Email Inbox
Researchers discovered a new email threat called Ropemaker can insert malicious URLs after the email is received. 27707/Pixabay

An expert says emails can now be used to track a person’s movements -- specifically, when they’re online and checking emails, and where they are at the very moment they do that.

In today’s world, cookies are more than just chewy sweet treats that can be filled with chocolate chips, nuts, and other things. They can be used to track a person’s movements on the internet, helping ad companies to know what a person is looking at whenever he or she browses the web, and ultimately helping to form a profile of a person’s interests.

Now, a person who used to run a journalism startup called Newsvine and was VP of design at one of the most popular social media apps today, Twitter, said emails can be used to track a person’s location and email activity.

Mike Davidson, VP at InVision, a company that develops design prototyping software, shared in a lengthy blog entry that a certain service called Superhuman attaches “tracking pixels” to the emails its users send. These “pixels” then inform the email sender if the receiver has opened or read their email, and the location the receiver is at when he or she opens the email.

What’s more, Superhuman also tells users the number of times a receiver opens the email they sent, along with a timestamp and their location when they opened it.

Email address
30 percent of CEOs have had their email credentials leaked online, a study found. geralt/Pixabay

What’s the big fuss?

Some people on the internet responded to Davidson and said other companies and email providers also track people’s email use. Davidson said Superhuman’s approach is very different and is worth calling out for a few reasons.

  • First, “Read Receipts” or the reports Superhuman users get notifying them that the receiver has read their email, are turned “on” by default on Superhuman. This feature, though existent in other services like Apple’s iMessage or Microsoft’s Outlook, is turned “off” unless the receiver personally and deliberately turns it on to let message senders know they’ve read their messages.
  • Second, imagine a scenario where people in higher positions in the workplace send emails to workers in lower positions. The feature “can be used as a tool to monitor or coerce around-the-clock work.”
  • Third, Davidson pointed out that while people can turn images off on their email apps (to prevent Superhuman from tracking them), not a lot of people do that. These means that for the people who don’t turn images off, Superhuman can work as some sort of spyware that extracts location data allowing it to create a “map” that gives away the email receiver’s location at any given time.

Davidson gives a few recommendations for people so they can protect their privacy:

First, he recommended avoiding the use of Superhuman. Not only does it track receivers; it also prevents users from blocking the spyware pixels it uses. Users can be tracked, as well as everyone they send emails to.

Second, he recommends turning remote image loading off regardless of email client. iPhone users, however, cannot do this on Gmail for iPhone, and are thus advised to use Outlook since it allows them to use their Gmail accounts, and turn image loading off, without the need to migrate to another client.