E-mail Web bugs

Web bugs embedded in e-mails have greater privacy implications than bugs embedded in Web pages. Typically, the URL of web bugs contained in e-mail messages carry a unique identifier. This identifier is chosen when the e-mail is sent and recorded together with the recipient e-mail address. The later download of the URL signals that the e-mail has been read. The sender of the e-mail is therefore also able to record the exact time that a message was read and the IP address of the computer used to read the mail or the proxy server that the user went through. In this way the sender can gather detailed information about when and from where each particular recipient reads e-mail. Additionally, every time the e-mail message is displayed another request goes to the sender's web site.

Web bugs are used by e-mail marketers, spammers and phishers, to verify that e-mail addresses are valid, that the content of e-mails has made it past the spam filters, and that the e-mail is actually viewed by users. When the user reads the e-mail, the e-mail client requests the image, letting the sender know that the e-mail address is valid and that e-mail was viewed. The e-mail need not contain an advertisement or anything else related to the commercial activity of the spammer. This makes detection of such e-mails harder for mail filters and users.

Tracking via web bugs can be prevented by using e-mail clients that do not download images whose URLs are embedded in HTML e-mails. Many graphical e-mail clients can be configured to avoid accessing remote images. Examples include the Gmail, Yahoo! SpamCop/Horde webmail clients, and Mozilla Thunderbird, Opera, and relatively recent versions of Microsoft Outlook, and KMail mail readers. But other HTML techniques like iframes can still be used to track e-mail viewing, so some of these clients still are not adequately protecting their users.

Text-based mail readers such as Pine or Mutt do not interpret HTML or show images, so are not subject to tracking by e-mail web bugs. Plain-text e-mail messages cannot contain Web bugs since they cannot have images, and so are safe with any mail client.

Many modern email readers and web based email services will not load images when opening an HTML email from an unknown sender or that is suspected to be spam mail. The user must explicitly choose to load images. Web bugs can also be filtered out at the server level so that they never reach the end user. MailScanner is just one example of gateway software that can disarm iframes as well as web bugs. As a result of these measures, web bugs are slowly losing their effectiveness and can't be relied on to accurately count read rates for e-mail campaigns.