Does this CSS code expose if a message is read, and how long they have been reading it?

Question

This email analytics company offers an 'engagement metric' that shows how much time someone spends looking at an email, whether the email is printed or deleted.

They also claim it works in pretty much all email clients, be it web, desktop or mobile.

Looking at an example for the tracking code (first link), I can see how they track prints, but how do they track how long you have been reading the email and whether or not you delete it?

Answer 1

The email includes references to an externally-hosted images, like http://example.com/[tracking_id].png, where the tracking company controls the server hosting the image. The company records how and when each unique image URL is loaded by a mail client.

As you've noted, print operations can be logged by a tracking image in the @media print CSS directive. This assumes that the tracking image will not be loaded until the user actually prints the email.

Length of viewing time could theoretically be tracked by a slowly-loading image. The server would keep the HTTP response permanently unfinished, and it is only terminated when the user navigates away from the email. The server can log how long it took for the client to terminate the connection. However, I haven't observed this slow-load behavior in HTTP. It might be possible to do something similar with TCP sockets, which might be kept open even after the HTTP request completes (since the image is served with Connection: keep-alive), but my initial research suggests that the TCP connections may be kept alive after navigating away from a page that requested that keep-alive resource.

Excluding this possibility, it appears that the code you've included doesn't track time spent looking the email. Possibly time-tracking is a premium feature not enabled for this tracker.

The only other (mildly ridiculous) possibility I could consider is that the /F resource is somehow loaded when a navigation action is performed (i.e., the navigation action causes a manipulation to the document structure that causes the CSS rule to apply). If this (quite out-there) theory is the case, time-tracking will only work on Web-based mail, though.

Finally, they don't have ability to detect deletions. That article simply assumes that a user who has spent less that 2 seconds looking at an email has deleted it.

Answer 2

I get these questions from clients on a regular basis. The fundamental problem is that any email tracking technology requires cooperation from the client. The other answer dissected the image tracking so I won't repeat it here, other than to point out that the client must load the image from their server (said server is now on my block list).

Web-based email clients will fight you tooth-and-nail on css issues, so they probably have an inline option or just tailor delivery based on the recipient's MX record. Desktop clients usually have a "download images" option, very easy to turn off.

So, it's possible to know (or guess) what the reader did with your message IF they cooperate with you. If 40% of your messages come back as "unread" it doesn't mean they weren't read, it just means the client didn't tell you if they were read. Similarly I can see a virus scanner grabbing everything to process it being interpreted as "read and deleted".