Can Someone Track You With Your Email Address?

Email address tracking is the use of one email address as a stable identifier across messages, data sets and accounts. The same string serves as the account name at one service and the matching field in a third party data set. Three mechanisms carry most of the tracking: pixels embedded in mail, identifiers attached to links, and matching of records across data sets on the address field. Separation of addresses affects the third mechanism most directly, because a different address at each service gives each data set a different key.

Tracking pixels

A tracking pixel is a transparent image, typically one pixel by one pixel, embedded in the HTML body of a message with a unique URL for the recipient. When the mail client renders the message and loads remote images, the client sends an HTTP GET request to the tracking server for that URL, and the server logs the request with a timestamp, an IP address and a user agent string. The unique URL ties the request to a specific recipient record, so the log entry records an open event for that recipient. The mechanism fires only when remote images load, so a client that blocks remote images produces no request, while a client that preloads images produces a request before the message is read.

Link parameters

Links in mail carry tracking through two layers: a redirect and a set of query parameters. A tracked link points first to a tracking server rather than to the destination, and the server logs the click with the identifier attached to the link before forwarding the client onward. Query parameters appended to the destination URL, such as utm_source, utm_medium and utm_campaign for analytics, and fbclid and gclid for platform click identifiers, travel with the request and identify the campaign and source that produced the click. Both layers operate at click time, so they produce a record only when the recipient follows the link.

Data broker matching

Data broker matching is the joining of records from separate sources on a shared field, and the email address is a common shared field because it is stable and present in many kinds of records. A broker holds records from public registers, commercial transactions and breached data sets, and records that carry the same address are grouped into one profile, whatever their source. Hashing the address before matching does not break the join, because a hash function produces the same output for the same input, so two records carrying the same hashed address still match each other. The limit of the mechanism is that it depends on the shared field: records that carry different addresses do not join on the address field, although they can still join on other shared fields such as a name or a phone number when those fields are also identical across the records.

Account linkage

Account linkage is the use of the same address as the account identifier and the recovery address across multiple services. A service that offers sign in, password reset and notification delivery keyed to an address treats that address as the handle for the account, and a second service that does the same creates a second account under the same handle. When a data set containing the address is disclosed, whether through a breach or through a sale, the address matches the handle of every account registered under it, and the holder of the disclosed data set can test the address against other services to find which accounts exist under it. The linkage does not require access to any password, because the address itself is the lookup key.

Client defences

Client defences against pixel tracking operate at the image loading stage rather than at the address stage. Apple introduced Mail Privacy Protection in 2021 for the Mail app on iOS 15, iPadOS 15 and macOS Monterey, and Apple stated that the feature stops senders from using invisible pixels to collect information about the user and masks the IP address so that it cannot be linked to other online activity or used to determine location. The feature preloads remote content through Apple proxy servers, so the tracking server receives a request from the proxy rather than from the recipient device, and the request does not establish when the recipient actually opened the message. The defence covers mail read in the Apple Mail app only, and it addresses the pixel mechanism rather than the address matching mechanism described above.

Managed aliases

AliasFleet provides managed persistent aliases, one address per site, with per-alias pause and deactivation controls. When each service holds a different alias, the records held by those services carry different keys, so a data set disclosed by one service does not join on the address field with records held by another service, and a disclosed alias identifies only the service that held it. On paid plans, AliasFleet strips tracker pixels from forwarded mail before delivery and scrubs link tracking parameters, including utm parameters, fbclid and gclid, from links in forwarded mail. The limits sit alongside the mechanisms: alias separation does not change what the destination inbox provider can see, and it does not prevent matching on other shared fields when a name or phone number is identical across records. Financial accounts keep a permanent real dedicated address used only for financial accounts, never an alias, because recovery, statements and fraud alerts depend on that address.