You open a shop's newsletter at 10:14 pm on your phone, click on a pair of shoes and close it. The sender very probably knows all of this: the time you opened it, the type of device, sometimes your approximate city, the link you clicked. Email feels like a private channel between you and whoever writes to you, but commercial messages are often designed to measure your behaviour.
How email tracking works
The open pixel
Many graphic emails contain a tiny, invisible image loaded from a server belonging to the sender or the platform running the newsletter. When your email program downloads the images, it contacts that server using a unique address linked to you: at that moment the sender records that you opened the message, when and with what type of device.
Personalised links
The links in a newsletter often do not lead straight to the website, but first pass through a redirect address that contains an identifier for you. That way the sender knows which link you clicked and can link your subsequent visit to the website with your subscriber profile.
What is derived from it
Opens and clicks are used for campaign statistics, but also to build a profile: which products interest you, what time you read your email, whether you are an "active" or "dormant" customer. Later, more targeted mailings are based on this information.
What the law says
- Sending the newsletter. In Italy, Article 130 of the Personal Data Protection Code generally requires consent for commercial communications by email. The exception is so-called soft spam: a company may write to its own customer about products or services similar to those purchased, using the email provided at the time of sale, if the customer is informed and can object at any time.
- Tracking opens. The pixel accesses information on your device and sends it to the sender: this is why it falls within Article 5(3) of Directive 2002/58/EC and its national implementations, such as Article 122 of the Italian Privacy Code, which require consent for tracking tools that are not strictly necessary. The sender should inform you that it uses these tools.
- Profiling. If opens and clicks are used to build a profile for marketing, you can object at any time, without giving reasons, under Article 21 GDPR.
How to limit tracking
| Measure | Effect |
|---|---|
| Turn off automatic image loading | The pixel is not downloaded until you choose |
| Use your email program's privacy protection features | Some services load images through intermediate servers, hiding your address and the real time of opening |
| View messages as plain text | No images, no pixel |
| Reach the website by typing the address | The click is not linked to your subscriber profile |
These measures do not stop you receiving emails, but they reduce what the sender can learn about how you read them.
Unsubscribing the right way
The right to object to marketing must be easy to exercise. Legitimate newsletters contain an unsubscribe link, usually at the bottom of the message, and many email programs show an unsubscribe button next to the sender.
- Use the link for senders you recognise. If you signed up yourself, or bought from that company, it is the quickest route.
- Do not use the link in suspicious messages. For clearly fraudulent emails or unknown senders, clicking can confirm that your address is active. In those cases it is better to report the message as spam.
- If unsubscribing does not work, write to the controller named in the privacy notice, objecting under Article 21, and keep the emails received after your request.
A better-protected inbox
Aliases and dedicated addresses
Many email services let you create aliases: alternative addresses that deliver to the same inbox. Using a different alias for each shop lets you see who passed your address to third parties and switch off the alias if it becomes a source of spam.
Separate uses
One address for your bank, work and public services, another for shopping and sign-ups: if the second is exposed or flooded with advertising, the first stays clean.
Review your subscriptions
Every few months, search your mail for the word "unsubscribe": you will get an instant list of the newsletters you receive and can drop the ones you no longer read.
In short
- Open pixels and personalised links reveal when you open an email and what you click.
- Sending commercial emails generally requires consent, except for soft spam to existing customers.
- Tracking opens falls under the ePrivacy Directive's rules on tracking tools.
- Turn off automatic image loading or use your email program's privacy protections.
- Use different aliases for shops and unsubscribe only from senders you recognise.