
