Apple Mail Privacy Protection changed what an open rate means. If your reports still treat every open as a person reading your message, some of your numbers are probably wrong, and some of your automation is probably acting on bad data. This guide explains how tracking pixels work, how Apple Mail Privacy Protection and other image proxies distort opens, what we recommend measuring instead, and how to build sunset, re-engagement and A/B testing rules that do not depend on a signal you can no longer trust.
How a tracking pixel actually works
An open is not something the recipient does. It is something your tracking system infers. When we send a message with open tracking switched on, the HTML includes a very small image, usually one pixel by one pixel, hosted at a unique web address. That address contains an identifier for the message and the recipient. When an email client loads the images in the message, it requests that address, and the server records the request along with the time, the IP address and the user agent. That record is shown to you as an open.
Notice what the record proves: that something requested the image. It does not prove that a person saw the message, read it, or even looked at the screen. Several things can request the image without a person being involved, and several real readers never request it at all.
- Images blocked. Some people read mail with remote images off, so a real read produces no open.
- Plain-text clients. A plain-text version has no image, so no open is recorded even if the message is read in full.
- Preview panes and previews. A client may load images for a preview that the person never opens.
- Security scanners and gateways. Corporate filters may fetch images and links to check them, which creates a request within seconds of delivery.
- Privacy proxies. A service loads the image on behalf of the reader, often before the reader looks at the message. This is the case that matters most today.
Click tracking works differently. A tracked link points to a redirect address on a tracking domain, which records the click and sends the person on. Clicks are not free from noise either, because security scanners sometimes follow links, but a click needs a deliberate fetch of a specific address and is a much stronger signal than an image load. The setup of that tracking domain also matters for alignment and HTTPS, which we cover in our guide to custom Return-Path and tracking domains.
What Apple Mail Privacy Protection does to your opens
Apple introduced Mail Privacy Protection with iOS 15, iPadOS 15 and macOS Monterey. When a user turns it on in the Mail app, Apple downloads the remote content in incoming messages through proxy servers, in the background, and hides the real IP address of the device. The practical result for senders is that the image request no longer reflects what the reader did.
| What you used to rely on | What happens with protection on | Effect on your reports |
|---|---|---|
| Open time | The content is fetched when the message arrives, not when the person reads it | Opens appear at delivery time, so time-of-day and send-time analysis becomes misleading |
| Open or not | The image is loaded whether or not the person ever opens the message | Unread messages are counted as opened, so open rates rise |
| Number of opens | One fetch can stand in for many reads, or for none | Repeat-open counts and re-open rules stop meaning anything |
| IP address and location | Requests come from the proxy network, not from the device | Location-based and device-based personalisation of opens is unreliable |
| Mail client detection | The user agent can look like a generic client | Client breakdown reports undercount the affected audience |
The share of your list using Apple Mail varies a great deal between businesses, and the share who have turned protection on varies too. We will not quote an industry figure here, because it would not describe your audience. Measure your own list instead: look at the proportion of opens that arrive within a few seconds of delivery, and at recipients who register opens but never click, reply or buy across many months. Those two patterns usually reveal the size of the problem.
Important: Mail Privacy Protection does not stop clicks, replies, purchases or unsubscribes from working. It only weakens the open event. That is why the fix is to move your decisions to signals that need a human action.
Other things that distort opens
Apple is the best-known case, but it is not the only one. Gmail serves images through Google servers, which hides the reader address and caches the image, as described in the help pages for Gmail. Some corporate gateways prefetch both images and links. Some clients load images only after the user confirms, which undercounts real reads. Together these effects mean that opens come from a mixture of real readers, proxies, scanners and silent readers, and you cannot separate them perfectly.
There is one more effect to keep in mind. If your open rate is being raised by proxies, a sudden drop can still be a real warning. A fall in opens across all clients at the same time often means the mail is being placed in spam or blocked, so a falling trend is more useful than the absolute level. Pair it with the delivery signals described in our guide to deliverability metrics before you draw a conclusion.
What to measure instead of opens
No single metric replaces opens. A good reporting view combines signals that are hard to fake and that line up with what you actually want from a message. We group them in three layers: whether the message reached the mailbox, whether people acted, and whether people are unhappy.
| Signal | What it tells you | Reliability | Watch out for |
|---|---|---|---|
| Delivered and accepted rate | Whether receiving servers accepted the message | High | Acceptance is not inbox placement |
| Bounces and deferrals | List quality, blocks and throttling | High | Read the codes, see our guide to bounce codes |
| Spam complaints | How many recipients reported the message as unwanted | High but partial | Not every provider reports complaints to senders |
| Unsubscribes | Relevance and frequency problems | High | A hidden or broken unsubscribe link raises complaints instead |
| Clicks and unique clickers | Interest in the content | Medium to high | Scanners can follow links, so look at patterns |
| Conversions and revenue | Business outcome | High | Attribution windows and last-click bias |
| Replies | Real conversation, most useful for cold and transactional mail | High | Auto-replies and out-of-office messages |
| Reputation data from providers | How a mailbox provider sees your domain and IP | High | Only available at enough volume |
| Open rate | That something requested the tracking image | Low | Proxies, prefetching and image blocking |
For Gmail, the strongest data you can get directly is the reputation and spam-rate information in Postmaster Tools, which we explain in our Google Postmaster Tools guide. For complaints, the process for feedback loops is described in our guide to complaint rates and feedback loops. Both are independent of any tracking pixel.
Use event data from your sending platform
We send the mail for you and you receive event data about what happens to each message: accepted, delivered, deferred, bounced, complained, and where tracking is enabled, clicked or opened. Check your MigoSMTP account for the exact events and tracking options available to you. If you want those events in your own database, our guide to email webhooks and signature verification shows how to receive them safely. Store the raw events, then compute the metrics you choose, so that you can change your definitions later without losing history.
Rebuilding engagement segments without opens
Many sunset policies were written as rules such as: no opens in 90 days, remove. With protection enabled, a person who never reads your mail can still look active forever, and your list never shrinks. The opposite error is also possible: a real reader on a client that blocks images looks inactive and gets removed. Both mistakes cost you, one in complaints and wasted volume, the other in lost customers.
The fix is to define activity by actions. Here is a segment model that works for most senders, using only signals that need a person.
| Segment | Definition (example windows) | Treatment |
|---|---|---|
| Active | Clicked, replied, purchased, logged in or updated preferences in the last 90 days | Normal schedule, full programme |
| New | Subscribed within the last 30 days, confirmed address | Welcome series, no engagement filter yet |
| Cooling | No qualifying action for 90 to 180 days | Lower frequency, best content only |
| At risk | No qualifying action for 180 to 365 days | Re-engagement series with a clear reason to stay |
| Inactive | No qualifying action for over 365 days, or no response to re-engagement | Suppress from marketing, keep the consent record |
Pick windows that match how often your customers really buy or need you. A seasonal retailer and a monthly invoice sender should not share the same numbers. Our full process for cleaning and sunsetting, including how to word the final message, is in the list hygiene and sunset policy guide.
Design the re-engagement message around a click
Because you cannot trust an open, build the re-engagement flow around an action that a machine will not take by accident. Ask people to confirm that they want to stay, choose their topics or frequency, or update their details. A single, clearly labelled button works better than several links. If nobody acts after two or three messages over a few weeks, move the person to the suppressed group. Keep the suppression record so that the address is never mailed by accident, as described in our suppression list guide.
Use opens carefully, if at all
If you keep opens in a rule, keep them out of the deciding position. A reasonable use is a tie-breaker inside a group that is already defined by actions, or an alert when opens for a non-Apple segment fall sharply. Do not use a recent open as proof that a person is active, and do not use a missing open as proof that a person is inactive.
A worked example
The numbers below are invented to show the method, not a benchmark. Imagine a newsletter sent to 50,000 subscribers over 90 days, with a sunset rule based on opens and a new rule based on actions.
| Group | Subscribers | Opened at least once | Clicked or bought | Opened but took no action |
|---|---|---|---|---|
| Recent joiners (under 30 days) | 6,000 | 5,400 | 1,800 | 3,600 |
| Existing subscribers | 44,000 | 39,600 | 7,040 | 32,560 |
| Total | 50,000 | 45,000 | 8,840 | 36,160 |
Under the old rule, 45,000 of 50,000 subscribers, or 90 percent, count as active, and the sunset rule would remove only 5,000. Under the new rule, 8,840 people took a real action, which is about 18 percent. The 36,160 who opened but did nothing are not necessarily lost. Many are real readers who simply do not click, and many are machine opens. This is why the new model does not delete them: it moves them into the cooling and at-risk groups.
Suppose that, of the existing subscribers, 5,000 had no action for over 365 days. They receive a three-message re-engagement series, and 600 respond by clicking the confirm button. The remaining 4,400 are suppressed from marketing. The next send then goes to a list that is about 4,400 addresses smaller, which usually means fewer complaints and lower bounce risk, and the reported open rate will fall, because many proxy-opened inactive addresses have left. That fall is not a loss of performance. It is the report becoming more honest.
Tip: Before you change the rules, export the current numbers and keep them. When the open rate drops after cleaning, you will want to show stakeholders that the change came from the definition, not from worse content.
What Apple Mail Privacy Protection means for A/B testing
Subject line tests were often judged by open rate. That was always an imperfect proxy, and with proxies loading images it can mislead you. If one group has more Apple Mail users by chance, its open rate will look better regardless of the subject line. A test with a few thousand recipients per variant can easily be decided by that imbalance.
- Judge by clicks or conversions. The subject line affects whether the person opens, but the goal is the action that follows. Use unique clicks per delivered message, or a conversion event, as the winning metric.
- Balance the groups. If you know the mail client or provider, stratify the split so each variant has a similar mix. If you do not, use a large enough sample and a real significance check.
- Exclude machine-like opens. If you must compare opens, drop those that arrive within seconds of delivery, and compare only the remainder.
- Test things that do not need opens. Content, offer, call to action, layout and sender name can all be judged by clicks and conversions.
- Be careful with send-time tests. Open timestamps now often show the delivery time rather than the reading time, so a send-time winner based on opens is unreliable. Use click times or conversion times.
- Avoid automatic winner sends based on opens. A rule that sends the winner after a short wait on the basis of open rate will mostly pick the variant with more proxy-opening recipients.
Protecting deliverability while you change the rules
Removing the open signal from your decisions should not remove the discipline behind it. Mailbox providers still look at how recipients treat your mail, and they have their own, unfiltered view of real behaviour. Keep complaints low, keep bounces low, authenticate properly and make unsubscribing easy. Our guide to one-click unsubscribe and the List-Unsubscribe header explains the header that mailbox providers now expect from bulk senders.
Moving away from opens also changes how you read a warm-up or a new-domain launch. During warm-up, do not wait for a high open rate to increase your volume. Use accepted rates, deferrals, complaints and mailbox provider reputation data instead, as we explain in our warm-up guide.
Finally, remember privacy and consent. Tracking is covered by your privacy policy and, depending on where your recipients live, by consent rules. If you need to document what you track and why, the guidance in our GDPR article is a good place to start. Check your MigoSMTP account for how open and click tracking can be turned on or off for your sending, and make the choice according to your reporting needs and legal obligations rather than any assumed effect on inbox placement.
Checklist: making your reporting resilient
- Measure the share of opens that arrive within seconds of delivery, and the share of openers who never act.
- Remove open rate as a headline figure on dashboards and replace it with clicks, conversions, replies and unsubscribes.
- Add delivered, bounce, deferral and complaint rates to the same view.
- Rewrite every automation that triggers on an open so that it triggers on an action instead.
- Redefine active, cooling, at-risk and inactive using actions and time windows that fit your business.
- Build a re-engagement series that asks for one clear click, then suppress people who do not respond.
- Change A/B test winners to clicks or conversions, balance the groups and stop open-based auto-winners.
- Set up Postmaster Tools and complaint feedback, and review the numbers monthly.
- Write the definitions down and review them every quarter.
Sources and further reading
These are public documents from the organisations behind the behaviour described above. Features change, so check the current pages.
- Apple Newsroom: the announcement of Mail Privacy Protection with iOS 15, iPadOS 15 and macOS Monterey
- Google: Email sender guidelines for Gmail
- RFC 8058: Signaling One-Click Functionality for List Email Headers
- RFC 2369: The Use of URLs as Meta-Syntax for Core Mail List Commands
Want cleaner engagement data? Talk to us about the event data you receive from MigoSMTP, and how to feed it into your segments and reports.
Frequently asked questions
What is Apple Mail Privacy Protection?
It is a privacy feature in the Apple Mail app that users can switch on. When it is on, Apple loads remote content in a message, including tracking images, through its own servers in the background instead of letting the sender see the real device. The sender gets a request that does not prove the person read the message.
Does Mail Privacy Protection block email tracking completely?
No. It hides the real IP address and prevents senders from seeing when a message was genuinely opened, but links still work and clicks are still recorded when a person taps them. Replies, purchases and unsubscribes are also unaffected. What changes is the reliability of the open event.
Are my open rates now useless?
Not useless, but unreliable as a measure of attention. Opens can still hint at trends in a segment that is not affected by proxies, and a total collapse of opens can point to a delivery problem. Treat them as a weak signal and never use them as the only basis for a decision.
Why did my open rate jump after Apple changed how Mail works?
Many Apple Mail users switched protection on, and their messages are fetched in the background even if nobody reads them. Those machine fetches are counted as opens by tracking systems that do not filter them, so rates rise without any real change in reader behaviour.
Can I tell real opens from machine opens?
Only partly. Opens that arrive within seconds of delivery, many opens from the same proxy network, and opens with no later click or action are suspicious. You can filter on those patterns, but no filter is perfect, so use the result to reduce noise rather than as a precise count.
What should I use for a sunset policy if opens are unreliable?
Use actions that need a human: clicks, replies, purchases, logins, preference updates and form submissions. Combine them with a time window and the age of the subscription, and use opens only as a minor tie-breaker, if at all.
Should I still A/B test subject lines?
Yes, but judge the winner by clicks or conversions rather than opens. If you must use opens, split the test so that the groups are balanced by mail client, or exclude recipients whose opens look automated, and treat a small difference as noise.
Do other mailbox providers also load images through a proxy?
Yes. Gmail serves images through its own proxy, and other clients and security gateways may prefetch links and images. The details differ, so the same rule applies everywhere: an image request is evidence that something loaded the image, not proof that a person read the email.
Will turning off open tracking improve deliverability?
There is no reliable evidence that removing a tracking pixel by itself changes inbox placement. Authentication, list quality, complaint rates and sending habits matter far more. Decide on tracking according to your reporting needs and privacy policy, and check your MigoSMTP account for the tracking options available.