Email read-tracking is not GDPR compliant

https://blog.ohmysmtp.com/blog/your-emails-are-not-gdpr-compliant/

48 84 5 years ago

blog.ohmysmtp.com

draw_down• 5 years ago

Yeah, how's that GDPR working out? I feel like it was meant to do more than spur blog posts such as this one

Nextgrid5• 5 years ago

The spirit of it is good, the enforcement has been significantly lacking and the regulators who are supposed to enforce it appear incompetent or unwilling to do so.

SiempreViernes• 5 years ago

You can check here https://www.enforcementtracker.com/

Nextgrid5• 5 years ago

That link gets posted all the time, often as a rebuttal to the "no enforcement" claim but the web being littered by non-compliant tracking consent flows clearly shows there is not enough enforcement.

As a reminder, I don't believe the majority of consent flows on the web are compliant with the regulation. As per the ICO's guidelines (the UK data protection regulator) https://ico.org.uk/for-organisations/guide-to-data-protectio...:

Consent requires a positive opt-in. Don’t use pre-ticked boxes or any other method of default consent.
Keep your consent requests separate from other terms and conditions.
Make it easy for people to withdraw consent and tell them how.
Avoid making consent to processing a precondition of a service.

The majority of consent flows out there don't comply with at least one of these points, so the fact they're still out there 3 years after the regulation went into effect suggests enforcement is indeed lacking.

Daho0n• 5 years ago

Not perfect but much much better than before. I can give you two personal examples of how even small stuff that used to be ignored now demand attention:

I installed a game that had a bug (opt-in to tracking wasn't working so tracking was always on). Lots and lots of users complained in the game developers forum but nothing happened. Not even a reply. I and a few others wrote emails to the support mail and nothing. Then I threatened with GDPR months later and two days later support was on my case and my data was deleted from both their system and the third party they used for tracking.

Here in Denmark businesses aren't allowed to receive updates from the CPR registry (like SSN) if you aren't a customer anymore. It's used for stuff like banks automatically getting your new address if you move. Historically sending mails to those that didn't remove you from their updates didn't do anything. Now they run quickly as soon as they read "GDPR".

There are big businesses that get away with things they shouldn't but by far the most problems can now be resolved, even small stuff that big businesses before didn't lift a finger to fix where the little man had no chance in hell. Now they (we!) do.

NDizzle• 5 years ago

Excessive. I don't care what the EU thinks.

Nextgrid5• 5 years ago

Then you are welcome to opt into tracking. I think the EU's approach of default being "no tracking" is good - you can always decide to opt-in, but the default is safe.

pc86• 5 years ago

Which is fine for companies located in the EU.

The EU has absolutely zero authority to tell business located outside of the EU what to do. The fact that someone reading a blog post happens to be in Europe does not all of a sudden put the owner of that blog under EU jurisdiction.

jpttsn• 5 years ago

Life in the EU is wonderful. It’s like waking up every morning wearing a helmet. You can take the helmet off at any time, but the default is safe.

slig• 5 years ago

Thanks to some bureaucrats on EU now all the world has to deal with the stupid cookie banners everywhere.

petepete• 5 years ago

Thanks to some scummy advertising tactics*

ncallaway3• 5 years ago

I, as an American, am extremely thankful for the latest version of cookie banners.

Yes, the first version of cookie banners was awful and pointless. This latest iteration (of compliant banners) is wonderful, though.

They actually give me functionality that I _really want_. I click the "manage preferences" option on every single one for every site that offers it. I opt out of everything except for strictly necessary cookies for site functionality.

I am genuinely thankful for the GDPR era of cookie banners.

MereInterest• 5 years ago

No, it's thanks to targeted advertising. GDPR banners are completely unnecessary if you don't stalk your users. Stick to traditional advertising, and you don't need to remove user privacy, and therefore don't need to have any banner.

loloquwowndueo• 5 years ago

Use a “I don’t care about cookies” browser extension. Deal with it once, and then never again.

simion314• 5 years ago

Don't this website detect you are not in EU and don't bother you with any popup? From EU I see the reverse where the websites will detect I am EU and refuse to work.

Also you should be able to click on the GIANT button on the popup and never see it again.

I bet you also complain that thx to some other bureaucrats now all your marketing emails must include an Unsubscribe link.

bitwize• 5 years ago

It's well known that internet companies will fuck you in the ass if they're not strictly regulated. GDPR is a start, but honestly it doesnpt go far enough since companies have found ways to wriggle around it and/or it isn't enforced nearly enough. Sufficiently frustrated companies can just leave the EU market. What's needed is a worldwide framework like the WIPO with treaties to specify multilateral regulations and enforcement procedures.

n3storm• 5 years ago

While I support projects like ohmysmtp.com, I don't like the misinformation the post contains. There is not a single MUA that does not block, alert, warn user when hidden pixel is found, and also when any link in the message doesn't start with https...

proactivesvcs• 5 years ago

Not sure why you're being downvoted - I can't remember coming across an email client that doesn't support this, and many seem to do it by default these days.

mijamo3• 5 years ago

Gmail does not.

And even those who do are not warning you about the tracking part, only about loading resources. Most users will just think that they want to see the nice images and accept and have no idea that it means they are tracked.

gwd• 5 years ago

"Thanks for opening this email. We’ve logged that you read it, we’ll log again next time you open the email. We know where you’re located, and what device you’re on. We’re using this information to tweak our emails to get you to open and read more of our emails in the future"

Nice

Spivak4• 5 years ago

I think the paragraph after it kinda undermines their thesis though. There's nothing meaningfully different about an email and a website. They're both documents that you render locally on your client. The delivery mechanism doesn't really matter.

You would probably find it really weird that a NYT article archive HTML page you have on your machine still tracks you because you client runs the JS if it wasn't already the norm. But then why does downloading that same document on-demand change your expectation of being tracked? Or if we were in a alternate universe where web pages were hyperlinked PDFs I bet you would find it odd that opening one in Acrobat sends all your interactions to some server somewhere.

It's fine that by convention we have some places where it's not kosher to track people but we at least have to admit that the distinction is arbitrary and that being upset about email tracking but not website tracking is inherently inconsistent. Because sure you can name differences between emails and websites but nothing really fundamental.

mijamo3• 5 years ago

It is fundamentally different because when I track and email I know who I'm tracking and I will look at the data on and individual basis. For instance "great, that client has opened my contract email 5 times. Means they are interested.I can adapt my negotiating position based on that".

For websites I would look as the data in aggregate. Sure that aggregation can be pretty precise but still it is not on the personal level. I suppose technically speaking you could checks the individual use of a website for logged in users but even Google Analytics is very explicit on hat not being OK for instance, and there is no UI for it in any tool that I know.

ddevault• 5 years ago

Do you send emails through a service that let’s you see if the email was opened?

No.

ryandrake• 5 years ago

The sad thing is we already have a privacy friendlier alternative to spy pixels: Read Receipts, defined in RFC 2298. They are already user opt-in. Don’t most mail agents support them?

ncallaway3• 5 years ago

Sure, but most users don't or won't opt in to those, so the advertisers want to find a way to track people that isn't opt-in.

thekyle2• 5 years ago

It's not like only advertisers would benefit from read recipes in email. It would be very useful to know when your friend opens your message, which I assume is why basically every mainstream messaging app has the feature.

captainmuon• 5 years ago

Why would you want to track whether an email is read? That's creepy and obnoxious. Part of the social contract with mail is that it shouldn't matter if you haven't read it yet or if you read it and decide to answer later. Mail is an asyncronous medium and you should respect that and not micromanage your customers IMHO.

GhostVII2• 5 years ago

Because if you send emails to people who don't read them, eventually they will flag you as spam (even if they signed up for the emails in the first place), and then you will start getting blocked as spam by Gmail.

Also it's generally useful to know if a particular email is read so you can test out different formats and whatnot.

forgetfulness• 5 years ago

Because if you send emails to people who don't read them, eventually they will flag you as spam (even if they signed up for the emails in the first place), and then you will start getting blocked as spam by Gmail.

Probably because those email newsletters are spam sent to people who interacted with a form once.

inetknght2• 5 years ago

if you send emails to people who don't read them, eventually they will flag you as spam

That's because you're spamming them.

even if they signed up for the emails in the first place

Users can change their mind. Clicking anything in an email leads to susceptibility of phishing. So they shouldn't need to click an unsubscribe link to do so. Reporting you for spam is the safest option from their perspective.

And I would argue that most users didn't sign up for the emails. They were conned into giving their email and usually for a completely different purpose.

Also it's generally useful to know if a particular email is read so you can test out different formats and whatnot.

That's a very dubious assertion. Formats are in the content of the email. Different formats won't tell you why one email was opened while another was not.

kenny11• 5 years ago

But the problem with relying on tracking pixels to flag whether a message is read is that not everyone loads them.

I've had my mail clients (and Gmail) set for years to not load external images, and occasionally get "we notice you haven't been reading our messages so we're going to stop sending them to you" emails from mailing lists that I do actually read.

qwerty4561272• 5 years ago

Why would you want to track whether an email is read? That's creepy and obnoxious.

Indeed it is! Yet messengers like WhatsApp and Telegram always mark the messages that have been read. And I really hate this. Given the fact the actual messengers still are pretty good and very useful, I would pay them a premium if they could hide when have I been online and what messages have I read.

Spivak4• 5 years ago

I think most other messengers, iMessage, FB Messenger get this right that you can disable read receipts but then you won't get to see other people's either.

I really really enjoy having them. They make me feel less anxious about messages.

SerLava• 5 years ago

I refuse to use any service that reports on my active use of the service. The "seen" feature was created like a decade ago, and that took me from occasionally using Facebook, to never using Facebook.

Tomte• 5 years ago

There is an option in WhatsApp to do exactly that.

Ayesh• 5 years ago

But they are different to email. I actually enable seen notifications for people because it's very frustrating for real-time communication. Email is not meant to be that.

tinus_hn• 5 years ago

It’s just a setting (‘Read Receipts’), the price is that if you turn it off you can’t tell if others have read your messages either.

Spivak4• 5 years ago

I mean I think you know the answer to this question. Because these emails aren't "communication" but marketing campaigns that companies want to track the effectiveness of. Your inbox is nothing to these companies but another vector to put their brand in front of your eyeballs.

legohead2• 5 years ago

Think in terms of a mailing list for a business, like a newsletter.

It costs money to send out emails. If 50% of your users aren't reading them, you can trim the list of those who don't open the email.

nullserver• 5 years ago

The direct cost is near zero.

Staying on the good side of spam blockers is a much bigger deal.

Nextgrid5• 5 years ago

If you're asking yourself whether someone would read an email it's probably time to reconsider sending that email in the first place?

alisonkisk4• 5 years ago

When done properly (as the article describes), it's a courtesy feature under the control of the recipient.

qwerty4561272• 5 years ago

My e-mail client always tells me the sender wants a read receipt and also asks if I want to load external resources. If yours doesn't let you control this I strongly recommend to look for an alternative.

robinjfisher• 5 years ago

"In the UK and the EU, the GDPR requires organisations to inform recipients of the pixels, and in most cases to obtain consent for them. It’s not enough to just have a privacy policy somewhere that details this."

No it doesn't and yes it is.

Nowhere in the GDPR or in the UK implementation does it say that recipients need to be informed of pixels in and of themselves.

What it does say is that when you obtain the recipients' personal details you must provide them with a privacy notice setting out what data you collect and what you do with it. The privacy notice needs to be provided on collection of their data (when directly collected) or within 30 days of collection if from a third party.

There is no reason to not obtain consent to tracking but to suggest it's the only lawful basis on which to process the data is not correct. Subject to completion of an impact assessment, one could make a case that it falls under legitimate interests depending on the degree of processing of the tracking data e.g. the more that such data is used to inform further targeting of the individual vs. say aggregation of data for improving engagement.

I agree with your underlying point though - I turned off tracking (I use Postmark for transactional emails) because I don't really care about open rate and click rate etc. If my customers want to ignore the emails from the service it's up to them.

DisjointedHunt2• 5 years ago

The GDPR delegates the specifics of the requirements to the DPA of member countries.

The French CNIL, for example, has already fined Google and Amazon $100M+ for this very issue: https://www.huntonprivacyblog.com/2020/12/14/cnil-fines-goog...

GDPR is a nightmare and a case study in how regulations can terrorize entire industries or the abilities of individuals to innovate freely. Just read the chronology of events in that link above and try playing devils advocate that the CNIL did not amend those laws to specifically target these two companies. It's scary.

alisonkisk4• 5 years ago

They amended "rules", not "laws", which is what rulemakers do when they discover behaviors that violate the law (subject to interpretation, as intended) but not the rules.

quonn• 5 years ago

„Consent of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

[...]

4. When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.“

An email address is always personal and tracking if the email was opened ties it to that personal data.

So yes, the user has to consent.

dpedu2• 5 years ago

At the risk of conflating Gmail and email - doesn't gmail download automatically and serve images in emails from a google-owned server? Seems like this would completely defeat this kind of tracking.

alkonaut3• 5 years ago

They do. So the big splash image which is the same for everyone gets cached and served from google. The tracking pixel has a unique url per recipient (that’s the point) so can’t be cached.

alisonkisk4• 5 years ago

What do you mean? Google caches the tracking pixel, too, unless the email is executing client-side JavaScript, which is extremely rare.

nness• 5 years ago

This seems completely mute if the user has opted-in to the email in the first place, you can just condition this data-capture in the T&C?

alisonkisk4• 5 years ago

No, (it's not a moot point), because GDPR cannot be superseded by T&C.

albertgoeswoof• 5 years ago

Opting into receiving an email is not the same as opting into being tracked by the email. Burying this in T&Cs that no one reads doesn't let the user know this is happening, and continues to violate their privacy.

finnthehuman• 5 years ago

if the user has opted-in to the email in the first place

A burner email address I gave out exactly once to a vendor at defcon 2 years ago has been "opting into" all sorts of new marketing campaigns from many different companies, and as recently as this February.

Explain to me how tracking pixels in those emails are consistent with GDPR's informed consent.

the_gipsy• 5 years ago

Doesn't gmail block this since ever?

IIRC gmail doesn't allow any outgoing requests of email stylings. It strips it out or rewrites it to a re-hosted URL.

jsmith992• 5 years ago

It doesn't block them but it proxies them. They can still see that you read it and when.

mijamo3• 5 years ago

Email tracking works perfectly with Gmail users. You get get the precise time for when the mail is opened, even for repeated opening.

Tested with regular accounts and google workspace.

No idea where this rumor came.

fredsted2• 5 years ago

Like most of the problems EU has tried (and failed) to solve with legislation, like cookie laws, this is an issue that is already entirely solved by the client. If you don't like having external images in your emails, most clients these days support turning it off.

Whether it's a header image or a "spy pixel", both of these things can be used to track you. Therefore the solution is to disable it entirely if you do not like being tracked.

eythian• 5 years ago

this is an issue that is already entirely solved by the client

No it isn't.

What if I want to see the images in an email newsletter, but don't want to be tracked? The client can't give me a button "open images except tracking pixels" because it doesn't have enough information to know the difference.

fredsted2• 5 years ago

What if I want to see the images in an email newsletter, but don't want to be tracked?

That would be nice, but as I already wrote, it's not possible. The only way to have images (or any form of remote resource) in emails, and at the same time avoid tracking, is attaching them.

networkimprov• 5 years ago

Both hey.com[1] (from the Basecamp folks) and TMTP from the mnm project[2] (proposed successor to SMTP) disallow background downloading of remote URLs.

TMTP also specifies Markdown formatting (not HTML), fwiw.

[1] https://hey.com

[2] https://mnmnotmail.org

atoav• 5 years ago

I am not using any html emails. People should send me text. If pics are important attach them.

External (embedded) pictures are deactivated per default, if you want to get at least a tiny chance I see your picture, attach it or gain my trust (and even then, attach it).

JS in mails is completely ignored, it has no business of being there.

It would be nice to live in a world where you could trust sizeable companies not to break the law (or my trust) with every other email they send. It would be nice to have html and css in a mail and not have people abuse it. But as things stand now, not using html is the way to go.

denton-scratch• 5 years ago

Set your mailer to just use text/plain for displaying message bodies. No HTML == no tracking cookies. Any decent mailer will prompt you before sending a read confirmation.

Oh, wait - you're using gmail? I'm afraid you're beyond help.

Email read-tracking is not GDPR compliant

Related Stories