What we ask for, and why
Most email tools put a tiny invisible image in every message. When it loads, the tool records that this subscriber opened this email at this time, often with a rough location and device. Links are rewritten so each click is logged against the person too. Over months that becomes a reading history, and most tools invite you to build segments from it.
The Standard draws the line at the person. Members may look at totals: how many were sent, how many bounced, how many unsubscribed, how many visits a campaign sent to the site. Members do not keep per-person open or click logs, and do not build segments on them (clause NFS-2.2, ruling R-008). Any sync that sends your list to an ad platform, such as a “custom audience” connection in your email tool, stays switched off. The email tool acts as your processor under contract (clause NFS-1.4).
A consent line in the sign-up form doesn’t change this (clause NFS-1.3). Someone who asked for your newsletter asked for the newsletter, not for a record of when they read it.
Open rates were already broken
In June 2021 Apple announced Mail Privacy Protection, and it arrived with iOS 15 in September 2021. Apple says the feature “downloads remote content in the background by default”, whether or not you read the email, routes it through relays that hide the reader’s IP address, and stops senders learning “when and how many times you opened their email”. In practice, a message sitting unread on an iPhone with the feature on can still show up as “opened”.
How much this affects your list varies, but it is not small. Litmus’s email client figures, calculated from over a billion opens in July 2026, put Apple at about 62% of recorded opens, and Litmus says Mail Privacy Protection now affects “roughly 55-60% of all email opens”. Mailchimp’s own help pages warn that bot activity such as Mail Privacy Protection “can falsely inflate open and click metrics”.
Gmail changed things earlier. Since December 2013 it has fetched images through Google’s own proxy servers, so senders see Google’s servers rather than the reader’s location, and repeat opens are often not recorded.
Regulators are moving too. In France, the CNIL published a recommendation on tracking pixels in emails on 14 April 2026. It treats most open tracking as needing consent, with narrow exemptions, and gave senders until 14 July 2026 to inform existing subscribers and let them object. We don’t set our bar by the law, but the direction is the same.
So the number many teams steer by is part guesswork.
Measure outcomes, in aggregate
The useful question is what the email caused, not who looked at it.
- Orders and revenue per send. Put a campaign tag on your links (the same tag for everyone on that send, such as
?utm_campaign=sept-offer), and count visits and orders against it in first-party, cookieless analytics. Divide by the number sent. A tag that is identical for every recipient tells you the campaign worked without telling you who. - Replies. Ask a question and let people answer. A reply is the clearest sign an email was read, and it is the reader’s choice to send one.
- Unsubscribes and complaints. A rising unsubscribe rate on one type of email is feedback you can act on.
- List growth. New sign-ups per month, and where they came from, counted at the form.
- Discount codes. A code used only in one email gives you a clean total at the till or checkout.
The pattern to avoid is a link that carries a subscriber ID, or a redirect that logs each click against a name. Most tools do this by default when click tracking is on. Turn it off and use plain tagged links instead.
Deliverability without watching readers
You don’t need open logs to reach the inbox. You need a good sender reputation, and the big mailbox providers have spelled out the basics.
Google announced rules for bulk senders in October 2023, with enforcement starting in February 2024. They apply to anyone sending 5,000 or more messages a day to Gmail addresses. Senders must authenticate with SPF and DKIM, publish a DMARC policy, offer one-click unsubscribe in the message headers for marketing email, process unsubscribes within two days, and keep the spam rate reported in Google’s Postmaster Tools below 0.3%, with 0.1% as the target. Google says it began stepping up enforcement, including rejecting non-compliant mail, in November 2025. Yahoo set out matching requirements from February 2024, including the same 0.3% spam ceiling. Microsoft began rejecting unauthenticated mail from high-volume senders to Outlook.com, Hotmail.com and Live.com addresses from 5 May 2025.
None of this needs a record of who opened what. It needs:
- authentication set up once, properly, on your own domain;
- a sign-up process people understand, ideally with a confirmation step;
- an unsubscribe link that works first time;
- emails people expected, at the frequency they were promised;
- your tool handling bounces and complaints, which it does per address because it has to stop sending to dead or objecting mailboxes. That is suppression, not profiling.
Watch the spam rate in Postmaster Tools. It is a domain-level figure, and it is the one Google’s threshold refers to.
Cleaning your list without open logs
The usual reason for keeping open data is to find inactive subscribers and stop mailing them. That matters, because mailing people who never read you drags down reputation. You can do it by asking rather than watching.
Ask them. Every six or twelve months, send a re-confirmation email: “Do you still want to hear from us? Click here to stay on the list.” The click is an explicit request, like the original sign-up. Record the answer, not a reading history. Send one reminder, then remove everyone who didn’t confirm. You will lose some people who were quietly reading. Most lists end up smaller and healthier.
Use what you already know from the relationship. If you sell things, time since last order comes from your order history, which you hold anyway. A “we haven’t seen you for a while” email based on that is first-party personalisation, which the Standard allows when it is transparent.
Make leaving easy. A clear unsubscribe link, and an option to receive less often, does more for your complaint rate than any engagement score.
What not to do: rebuild the engagement segment from click logs under a different name. Using “last clicked” to decide who stays is still a per-person reading log.
Which tools let you switch it off
Many email tools let you turn tracking off. The details vary, so check what “off” means in yours.
- Mailchimp has open tracking on by default, except for plain-text emails. You can untick “Track opens” and “Track clicks” in each campaign’s settings. Its help pages note that when a paid user turns click tracking off, Mailchimp keeps redirecting links “until certain account activity thresholds are met”.
- Klaviyo has an account-wide setting to stop recording opens, and a separate one for clicks. It says that with open tracking off “the pixel still loads, but Klaviyo does not record the open”.
- Buttondown switched tracking off by default for new accounts in March 2021; open tracking is opt-in.
Also check integrations: any “sync to ads” or audience connection belongs off.
What it costs
You lose a quick number to glance at after each send, and a subject-line test based on opens. You gain numbers that mean something: orders, replies, unsubscribes, list growth. Our own newsletter runs with open and click tracking off. We judge it by replies, sign-ups and unsubscribes.
- NFS-2.2 and ruling R-008: email counts are fine; per-person open and click logs, and segments built on them, are not. Email tools’ ad and CRM audience syncs stay off.
- NFS-1.4: your email tool acts as a processor under contract, not for its own purposes.
- NFS-2.1: measure site visits from campaigns with analytics that count, not follow.
- NFS-1.3: a tick-box doesn’t turn a per-person reading log into something acceptable.
Applicants list their email tool and its settings on their data map. The self-check has a question on email, and “Where data goes” has five questions to put to any vendor.
Sources (16), checked 20 September 2026
- Apple: Mail Privacy Protection and privacy
- Apple Newsroom: Apple advances its privacy leadership with iOS 15 (7 June 2021)
- Apple Newsroom: iOS 15 is available today (September 2021)
- Litmus: Email client market share (July 2026 data)
- Litmus: What you need to know about image caching in Gmail
- Google: Gmail introduces new requirements to fight spam (October 2023)
- Gmail Help: Email sender guidelines FAQ
- Yahoo Sender Hub: Sender best practices
- dmarcian: Microsoft enforces SPF, DKIM, DMARC for high-volume senders
- CNIL: Pixels de suivi dans les courriers électroniques, recommandation (14 April 2026)
- CNIL: Questions-réponses on the tracking pixel recommendation
- Mailchimp: Use open tracking in emails
- Mailchimp: Use click tracking in emails
- Klaviyo: How to manage open tracking
- Buttondown: Email tracking is now off by default (March 2021)
- Buttondown Docs: Open tracking