Your open rate is inflated because two of the largest mail platforms load email images on the reader’s behalf. Apple Mail Privacy Protection fetches images through Apple’s servers whether or not the message is opened, and Gmail serves every image through Google’s proxy, sometimes before anyone looks. You can spot these false opens by their timing, their network and their pattern, but you cannot recover the real opens they hide.
This article explains both mechanisms, shows what their opens look like in practice and suggests what to measure instead.
What Apple Mail Privacy Protection does
Apple announced Mail Privacy Protection in June 2021. In Apple’s words, it stops senders from using invisible pixels to collect information about the user, helps prevent senders from knowing when the user opens an email, and masks the IP address so it cannot be used to determine location.
For a sender, that has three consequences:
- Opens without reading. Apple Mail loads remote content, including tracking images, through Apple’s relay servers in the background. A message can register as opened even if the person never looks at it.
- Meaningless timing. The time of the request reflects when Apple fetched the image, not when the person read the message.
- No location or network. You see Apple’s infrastructure, not the reader’s home or office connection.
The protection applies in Apple’s Mail app when the user switches it on. It does not depend on which mailbox provider the person uses: a company address read in Apple Mail on an iPhone is affected in the same way as a personal one.
What Gmail’s image proxy does
Gmail works differently. Google states that Gmail uses Google’s secure proxy servers to serve images in messages, to protect users against image-based security problems. The reader’s device never contacts your server directly; Google does.
The consequences are milder than Apple’s, but real:
- Hidden network. Every Gmail open looks like it comes from Google. You cannot tell an office in Madrid from a phone in Warsaw.
- Fewer repeat opens. Because the image is cached, a person reopening the message may not create a new request.
- Machine fetches. Gmail can fetch or scan an image shortly after the message arrives, before anyone reads it. Those events look like very fast opens.
Gmail’s help page also explains that images are not shown when Gmail considers a sender or message suspicious. In that case you may see no open at all.
How false opens look in practice
You rarely need special tools to suspect a false open. The pattern gives it away.
| Pattern | Likely cause | How much weight to give it |
|---|---|---|
| Open within seconds of sending, from Google’s network | Gmail fetching or scanning the image | None |
| Opens from Apple’s network for almost every Apple Mail recipient, soon after delivery | Mail Privacy Protection preloading | None for reading; it confirms delivery to Apple Mail |
| Several opens within a few seconds | Scanner or proxy, sometimes plus a preview | None |
| Open hours later from Google’s network | Possibly the reader viewing the message in Gmail | Low: a hint |
| Open days later from a mail program on a mobile or home network | Possibly the person coming back to it | Low to moderate: still a hint |
| Click on a link, well after delivery, in a visible browser | Possibly a person | Moderate: stronger than any open |
If your campaign shows a near-perfect open rate among a group of recipients, or every message “opened” within a minute of sending, you are almost certainly looking at proxies.
A quick check you can run on your own data
Take your last 100 tracked emails and sort the opens by delay after sending. Mark everything under one minute. Then mark everything that came from Apple’s or Google’s networks. What remains is the part of your “open rate” that at least might involve a person. Compare it with the figure on your dashboard: the gap shows how much of your open rate was machines, and only the remaining part is worth discussing.
Why you cannot just “correct” the number
It is tempting to subtract the Apple opens and call the rest the real open rate. That removes false opens, but it does not add back the real ones. When an Apple Mail user with the protection on really does read your message, you still cannot see it as a separate event. Some of the opens you just removed belonged to people who read the email; you simply cannot tell which.
So any adjusted open rate is a lower, steadier number, not a true one. It is useful for comparing your own periods or two versions of a message using the same method. It is not useful as an industry benchmark, and published averages that mix machine opens, newsletters and personal emails tell you little about your own outreach.
What to measure instead
For one-to-one business emails, three numbers carry far more information than opens:
- Clicks with a human pattern. Filter out clicks that arrive within seconds of delivery or from data-centre networks, which typically come from security scanners. What remains is a reasonable sign of interest.
- Replies. A reply cannot be generated by a proxy. Reply rate and time to first reply are the most honest measures of outreach. We cover them in reply rate instead of open rate.
- Trends, not single events. Compare the same counting method over weeks. A rise in human-pattern clicks and replies means more than any single “opened” notification.
What this means for reports to your team
If your team or your manager is used to an open-rate figure, change the report rather than the explanation. Show three lines side by side: opens that came from proxies or scanners, opens with no sign of a machine, and replies. Add clicks with a human pattern if you track links. Keep the same method every month so that trends are comparable, and write the counting rule next to the chart. A lower but honest number that moves with real interest is more useful than a high one that mostly reflects which mail app your recipients use.
How HawkOpen handles Apple and Gmail opens
HawkOpen, the tracking app made by TriStiX S.L., does not count every image request as an open. It checks each request against named rules and shows you which rule decided the outcome.
- A request that matches Apple’s privacy proxy gets the category privacy proxy and the rule code R-OPEN-APPLE.
- A request served through Google’s proxy gets the category proxy cache (R-OPEN-GOOGLE). Gmail’s declared prefetching and fetches from Google’s network shortly after sending have their own rules, R-OPEN-GMAIL-PREFETCH and R-OPEN-GOOGLE-SCAN.
- These machine and proxy opens are counted separately from observed opens, so they do not inflate the figure you compare. Observed means that nothing pointed at a machine; it does not mean that a person was proven.
- None of these machine events fires a notification, and a single open never does. Replies do.
- Clicks have their own rules for scanners, such as several links clicked within two seconds or a click from a security vendor’s network.
These are estimates: a verdict goes no higher than “likely”. The rules are versioned, so stored events can be classified again when the rules improve. HawkOpen is currently in a controlled launch; the open-accuracy FAQ lists the rules and their limits in more detail.
Finally, a practical note. Tracking in HawkOpen runs only after the company switches it on and only for recipients with a recorded consent. If you also need to think about whether you may track at all, read consent-based email tracking.