{{about|a user tracking technique on the Web|the location technology|Bluetooth Low Energy beacon}} {{redirect|Web bug|bugs in web software|Software bug}} {{missing|Facebook Pixel (incoming redirect)|date=November 2022}} {{Short description|Method to track the viewing of a webpage}} {{Use mdy dates|date=July 2012}} A '''web beacon'''<ref group="note">Also called web bug, tracking bug, tag, web tag, page tag, tracking pixel, pixel tag, 1×1 GIF, spy pixel, or clear GIF.</ref> is a technique used on web pages and email to unobtrusively (usually invisibly) allow checking that a user has accessed some content.<ref>{{cite web|url=http://news.cnet.com/2100-1017-243077.html|title=Nearly undetectable tracking device raises concern|date=January 2, 2002|author=Stefanie Olsen|work=CNET News|access-date=May 23, 2019|archive-date=November 7, 2014|archive-url=https://web.archive.org/web/20141107101823/http://news.cnet.com/2100-1017-243077.html|url-status=dead}}</ref> Web beacons are typically used by third parties to monitor the activity of users at a website for the purpose of web analytics or page tagging.<ref>{{cite web |url=http://w2.eff.org/Privacy/Marketing/web_bug.html |author=Richard M. Smith |title=The Web Bug FAQ |publisher=EFF.org Privacy Archive |date=November 11, 1999 |access-date=July 12, 2012 |archive-date=June 29, 2012 |archive-url=https://web.archive.org/web/20120629051001/http://w2.eff.org/Privacy/Marketing/web_bug.html |url-status=dead }}</ref> They can also be used for email tracking.<ref>{{cite web|url=http://www.mailsbroadcast.com/email.bolts.nuts/about.web.bugs.htm|title=Email web bug invisible tracker collects info without permission|website=mailsbroadcast.com|author=Richard Lowe Jr And Claudia Arevalo-Lowe|access-date=August 22, 2016|archive-date=December 3, 2017|archive-url=https://web.archive.org/web/20171203232852/http://www.mailsbroadcast.com/email.bolts.nuts/about.web.bugs.htm|url-status=dead}}</ref> When implemented using JavaScript, they may be called '''JavaScript tags'''.<ref>{{Cite web |url=https://napoleon.bc.edu/ojs/index.php/ital/article/viewFile/1771/1677 |title=Negrino, Tom; Smith, Dori. ''JavaScript para World Wide Web''. Pearson Education, 2001. accessed 1 October 2015 |access-date=October 1, 2015 |archive-date=May 12, 2016 |archive-url=https://web.archive.org/web/20160512003443/http://ejournals.bc.edu/ojs/index.php/ital/article/viewFile/1771/1677 |url-status=live}}</ref> Web beacons are unseen HTML elements that track a webpage's views. Upon the user revisiting the webpage, these beacons are connected to cookies established by the server, facilitating undisclosed user tracking.<ref>{{Cite book |last=Payton |first=Anne M. |chapter=A review of spyware campaigns and strategies to combat them |date=2006-09-22 |title=Proceedings of the 3rd annual conference on Information security curriculum development |chapter-url=https://doi.org/10.1145/1231047.1231077 |series=InfoSecCD '06 |location=New York, NY, USA |publisher=Association for Computing Machinery |pages=136–141 |doi=10.1145/1231047.1231077 |isbn=978-1-59593-437-6}}</ref>
Using such beacons, companies and organizations can track the online behavior of web users. At first, the companies doing such tracking were mainly advertisers or web analytics companies; later social media sites also started to use such tracking techniques, for instance through the use of buttons that act as tracking beacons.
In 2017, W3C published a candidate specification for an interface that web developers can use to create web beacons.<ref name="W3C">{{cite web | url=https://www.w3.org/TR/beacon/ | title=Beacon | publisher=W3C | date=April 13, 2017 | access-date=November 7, 2019 | author1=Jatinder Mann |author2=Alois Reitbauer | archive-date=October 27, 2019 | archive-url=https://web.archive.org/web/20191027150959/http://www.w3.org/TR/beacon/ | url-status=dead}}</ref>
== Overview == thumb|upright=1.5|An innocuous web beacon embedded in a email A web beacon is any of several techniques used to track who is visiting a web page. They can also be used to see if an email was read or forwarded or if a web page was copied to another website.<ref>{{Cite journal|last1=Bouguettaya|first1=A. R. A.|last2=Eltoweissy|first2=M. Y.|date=2003|title=Privacy on the Web: facts, challenges, and solutions|journal= IEEE Security & Privacy|volume=1|issue=6|pages=40–49|doi=10.1109/MSECP.2003.1253567|bibcode=2003ISPri..99f..40R |issn=1558-4046}}</ref>
The first web beacons were small digital image files that were embedded in a web page or email. The image could be as small as a single pixel (a "tracking pixel") and could have the same colour as the background, or be completely transparent.<ref>{{Cite journal |last=Nielsen |first=Janne |date=2021-04-27 |title=Using mixed methods to study the historical use of web beacons in web tracking |url=https://link.springer.com/10.1007/s42803-021-00033-4 |journal=International Journal of Digital Humanities |language=en |volume=2 |issue=1–3 |pages=65–88 |doi=10.1007/s42803-021-00033-4 |s2cid=233416836 |issn=2524-7832|url-access=subscription }}</ref> When a user opens the page or email where such an image is embedded, they might not see the image, but their web browser or email reader automatically downloads the image, requiring the user's computer to send a request to the host company's server, where the source image is stored. This request provides identifying information about the computer, allowing the host to keep track of the user.
This basic technique has been developed further so that many types of elements can be used as beacons. Currently, these can include visible elements such as graphics, banners, or buttons, but also non-pictorial HTML elements such as the frame, style, script, input link, embed, object, etc., of an email or web page.
The identifying information provided by the user's computer typically includes its IP address, the time the request was made, the type of web browser or email reader that made the request, and the existence of cookies previously sent by the host server. The host server can store all of this information, and associate it with a session identifier or tracking token that uniquely marks the interaction.
=== Use by companies === {{Broader|Corporate surveillance}} {{See also|Facebook beacon}} Once a company can identify a particular user, the company can then track that user's behavior across multiple interactions with different websites or web servers. As an example, consider a company that owns a network of websites. This company could store all of its ''images'' on one particular server, but store ''the other contents'' of its web pages on a variety of other servers. For instance, each server could be specific to a given website, and could even be located in a different city. But the company could use web beacons requesting data from its one image server to count and recognize individual users who visit different websites. Rather than gathering statistics and managing cookies for each server independently, the company can analyze all this data together, and track the behavior of individual users across all the different websites, assembling a profile of each user as they navigate through these different environments.
== Email tracking == {{Main|Spy pixel}} Web beacons embedded in emails have greater privacy implications than beacons embedded in web pages. Through the use of an embedded beacon, the sender of an email – or even a third party – can record the same sort of information as an advertiser on a website, namely the time that the email was read, the IP address of the computer that was used to read the email (or the IP address of the proxy server that the reader went through), the type of software used to read the email, and the existence of any cookies previously sent. In this way, the sender – or a third party – can gather detailed information about when and where each particular recipient reads their email. Every subsequent time the email message is displayed, the same information can be sent again to the sender or third party.
"Return-receipt-to" (RRT) email headers can also trigger sending of information and these may be seen as another form of a web beacon.<ref>See Internet Engineering Task Force memorandum RFC 4021.</ref>
Web beacons are used by email marketers, spammers, and phishers to verify that an email is read. Using this system, they can send similar emails to a large number of addresses and then check which ones are valid. Valid in this case means that the address is actually in use, that the email has made it past spam filters, and that the content of the email is actually viewed.
To some extent, this kind of email tracking can be prevented by configuring the email reader software to avoid accessing remote images.
One way to neutralize such email tracking is to disconnect from the Internet after downloading email but before reading the downloaded messages. (Note that this assumes one is using an email reader that resides on one's own computer and downloads the emails from the email server to one's own computer.) In that case, messages containing beacons will not be able to trigger requests to the beacons' host servers, and the tracking will be prevented. But one would then have to delete any messages suspected of containing beacons or risk having the beacons activate again once the computer is reconnected to the Internet.
Web beacons can also be filtered out at the server level so that they never reach the end-user.
== Beacon API == The Beacon API (application programming interface) is a candidate recommendation of the World Wide Web Consortium, the standards organization for the web.<ref>{{Cite web |url=https://www.w3.org/TR/beacon/ |title=Beacon W3C Candidate Recommendation 13 April 2017 |access-date=July 26, 2017 |archive-date=March 3, 2021 |archive-url=https://web.archive.org/web/20210303203846/http://www.w3.org/TR/beacon/ |url-status=live }}</ref> It is a standardized API that directs the web client to silently send tracking data back to the server, i.e. without alerting the user and thus disturbing their experience.{{cn|date=June 2024}}
Use of this Beacon API enables user tracking and profiling without the end-user's awareness, as it is invisible to them, and without delaying or otherwise interfering with navigation within or away from the site.<ref>[https://nikcodes.com/2014/12/16/squeezing-the-most-into-the-new-w3c-beacon-api/ Squeezing the Most Into the New W3C Beacon API ] {{Webarchive|url=https://web.archive.org/web/20171003030810/https://nikcodes.com/2014/12/16/squeezing-the-most-into-the-new-w3c-beacon-api/ |date=October 3, 2017 }} - NikCodes, 16 December 2014</ref> Support for the Beacon API was introduced into Mozilla's Firefox browser in February 2014<ref>[https://developer.mozilla.org/en-US/docs/Web/API/Navigator/sendBeacon Navigator.sendBeacon] {{Webarchive|url=https://web.archive.org/web/20210430204701/https://developer.mozilla.org/en-US/docs/Web/API/Navigator/sendBeacon |date=April 30, 2021 }} - Mozilla Developer Network</ref> and in Google's Chrome browser in November 2014.<ref>[https://developers.google.com/web/updates/2014/10/Send-beacon-data-in-Chrome-39 Send beacon data in Chrome 39] {{Webarchive|url=https://web.archive.org/web/20210413030320/https://developers.google.com/web/updates/2014/10/Send-beacon-data-in-Chrome-39 |date=April 13, 2021 }} - developers.google.com, September 2015</ref>
== Spy pixels == '''Spy pixels''' or '''tracker pixels''' are hyperlinks to remote image files in HTML email messages that have the effect of spying on the person reading the email if the image is downloaded. They are commonly embedded in the HTML of an email as small, imperceptible, transparent graphic files.<ref name=":2">Sipior, Janice C., Burke T. Ward, and Ruben A. Mendoza. 2011. “Online Privacy Concerns Associated with Cookies, Flash Cookies, and Web Beacons.” ''Journal of Internet Commerce'' 10(1):1–16.</ref> Spy pixels are commonly used in marketing, and there are several countermeasures in place that aim to block email tracking pixels. However, there are few regulations in place that effectively guard against email tracking approaches.
=== History === Networked email was pioneered in 1971 by Ray Tomlinson and has made it much more convenient to send and receive messages as opposed to traditional postal mail.<ref name=":4">Hossin. M. 2019. "[https://www.researchgate.net/publication/342116029_Email_Tracking_Beacon_Concerns_and_Solutions Email Tracking Beacon: Concerns and Solutions]". ''International Journal of Engineering Research And'' V8(06).</ref> In 2020, there were 4 billion email users worldwide and approximately 306 billion emails sent and received daily.<ref>{{Cite web |title=Number of e-mail users worldwide 2025 |url=https://www.statista.com/statistics/255080/number-of-e-mail-users-worldwide/ |access-date=2021-04-13 |website=Statista |language=en}}</ref> The email sender, however, still has to wait for a reply email from the recipient in order to confirm that their message was delivered. There are some situations where the recipient doesn't respond to the sender even when they have read the email, which is why the email tracking method emerged. Most email services do not provide indicators as to whether an email was read, so third-party applications and plug-ins have provided the convenience of email tracking. The most common method is the email tracking beacon or spy pixel.<ref name=":4" />
Spy pixels were described as "endemic" in February 2021. The "Hey" email service, contacted by ''BBC News'', estimated that it blocked spy pixels in about 600,000 out of 1,000,000 messages per day.
=== Mechanism === HTML email messages typically contain hyperlinks to online resources. Common software used by a recipient of email may, by default, automatically download remote image files from hyperlinks, without asking the user for confirmation. After downloading an image file, the software displays the image to the recipient. A spy pixel is an image file that is deliberately made small, often of a single pixel and of a colour that makes it "impossible to spot with the naked eye even if you know where to look." Any email user can be reached via email tracking due to the open nature of email.<ref name=":5">Xu, Haitao, Shuai Hao, Alparslan Sari, and Haining Wang. 2018. “[https://www.researchgate.net/publication/328379389_Privacy_Risk_Assessment_on_Email_Tracking Privacy Risk Assessment on Email Tracking].” ''IEEE INFOCOM 2018 - IEEE Conference on Computer Communications''.</ref>
The tracking process begins when a sender inserts an image tag, represented as <img>, into an HTML-based email. The image tag is linked to a tracking object stored on the server of the sender through a reference Uniform Resource Locator (URL). Once the mail client is opened, the recipient receives the email through a process whereby the mail user agent (MUA) synchronizes updates from the recipient's message transfer agent (MTA) with the local mail repository. When the recipient opens the email, the mail client requests the file that is referenced by the image tag. As a result, the web server where the file is stored logs the request and returns the image to the recipient. In order to track individual behavior, the tracking object or reference URL has to contain a tag that is unique to each email recipient. Oftentimes, the hash of the recipient's email is used. In contrast, IP address and device information collected from non-tracking images does not reveal specific users' email addresses.<ref name=":0">Haupt, Johannes, Benedict Bender, Benjamin Fabian, and Stefan Lessmann. 2018. “Robust Identification of Email Tracking: A Machine Learning Approach.” ''European Journal of Operational Research'' 271(1):341–56.</ref>
When a single email is sent to multiple recipients, the tracking report will normally show the number of emails that have been opened but not the specific recipients who have done so.<ref name=":4" />
==== Email tracking vs. web tracking ==== Web tracking and email tracking employ similar mechanisms, such as the usage of tracking images or cookies. Email tracking makes it much easier to trace back to any individual without consent, as email addresses can often reveal an individual's affiliation to a particular organization, browsing history, online social media profile, and other PII.<ref name=":0" /> This can lead to cross-tracking across devices, where third-party services link devices that share common attributes such as IP addresses, local networks, or login information.<ref name=":1">Englehardt, Steven, Jeffrey Han, and Arvind Narayanan. 2018. “[https://petsymposium.org/2018/files/papers/issue1/paper42-2018-1-source.pdf I Never Signed up for This! Privacy Implications of Email Tracking].” ''Proceedings on Privacy Enhancing Technologies'' 2018(1):109–26.</ref><ref>Brookman, Justin, Phoebe Rouge, Aaron Alva, and Christina Yeung. 2017. “Cross-Device Tracking: Measurement and Disclosures.” ''Proceedings on Privacy Enhancing Technologies'' 2017(2):133–48.</ref> Although this may be more challenging with web tracking, more advanced web trackers have data collection features, like the Meta Pixel's advanced matching feature, that allows people to be identified by submitting an email address or other PII on a form page.<ref>{{Cite web |title=About advanced matching for web |url=https://www.facebook.com/business/help/611774685654668?id=1205376682832142 |access-date=May 3, 2024 |website=Facebook}}</ref>
=== Usage ===
==== Personal use ==== Individuals and business owners may want to use email tracking for a variety of reasons, such as lead generation, event invitations, promotions, newsletters, one-click polls, and teacher-parent communications. They can use services like Yet Another Mail Merge (YAMM), a Google Sheets add-on, to create and send personalized mail merge campaigns from Gmail. The sender has the option to enable the tracker and see email open rates, clicks, replies, and bounces.<ref>{{Cite web |title=Mail merge for Gmail - Yet Another Mail Merge - YAMM |url=https://yamm.com/ |access-date=2021-04-21 |website=yamm.com |language=en}}</ref> According to YAMM's website: "YAMM embeds a tiny, invisible tracking image (a single-pixel gif, sometimes called a web beacon) within the content of each message. When the recipient opens the message, the tracking image is scanned, referenced and recorded in our system."<ref>{{Cite web |title=How to track if your emails have been opened? |url=https://support.yet-another-mail-merge.com/hc/en-us/articles/211870885-How-to-track-if-your-emails-have-been-opened- |access-date=2021-04-21 |website=Documentation - Yet Another Mail Merge Support |language=en-US}}</ref>
==== Marketing ==== Tracking the behavior of users through mediums like email newsletters and other forms of marketing communication is a competitive advantage in online marketing. In fact, it is so valuable that there are companies that sell online user data or offer email tracking as a service, such as Bananatag, Mailtrack.io, and Yet Another Mail Merge.<ref name=":3">Fabian, Benjamin, Benedict Bender, Ben Hesseldieck, Johannes Haupt, and Stefan Lessmann. 2021. “Enterprise-Grade Protection against e-Mail Tracking.” ''Information Systems'' 97:101702.</ref><ref name=":4" />This is because by learning more about the user based on their clicking histories and demographics, websites and companies can tailor messages to each user. The more information on the individual-level preferences of a user, the better. Customized communications in marketing can then result in heightened customer loyalty, lock-in, and satisfaction, which translates to increased cash flows and profitability.<ref>Ansari, Asim and Carl F. Mela. 2003. “[https://www.researchgate.net/publication/247837315_E-Customization E-Customization].” J''ournal of Marketing Research'' 40(2):131–45.</ref> Using data to map out the competitive landscape can also help companies derive a competitive strategy and gain a competitive advantage.<ref>Ringel, Daniel M. and Bernd Skiera. 2016. “[https://www.researchgate.net/publication/301828416_Visualizing_Asymmetric_Competition_Among_More_Than_1000_Products_Using_Big_Search_Data Visualizing Asymmetric Competition Among More Than 1,000 Products Using Big Search Data].” ''Marketing Science'' 35(3):511–34.</ref> However, adverse effects from behavioral marketing can include discrimination, including price discrimination.<ref>Datta, Amit, Michael Carl Tschantz, and Anupam Datta. 2015. “[https://www.andrew.cmu.edu/user/danupam/dtd-pets15.pdf Automated Experiments on Ad Privacy Settings].” ''Proceedings on Privacy Enhancing Technologies'' 2015(1):92–112.</ref><ref>Taylor, Curtis R. 2004. “[https://drive.google.com/file/d/1weoOhLf_SioyUJRqVTo52GSliMVIlEAu/view Consumer Privacy and the Market for Customer Information].” ''The RAND Journal of Economics'' 35(4):631.</ref>
==== Malicious emails ==== Some emails contain malicious content or attachments, and email tracking is used to detect how fast these viruses or malicious programs can spread.<ref name=":3" /> At the same time, generally, the deliverability of tracked emails is reduced up to 85%, as the firewalls of company servers embed algorithms to filter out emails with suspicious contents.<ref name=":4" />
==== Research ==== Web tracking and tracking software are used by researchers who need to gather data for their research, especially in information seeking studies. In fact, tracking technologies can be used for good, offering valuable information for the development of websites, portals, and digital libraries. It can also be used to improve user interfaces, search engines, menu items, navigational features, online help, and intelligent software agents, information architecture, content description, metadata, and more. These finds can be useful in marketing and e-commerce and may be important to people like library and information professionals, educators, and database designers.<ref>Fourie, Ina and Theo Bothma. 2007. “[https://www.researchgate.net/publication/235267179_Information_seeking_An_overview_of_web_tracking_and_the_criteria_for_tracking_software Information Seeking: an Overview of Web Tracking and the Criteria for Tracking Software].” ''Aslib Proceedings'' 59(3):264–84.</ref>
=== Spying effect === The spying effect is that, without the email recipient choosing to do so, the result of the automatic download is to report to the sender of the email: if and when an email is read, when (and how many times) it is read, the IP address and other identity details of the computer or smartphone used to read the email, and from the latter, the geographical location of the recipient. This information provides insights into users' email reading behaviors, office and travel times, as well as details about their environment.<ref name=":0" /> By doing a reverse lookup of an IP address, the log entry can provide information on which organizations a user is affiliated with.<ref name=":33">Fabian, Benjamin, Benedict Bender, Ben Hesseldieck, Johannes Haupt, and Stefan Lessmann. 2021. “Enterprise-Grade Protection against e-Mail Tracking.” ''Information Systems'' 97:101702.</ref> For example, a board member of a major technology company was caught forwarding confidential information when an email log entry, IP address, and location information were examined simultaneously. Additionally, if spammers send emails to random email addresses, they can identify active accounts in this manner.<ref name=":0" />
There exist many companies that offer email tracking services to senders. According to a study done by three researchers at Princeton University, about 30% of the emails they analyzed leaked recipients' email addresses to third parties via methods like embedded pixels, the majority of them intentionally. 85% of emails in their corpus of 12,618 gathered using a web crawler contained embedded third-party content, with 70% categorized as trackers. Top third-party domains include "doubleclick.net", "mathtag.com", "dotomi.com", and "adnxs.com", and the top organizations that collect leaked email addresses include The Acxiom, Conversant Media, LiveIntent, Neustar, and Litmus Software.<ref name=":4" /><ref name=":1" /> Reloading an email increases the chance of the recipient's information being leaked to third parties. The study also found that tracking protection was helpful: it reduces the number of email addresses leaked by 87%.<ref name=":1" />
A separate study found that 24.7% of 44,449 emails analyzed were embedded with at least one tracking beacon. Emails categorized as travel, news/media, and health had the highest prevalence of tracking, with 57.8%, 51.9%, and 43.4% containing at least one tracking beacon respectively. On the other hand, emails categorized as email client, social networking, and education have the least tracking, with 0.6%, 1.6%, and 3.8% containing at least one tracking beacon respectively. Through a survey, the authors also found that 52.1% of participants who checked email quite often were unaware that they could be tracked from simply opening an email. 86% of participants consider email tracking as a serious privacy threat.<ref name=":5" />
According to poll results from Zogby International, 80% of consumers are either "somewhat" or "very" concerned about online tracking.<ref name=":2" /> Consumers who perceive a lack of business or governmental regulation will try to regain power through a variety of responses, such as fabricating personal information, using privacy-enhancing technologies, and refusing to purchase.<ref name=":3" /> At the same time, some argue that people's perceptions about privacy have changed with the times. For example, Mark Zuckerberg, founder of Facebook, said, "People have really gotten comfortable not only sharing more information and different kinds, but more openly and with more people. That social norm is just something that has evolved over time."<ref name=":2" />
Cambridge Analytica used a third-party app called “thisisyourdigitallife” to collect information from over 50 million Facebook users. Access to users' emails can expose them to data leaks. Four researchers from the University of Iowa and the Lahore University of Management Sciences designed and deployed CanaryTrap, which identifies data misuse by third-party apps on online social networks. It does this by linking a honeytoken to a user’s social media page and then watches for unrecognized usage. Specifically, the authors shared email addresses as honeytokens and watched for any unrecognized use of those email addresses. After performing an experiment on 1,024 Facebook pages, the authors discover multiple counts of data misuse. 422 unrecognized emails were received on honeytokens shared with 20 Facebook apps. Within those 422 emails, 76 were categorized as malicious or spam.<ref>Farooqi, Shehroze, Maaz Musa, Zubair Shafiq, and Fareed Zaffar. 2020. “[https://www.petsymposium.org/2020/files/papers/issue4/popets-2020-0074.pdf CanaryTrap: Detecting Data Misuse by Third-Party Apps on Online Social Networks].” ''Proceedings on Privacy Enhancing Technologies'' 2020(4):336–54.</ref> Furthermore, third-party trackers can be considered as “adversaries” to Internet users because the use of HTTP cookies, Flash cookies, and DOM storage breaks data confidentiality between the users and the websites they interact with.<ref>Mittal, Sonal. 2010. “[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2005252 User Privacy and the Evolution of Third-Party Tracking Mechanisms on the World Wide Web].” ''SSRN Electronic Journal''.</ref>
Overall, researchers at Carnegie Mellon University and Qualcomm found that many users don't see tracking as black and white. Many want control over tracking and think that it has its benefits, but don't know how to control tracking or distrust current tools. Out of 35 participants in the study, fourteen saw tracking as conditionally positive, eight saw it as generally neutral, nine saw it as generally negative, and the remaining four had mixed feelings. Twelve participants felt resigned to tracking.<ref>Melicher, William et al. 2016. “(Do Not) Track Me Sometimes: Users’ Contextual Preferences for Web Tracking.” ''Proceedings on Privacy Enhancing Technologies'' 2016(2):135–54.</ref>
=== Countermeasures === Countermeasures include using a plain text email client, disabling automatic download of images, or, if reading email using a browser, installing an add-on or browser extension.
The process of email-tracking does not require cookies, which makes it difficult to block without affecting user experience.<ref name=":34">Fabian, Benjamin, Benedict Bender, Ben Hesseldieck, Johannes Haupt, and Stefan Lessmann. 2021. “Enterprise-Grade Protection against e-Mail Tracking.” ''Information Systems'' 97:101702.</ref> For example, disabling automatic download of images is easy to implement; however, the trade-off is that it often results in a loss of information, incorrect formatting, a decline in user experience, and incomprehension or confusion.<ref name=":0" />
Three Princeton University researchers who analyzed 16 email clients found that none of the existing setups completely protects users from the threats of email tracking. Blocking extensions such as uBlock Origin, Privacy Badger, and Ghostery can filter tracking requests.<ref name=":1" />
Four other researchers aimed to detect trackers by focusing on analyzing the behavior of invisible pixels. After crawling 84,658 web pages from 8,744 domains, they found that invisible pixels are present on more than 94.51% of domains and make up 35.66% of all third-party images. Filter lists such as EasyList, EasyPrivacy, and Disconnect are popular ways to detect tracking; they detect known tracking and advertising requests by keeping a "blacklist." However, they miss around 30% of the trackers that the researchers detected. Moreover, when all three filter lists were combined, 379,245 requests from 8,744 domains still tracked users on 68.70% of websites.<ref>fouad, Imane, Nataliia Bielova, Arnaud Legout, and Natasa Sarafijanovic-Djukic. 2020. “Missed by Filter Lists: Detecting Unknown Third-Party Trackers with Invisible Pixels.” ''Proceedings on Privacy Enhancing Technologies'' 2020(2):499–518.</ref>
Recent research has focused on using machine learning to develop anti-tracking software for end-users.<ref name=":0" /><ref name=":3" />
Analyzing mail flows and aggregate statistical data can help protect user accounts by detecting abnormal email behavior such as viral propagation of malicious email attachments, spam emails, and email policy violations.<ref>Stolfo, Salvatore J., Shlomo Hershkop, Ke Wang, Olivier Nimeskern, and Chia-Wei Hu. 2003. “[https://www.researchgate.net/publication/220697190_A_Behavior-Based_Approach_to_Securing_Email_Systems A Behavior-Based Approach to Securing Email Systems].” ''Lecture Notes in Computer Science'' 57–81.</ref>
Privacy tools can have usability flaws which makes it difficult for users to make informed and meaningful decisions. For example, participants in a study thought that they had installed configured a tool successfully when they had not.<ref>Leon, Pedro et al. 2012. “[https://www.researchgate.net/publication/241623182_Why_Johnny_can%27t_opt_out_A_usability_evaluation_of_tools_to_limit_online_behavioral_advertising Why Johnny Can't Opt Out].” ''Proceedings of the 2012 ACM Annual Conference on Human Factors in Computing Systems - CHI '12.''</ref> Additionally, the rise of ad-blockers and similar privacy tools have led to the emergence of anti ad-blockers, which seek out ad-blockers and try to disable them with various methods, in an escalating ad-blocker arms race.<ref name=":3" />
=== Privacy regulations and policies === There are few regulation initiatives that exist to protect users from email tracking.<ref name=":3" /> The help pages of many email clients, such as Gmail, Yahoo! Mail, and Thunderbird may mislead users into thinking that privacy risks associated with email tracking are limited by stating that the threat is restricted to the ''email sender'' receiving recipients' information rather than third-parties also being able to access that information.<ref name=":1" />
==== United States ==== The U.S. currently does not have comprehensive privacy rights in place. The Fourth Amendment, which guarantees "the right of the people to be secure in their persons, houses, papers and effects. against unreasonable searches and seizures, shall not be violated" does not explicitly apply to private companies and individuals. California's state constitution, however, grants individuals explicit privacy rights from both government and private action. There are regulations that target specific sectors, such as the Gramm-Leach-Bliley Financial Modernization Act of 1999 directed towards the financial services sector, the Health Insurance Portability and Accountability Act of 1996 for the healthcare sector, and the U.S. Department of Commerce's Safe Harbor framework which assists US companies' compliance with the EU's Directive on Data Protection.<ref name=":2" />
==== European Union ==== The European Union passed the Directive on Data Protection (Directive 95/46/EC) in 1995 which requires member states to comply with certain privacy protection laws, focused on protecting the consumer. The directive forbids the exchange of data between EU member countries and countries that are not in accordance with the directive. Personal data can only be collected in certain circumstances and must be disclosed to individuals whose information is being collected. Additionally, PII can only be kept for as long as it is used for its original purpose.<ref name=":2" />
The EU first introduction a set of regulations on tracking technologies in 2002. In 2009, the EU Directive mandated that websites ask for consent before using any type of profiling technology, such as cookies. As a result, most European websites implemented a "cookie bar." However, four researchers at the Polytechnic University of Turin performed an experiment on 35,000 websites using a tool called CookieCheck and found that 49% of those websites do not follow the EU cookie directive and installed profiling cookies before the user gave consent. In conclusion, the authors argue that the EU regulatory framework has been ineffective in enforcing rules and has not done much in helping reduce users’ exposure to tracking technologies.<ref>Trevisan, Martino, Stefano Traverso, Eleonora Bassi, and Marco Mellia. 2019. “[https://www.researchgate.net/publication/332888923_4_Years_of_EU_Cookie_Law_Results_and_Lessons_Learned 4 Years of EU Cookie Law: Results and Lessons Learned].” ''Proceedings on Privacy Enhancing Technologies'' 2019(2):126–45.</ref>
== Notes == {{reflist|group=note}}
== References == {{reflist|30em}}
== External links == * [https://web.archive.org/web/20010729060646/http://www.eff.org/Privacy/Marketing/web_bug.html The Web Bug FAQ] from EFF * [https://lwn.net/Articles/86893/ "Did they read it?"] from the Linux Weekly News * [http://bcn.boulder.co.us/~neal/privacy/trojanmarketing.html Trojan Marketing] * [http://yro.slashdot.org/yro/06/10/13/1623217.shtml Slashdot on Web Bugs]—Slashdot.org forum thread on blocking web bugs
Category:Email Category:Internet privacy Category:Spamming Category:Web analytics