Hacker News Reader

Comment by isostatic | Hacker News Reader

"This stressed out a lot of email marketers, who quite rightly realised that the new regulations would have a significant effect on their ability to acquire and market to customers via their email address"

"The overwhelming majority of commercial email sent today contains tracking pixels and tracking links, these are used to uniquely identify individuals so that opens and clicks can be correctly attributed to them"

Good.

While spammers may have a problem, people don't.

If I want your tracking pixels and emails then I'll opt in.

View on HN

If they send you an email it means that they obviously have your email address, which I believe is considered personal data.

Now, what additional personal data are collected by tracking pixels?

> these are used to uniquely identify individuals

I would say that this isn't the case. It is to check that the email was read.

Thats correct. But Tracking or Profiling is Opt-In too

You can tracking pixels to track per-user engagement. You can also use tracking links to connect the email address to website activity. As you say, it's possible to use these to track in the aggregate, but many platforms allow tracking by individual.

You are correct that the email was already personal data. But, GDPR requires that each new use of data be transparently communicated and legally justified (which may or may not mean consent), even if it's only using data you already have. The fact that they have already identified the user does not resolve the issue--GDPR still cares when you collect more data about a known user.

Meaning, even though you are justified using the email address to send the newsletter, you may not be in the clear building an engagement profile associated with that email. Which, apparently, some email marketers do.

Not some, all email marketers do.

There's nothing stopping them either, they're entitled to do so, given they obtain consent for that data processing.

Do they? Remember that under the GDPR, a five-page ToS with a "I consent" button at the end is not considered valid. In particular, the user must consent for each use of the PI separately. I don't remember ever seeing a specific consent box for building an engagement profile.

I meant that all marketers are collecting the data, and in the overwhelming number of cases they're doing so without consent.

I'm yet to see a single marketer only do tracking by opt-in, and I work in the industry.

The problem is that we're:

A) Collecting the data without consent

B) In most cases, unable to not collect the data because ESP's do it by default with no option to switch it off

I would argue that pixel trackers for the purpose of checking whether the email is read is covered by the consent to receive marketing by email in the same way as what emails were sent to whom and when will likely also be tracked.

> Now, what additional personal data are collected by tracking pixels?

In theory, an IP can be captured, which is considered PII, but most mailbox providers use proxies so this isn't reliable.

> Now, what additional personal data are collected by tracking pixels?

If I read it, when I read it, where I read it from (location, device, etc)

None of these are personal data if not liked to the email address, which they do not have to.

If linked to email address and considered personal data then the argument is what is covered by consent to receive email marketing? IMHO tracking whether the email was opened is covered (in the same way as agreeing to receive phone marketing should imply they can track whether you answered the phone...). They will also obviously keep track of what emails they sent you and when.

> in the same way as agreeing to receive phone marketing should imply they can track whether you answered the phone.

But agreeing to receive a snail mail does not imply consent to track if it was read. I feel that email is closer to that.

It's impossible to track letter so the point is moot.

The point is that tracking emails, like tracking phone calls, is inherent to that communication medium and there is absolutely nothing wrong with it.

I agree, this is a good thing, the GDPR was design to stress those people and give the control back to the user.

> While spammers may have a problem, people don't.

Marketing spammers maybe, but now scammers and malware spammers have the floor instead. Laws only stop the law abiding citizens from doing their thing, it sure doesn't stop the criminals from.... being criminals.

Not having marketing spammers is still better than having spammers and scammers

There's usually an unsubscribe button for marketing spam, and if there isn't I usually block their email. You can't do that with scammers / illegal spam.

Have you ever clicked one of those? I've never been sure if that wouldn't have worsened the situation by giving feedback that this is an active mail address managed by somebody.

I click it all the time when I feel I'm getting way too many emails. If I feel like it's not some malware spam at least but genuine marketing trying to sell me something. Every now and then I go back to all those "rewards programs" emails and unsubscribe to the least relevant ones to me.

If it's from a legitimate company in American jurisdiction they are legally obligated to stop sending emails if you click unsubscribe. I suppose that piece of information has some nonzero value that you are giving up in exchange to not be contacted by that company.

If you filter just a single address that address can change. If you filter their domain you might lose legitimate correspondence.

I’ve had several groupings of unsolicited marketing emails over the years where I’ve clicked Unsubscribe and ended up on what’s very clearly a Totally Not That Email List, Honest...but it’s advertising the same things, in the same way, just from a slightly different email and possibly different company name. They have all been American in origin.

You can complain under the CAN-SPAM Act.

It's so asymmetrical though. The amount of effort it takes to spam someone is vastly lower than a complaint.

What would be great is a third-party site where you can somehow document/log unsubscribe requests. Then, if the company still spams you, document that. A few hundred users is pretty good proof, and the company can't just argue a glitch. It'd pay for that.

Easy enough to fix: use a unique address for a company, unsubscribe, then take the related company to court later. Works even better in a GDPR location.

Right; with my unlimited resources, time, and understanding of the legal system.

I mean, I'd love to be able to, but do you think I'd even be able to determine what the company's actual address is?

Marketers, spammers and scammers are the same thing - sources of unsolicited e-mail, engaging with whom is not good for you. Eliminating marketers from the trio means only that much less messages to worry about.

I guess I must not be important enough or something because I don't recall the last time I got any marketing emails without sharing my email with a marketing person. The only marketing outside of "Rewards" programs that I get is marketing from the one conference I go to every year, and I get plenty of free swag from them, then I unsubscribe.

Did you take a look at your Spam folder? On my primary address (one I used for almost two decades), 90% of my spam is unsolicited marketing communication. Quickly skimming it, roughly half of that 90% is from parties I may have interacted with in the past, the other half is from apparently legit companies that I haven't interacted with, that pulled my address from somewhere (possibly because I used it to register my business).

Outside of spam, I spent some time and unsubscribed from most of the pseudo-solicited communications I got (i.e. the kind of pre-GDPR bullshit where I register for some service and this automatically counts as consent to receive marketing communication). About solicited marketing messages I don't whine much (except that they exist), that's on me.

(I actually used this occasion to softly threaten one of the marketers from the top of my box with legal action, because they are clearly breaking Polish law - they tried the "this message is only request for consent to sent the actual message" trick, but executed it badly.)

So GDPR would solve some of the problems? That sounds great to me. It can also cut some borderline grey data companies.

Fuck the unsubscribe button. I never subscribed in the first place.

It’s one disgusting thing when people hide signup behind email confirmation without clearly marked opt-in spam confirmation. It’s another when I get home from a professional event and I have a dozen new “subscriptions” and people “just reaching out” or “following up on our prior conversation” to a single-purpose email address I gave to one place and used a fake name and fake company name.

Email marketing can get fucked.

It's not like legitimat-ish email marketing will suddenly switch to scammers or illegal spam, they would actually get in trouble for violations. Companies that don't rely on scams aren't desperate enough to risk getting fined for such a weak lead (I'd hope).

Not that I'll ever configure my email client to automatically download images, as far as I'm concerned downloaded images is just making your email address more valuable to the spammer by confirming you got it.

True, but the "law abiding" corporations are the problem for my privacy, not spammers.

Sure… but that is always true when it comes to law. I just don't see how that makes the situation worse for the people?

I don't want to be tracked by marketing emails without consent (or, more realistically, ever, because please). If you want to do it anyway, from here on out you have to violate the law.

If you had no trouble with doing that before (being a filthy spammer/scammer), you still won't. If you do, then you will stop tracking me. Hooray.

You're right, but this law isn't targeted at scams and malware. It's meant to stop broader commercial tracking, and leaves us better off on that front, while criminals were going to do what they do anyway so we're no worse off there.

Actually it does, because if industry stops using tracking pixels, it demotivates email clients from having to support it, and makes it easier to block bad actors. Same with tracking on websites and browser support. Chrome would instantly put in a tracking blocker if Google couldn't do tracking any more. But so far Google's strategy is fighting and working around the law because they think they would lose a huge amount of revenue without tracking.

> it demotivates email clients from having to support it.

Hardly. It's just the abuse of being able to display images in HTML-formatted mail. You would have to remove every tag and attribute that is able to request an external URL from a mail HTML dialect to counteract tracking.

> but now scammers and malware spammers have the floor instead.

That's a non-sequitur and complete nonsense unless you want to suggest that GDPR automatically turns marketers into criminals.

Also, just because it can't solve all of the problems at once doesn't mean it's a bad thing.

Have the floor? How does this change the behaviour of scammers in the slightest?

Laws don't stop criminals from being criminals (except when they do of course), but it isolates them so they can't easily blend into the crowd of non-abusive individuals.

Plus, if something is illegal there's less likely to be an industry driving down the price of that activity. If something is more expensive and less convenient, then people (including criminals) are less likely to do it.

What surprises me more is that tracking pixels even work anymore. What email clients don't bother to filter them out?

Do any email clients block tracking pixels? My understanding is that they block images by default but if you choose to view them you will load all the tracking pixels.

Article author here - Tracking pixels aren't blocked per se in most email clients but you're correct that they rely on images being loaded.

Thanks for answering, it's curious enough that I'm now looking into Thunderbird plugins to see if there's one to block (or try to) tracking pixels.

Thunderbird blocks images per default. I never bother to load them.

Just to be clear, it blocks remote images by default. Images embedded in a mail are displayed.

I guess I'm just not that familiar with HTML email anymore in general, and when I do read it I generally do not have images regardless.

I always assumed that disabling 1x1px images would be first on the list of mitigations against this technique. I was under the impression that email clients, in addition to an option to block images in general (usually on by default for an address or origin), generally prevented the loading of remote images. Embedding images directly into emails is fine, isn't it?

Depending on the platform used to send the email, it's trivial to change that pixel to any other image, ie a brand logo in the template.

On the whole, disabling images entirely is the only real defence against email tracking.

Or I guess the mail server could just always precache all images at the time of receipt. Then nothing new happens when the mail is read. I think somebody here is describing GMail's approach that way.

gmail's cache hides a users location but you can still tell when they've opened an email, and you can still get a ton of information if they click a tracked link within the email as well.

Then email servers would have to download billions of images of which 99% the corresponding email won't even be opened

The easiest way is to disable them by default which is why Thunderbird defaults to not loading from senders not yet whitelisted, which thankfully most HTML email has the text on the email, it's those darn emails that have all the text in an image that I get suspicious of and delete (usually spam / probably malware). It would be nice to see plugins to block them for sure. I use Thunderbird for work, keep forgetting to use it for regular email. At least even webmail email services block pictures by default now, probably to prevent browser exploitation, never know when someone finds some rogue PNG exploit.

You can't tell if an image is a 1x1 pixel until you load it from the server. At that point, the pixel has already done its job.

Most email clients these days don't block images by default unless it ends up in the spam mailbox.

They never embed images directly into emails either.

At least Thunderbird and Outlook on Mac block images by default and you can whitelist people from your address book.

Gmail, among others. Gmail proxies remote content when the email is opened, so the IP address of the user is not disclosed, but the time and number of opens can be tracked.

Google could proxy and cache remote content in emails when they are accepted by Gmail servers, and that would render Gmail users untrackable by third-parties.

The decision to not cache was a compromise with email marketers after many years. Originally, gmail would not show embedded images by default at all: https://nakedsecurity.sophos.com/2013/12/16/gmail-takes-imag...

I am surprised that Apple's built-in email clients on both macOS and iOS load remote content by default. One of the first things I disable when I set up a new machine.

Do they? I've just loaded a gmail email on my phone, it says "This message contains unloaded emails", with an option to load them.

Well recently they were used in an underhanded means by the DOJ against a Seal team member they were prosecuting, they did it to his lawyers

https://www.theguardian.com/us-news/2019/may/13/navy-seals-l...

Reply on news.ycombinator.com