What image blocking does (and doesn't) do

The oldest defence against tracking pixels is simply not loading remote images. It’s genuinely effective — but it has real limits, and it is not a substitute for withdrawing consent.

Blocking remote images: what it stops

If your mail client doesn’t fetch remote images, the tracking pixel is never requested, so:

• The open is not recorded.
• Your IP address and user-agent are not sent to the tracker.

Most desktop and mobile clients let you turn this on (“Ask before displaying remote content” or similar). It is the single most effective personal setting against open-tracking.

Image proxies: a partial fix

Some providers — notably Gmail and Apple Mail’s Privacy Protection — take a different approach: instead of blocking, they proxy remote images through their own servers.

• Apple Mail Privacy Protection (MPP) pre-fetches images through Apple’s proxy, from an Apple IP, often whether or not you actually opened the message. This hides your real IP and makes “opened” signals unreliable — senders increasingly can’t trust Apple opens at all.
• Gmail caches images through Google’s proxy, hiding your IP and reducing what the tracker learns.

Proxies protect your IP address and location, and they blur open-tracking. But note what they do not do:

• The image is still fetched (just by the proxy), so a raw “something loaded” event may still occur — sometimes decoupled from a real open, sometimes not.
• The unique identifier in the URL is still delivered to the sender’s server. If the proxy fetches a per-recipient pixel, the sender still learns that address’s pixel was pulled, even if the IP is Apple’s or Google’s.

What image handling never fixes: rewritten links

Blocking or proxying images does nothing about click tracking. When you click a rewritten link, you actively make a request to the sender’s redirect endpoint, which records the click before forwarding you. No image setting prevents that — only not clicking, or the sender not rewriting links, does. Our Link inspector reveals when a link is rewritten.

Why it’s not a substitute for withdrawing consent

Image controls are a technical mitigation you apply to yourself. They:

• vary by client and can be inconsistent,
• don’t cover clicks,
• and don’t change what the sender is allowed to do.

Withdrawing consent is a legal instruction to the sender. When honoured correctly (see your rights), it stops the tracking at the source — including on emails already sent — regardless of which mail client you use. The two are complementary: block images to reduce leakage today, and withdraw consent to stop the tracking being done to you at all.