Remove tracking pixels from an email UNBEACON

What a tracking pixel tells the sender

An open-tracking pixel is an ordinary image tag pointing at a URL that identifies you personally. It is usually one pixel square, or sized to nothing at all, or hidden with display:none, so you never see it. The picture is irrelevant; the request for it is the point. When your mail client fetches it, the sender's server writes a line in a log.

That one line carries the moment you opened the message, how many times you have opened it since, the IP address you opened it from and therefore roughly where you were, and which client you read it in. Because the URL holds an identifier issued to you alone, none of that is attached to “somebody”; it is attached to your name. Forward the message with the pixel still in it and the next person to open it is logged too, under your identifier, from their address.

The four things this looks for

• An image with no size. Width or height of two pixels or fewer, whether set as an attribute or in an inline style, or an off-site image set to display:none.
• A known tracking host. About fifty bulk-mail and click-tracking services by name, plus any hostname whose first label is one of the usual giveaways: track., open., click., beacon..
• Tracking parameters in the image URL. utm_, mkt_tok, mc_eid, _hsenc, recipient and subscriber identifiers, and a path that is literally /open or /beacon.
• The same tests on CSS backgrounds. A beacon does not have to be an <img>. A background-image:url(…) in a style block fetches from the network exactly the same way, and is a common way of hiding one from a scanner that only reads image tags.

Those parameter names are matched at a parameter boundary rather than as loose text, which sounds pedantic and is not: matched as bare substrings, ct= matched product= and open matched opening-hours.png, and a real product photograph was stripped out of a newsletter as though it were a tracker. Each thing removed is replaced with a visible comment marker, so you can see where it was and the layout does not collapse.

What this does not do

It does not stop tracking through links. Almost every link in a marketing email is a redirect through the sender's own server, so the click is reported whatever you do to the images. SANILINK strips the tracking tags out of a link before you follow it, UNSUB finds the genuine unsubscribe address rather than the one-click trap, and PHISHLENS opens a suspicious message without letting it call home.

It also cleans a copy. The message sitting in your mailbox is untouched, and if your client has already loaded the images the report has already been sent. The moment this is useful is before you forward, archive, or hand a message to somebody else, and the stronger defence, which costs nothing, is turning off remote images in your mail client so nothing loads until you ask for it.

To see where a message really came from before you trust any of it, HEADERPROOF checks the authentication results in the headers and MAILBOX takes the whole message apart.