Get your inbox officially a-rockin', and tell email trackers not to bother knockin'.
Data is worth a mint, and unsurprisingly, there's now a very long line of companies dreaming up sly ways to get their sweaty fingers on it. One of the more recent additions to the ever-growing list of data-ruses is the "email protection service". In summary, you give a self-styled and completely unaudited "pRiVaCy BrAnD" access to your entire email flow, and they remove the trackers before sending the email to your inbox.
This would be a fantastic idea if you could actually trust tech companies. Unfortunately, however, tech companies are among the least trustworthy entities in the entire universe, and self-styled "pRiVaCy BrAnDs" are no exception. In fact, the only two things you can ever trust self-styled "pRiVaCy BrAnDs" to do are...
- Collect and exploit data.
- Pretend that they don't.
It's therefore most unwise to use "email protection" services. You're allowing a totally unnecessary and totally opaque third-party unrestricted access to your mail stream. And if the "protection" service is free, the only thing the service provider can possibly monetise is your data.
But don't worry. Blocking email trackers on your own device, without releasing your email flow to any third party, is fast, simple and reliable.
All you need is the uBlock Origin browser extension, and a tiny bit of nifty customisation knowledge.
This post is additionally going to explain the process behind email tracking and look at the issue of whether or not you can plausibly deny opening an email when tracking is NOT blocked. This is important information, but if you only want to know how to set up the block and get it done, you can skip down to the heading "BLOCKING THE TRACKERS".
Let's start with a brief explanation of how the simple process of email tracking works...
HOW EMAIL TRACKING WORKS
There are two main types of email tracking. Media-based, and click-based.
Click-based tracking simply involves the tracker dropping a tracked hyperlink into the email, and trying to bait you into clicking it. If you click the link, you visit the target destination, show up as a site visitor, and are recorded by any intermediate tracker domains. Because tracker links have a unique code in their URL, the tracker is able to match the click with your specific email, so they know the response was yours, and not someone else's. But if you don't click the link, or engage with anything in the email itself, you can't be tracked by click-based tracking. It can only track people who engage.
Media-based tracking is much more powerful. The sender embeds some type of media content into the email, as a hotlink. It could be an illustration, a video, an audio file, a brand logo glyph, or a so-called "clear gif" - which is designed to be invisible to the recipient. When you open the email, the embedded content loads, creating a network call to the tracker's server, which then logs the event, along with a timestamp, your IP address, etc. Simplistically, the tracker knows the email was opened, and it knows when it was opened. You, the recipient, don't have to take any action at all beyond opening the email.
There may be more than one piece of media content in an email, and the units may be located on different servers - potentially belonging to a range of different companies, all of whom want to spy on you. There are emails with double digits of trackers in them. Twenty is not particularly unusual.
It's also possible for one piece of tracker-content to pass its hotlink URL through multiple domains, allowing multiple companies to spy on you without the need to load more than one piece of content.
Although any type of media content can potentially serve as an email tracker, a single-pixel "clear gif" (often also known as a "pixel", a "web beacon" or a "web bug") is the classic, traditional email tracking mechanism.
One reason the clear gif has become the default is that the media is undetectable to the recipient's naked eye. But clear gifs are additionally ideal for mass tracking because they barely take up any space on the sender's server, and they thus fulfil briefs like bandwidth economy and ease of storage in high-volume duplicate. Duplicating the image to a volume of different URLs was the traditional method of uniquely identifying the specific email that was opened. But unique user identification can also be achieved through other means.
Why a gif, and not a jpg or a png? Because gifs are technically video, so they don't get blocked by image blockers. If you natively block images in Chrome or Chromium-based browsers, gifs will still get through.
When people or privacy policies refer to a "web beacon", "pixel" or "clear gif", they're talking about an extremely small, transparent, embedded media file.
Our system will block any typical type of email tracker embed.
HOW RELIABLE IS THE PROOF THAT I OPENED AN EMAIL WITHOUT BLOCKING?
Good question! In itself, a hotlink hit on the sender's server doesn't prove you opened the email. It only proves the media was loaded. Since there are means by which the media could have been loaded by automated software at your end, you can plausibly deny opening the email up to a point.
This remains fairly easy if you only opened the email once, shortly after its arrival, and you didn't interact with it beyond simply reading it.
However, if you further interact with the email, reopen it several times, or forward it, it becomes much harder to deny opening it. If, for example, you clicked a tracked link in the email and then forwarded it to a friend - who also opened it - it becomes pretty obvious that you read it. Also, if you left the email in your inbox three weeks before opening it, the timestamp on the sender's server will correspond much more logically with a human read than an automated screening load, which would normally happen immediately upon receipt.
BLOCKING THE TRACKERS
To block email trackers without using any remote services, all you need to do is reliably block images and media for the specific domain your email reader uses.
You can do this in any browser which has compatibility with the extension uBlock Origin.
If you don't already have uBlock Origin installed as a browser extension, install it. It's reputable among serious privacy advocates, and it runs on the client side, so if you monitor your network you can see for yourself that it's well-behaved.
To set up the email tracker block, open up the uBlock Origin Dashboard and navigate to the My filters pane. You need to add two lines of code into this pane, which will differ, depending on the email service you use.
I'm going to quote the code as a template, based on an example email service. Here are the two lines, ready to paste into My filters...
||*^$image,domain=mail.example.com,important
||*^$media,domain=mail.example.com,important
Here's how things should look...
Once you've pasted these lines into My filers, you need to change mail.example.com to match the domain of your own email service.
HOW DO I KNOW WHAT THE DOMAIN IS?
Load your email service.
The domain will be whatever you see in your browser's address bar after the https://, and before the next forward slash.
So if, when you use your email service, your address bar says https://mail.yahoo.com/b/blahblahblah, the domain will be mail.yahoo.com. After modification, the code in uBlock Origin's My filters pane will thus be...
||*^$image,domain=mail.yahoo.com,important
||*^$media,domain=mail.yahoo.com,important
Once you've changed the domain on both lines, hit the Apply changes button.
Done. Your inbox is now officially a-rockin', and you're telling email trackers not to bother knockin'.
And now you don't have Duckrosoft or any other Big Tech-schmoozin' 'pRiVaCy ToOl PrOvIdEr' combing through your mail for bounty that their Silicon Valley partners can flog to their good friends the police.
PROTONMAIL WARNING!
Be aware that the Protonmail / Proton email service tries to be clever, and can end up bypassing your blocking regime, which actually makes its privacy worse.
ProtonMail / Proton - which I wouldn't recommend as a privacy guard but I know a lot of anti-surveillance people use - has an image blocking feature which is enabled by default. If you click the Load button to load the images, then rather than simply loading the images from their source domains the service will proxy them. Essentially, fetch them behind your back, and then serve them to you via a script.
So even if you have a solid media block set up, hitting Proton's Load button will create a hit on the tracker's server. It has to. That's the only way Proton can obtain the images to show you. The hit should not give the tracker your IP address, but it can still potentially tell the tracker that you opened the email.
And worse, this means your interaction is going through Proton's servers, which allows Proton itself to log your action. This would not be the case when the email provider simply leaves the embed alone. With a service like Yahoo, which works without JavaShit (yes, take note all ye "pRiVaCy TeCh" brands - that IS still possible), the email provider does not have to know whether the tracking embeds loaded or not.
Thankfully, Tutanota doesn't replicate Proton's facepalm of a proxying practise, so the method described in this post remains sound within Tutanota. But for some inexplicable reason Tutanota can't manage to attain basic freedom from THE WORST SURVEILLANCE PROTOCOL ON THE WEB (alias JavaScript). The brand should be suitably embarrassed by the fact that both Gmail and Yahoo will still work JavaScript-free.
I CAN'T SEE THE PICTURES!
Good. If the block is working as it should, you won't be able to see media in emails, but media will display as normal everywhere else on the Web. You are making a sacrifice, but nothing like as great a sacrifice as pushing all your mail through Duckrosoft or some equivalent "email protection service".
CAN I STILL BE TRACKED ONCE I'VE HARD-BLOCKED IMAGES WITH UBLOCK?
Irrepressible stalkers will always find ways to stalk people. That's why even the commercial email protection services won't guarantee 100% protection. But blocking images and media across your email domain will wipe out the vast majority of email tracking.
It is still feasible that the odd email-opening could be tracked, but that would be the case even if you used a professional "protection" service.
Be acutely aware of any sign that images are loading within an email. If you can see images, the block is somehow being bypassed (as was the case with Proton), or is not set up correctly. Check, in particular, the the My filters tick box is ticked in uBlock's Filter lists pane. The box should be ticked by default, but you may have unticked it by accident. You can use that tick box if for any reason you want to disable your blocking and see the images in an email.
If you don't see media in emails, even when you load it, your privacy protection, within emails at least, is strong.