Menu
EN
ENPLDEESFRPTIT
Log in Coming soon Start for €1 + VAT Coming soon

What is Apple Mail Privacy Protection?

It is a feature of Apple Mail on iPhone, iPad and Mac that loads remote content of emails privately through Apple’s servers, often in advance, and hides the recipient’s IP address. For the recipient it means more privacy; for the sender, an open from Apple Mail no longer shows whether the person read the message.

Checked:

The recipient switches it on in the Mail settings, under Privacy Protection, with the option to protect Mail activity. Because content is loaded whether or not the message is opened, trackers that count every image request show opens that nobody made, and the network address no longer reveals the reader’s location.

HawkOpen recognises these requests by the way Apple fetches the image and by Apple’s network, gives them the category privacy proxy and the rule code R-OPEN-APPLE, and does not classify them as human activity or notify you about them. The protection does not click links, so clicks and replies remain useful signals.

Sources

Related questions

More in this topic

  • Why was my link clicked seconds after I sent the email?

    Most likely a security scanner did it. Many company mail systems open the links in an incoming email to check them before the person sees the message. HawkOpen counts these as signs of a scanner, never classifies them as likely human activity on that basis, and lists the rule codes behind the verdict.

  • Does an open prove that someone read my email?

    No. An open means that the tracking image was requested. The request can come from a person, a privacy proxy, a mail provider’s image cache or a scanner, and HawkOpen never presents it as proof of reading.

  • How accurate is email open tracking?

    It accurately records that a tracking image was requested, but that is not the same as a person reading. It overcounts when Apple Mail, a mail provider’s proxy or a scanner loads the image, and undercounts when images are blocked, so HawkOpen labels each request instead of counting every one as an open.

  • Why does my tracker say an email was opened when nobody opened it?

    Because something other than a person loaded the tracking image: Apple Mail Privacy Protection, the image proxy of Gmail, Outlook.com or Yahoo, a security scanner or a link preview. HawkOpen shows such events with their category and rule code, and does not classify them as human activity.

  • Why does one email show many opens?

    Each request for the tracking image is recorded as a separate event. A proxy, a scanner, the recipient opening the message again on a phone and a computer, or other people reading a forwarded copy all add events, and HawkOpen lists each one with its time and category.

  • Why does an open appear seconds after I send the email?

    Usually a machine loaded the image: Gmail’s scanner or prefetching, Apple Mail Privacy Protection or a company security filter. HawkOpen has rules for these, such as R-OPEN-GOOGLE-SCAN, R-OPEN-GMAIL-PREFETCH, R-OPEN-APPLE and R-OPEN-FAST, and a fast open alone is never classified as likely human activity.

  • Why do opens come from Google’s image proxy, and how do I tell them from real ones?

    Gmail does not let the reader’s device fetch images directly: Google’s servers fetch them and pass them on, so you see Google’s network instead of the reader’s. HawkOpen marks such requests as proxy cache (R-OPEN-GOOGLE) and marks Gmail’s prefetching and scanning with separate rules.

  • Does a preview pane count as an open?

    Yes, if the preview shows images: the mail program then loads the tracking image just as when the message is opened, and HawkOpen cannot tell a glance in a preview pane from careful reading. A one-line text preview in the message list, without images, records nothing.

  • What happens if the recipient blocks images?

    Then the tracking image is not loaded and no open is recorded, even if the person reads every word. Clicks on tracked links are still recorded, and so are replies on the Pro and Business plans, so a click without an open usually means images were blocked.

  • What is a good email open rate?

    HawkOpen does not publish benchmarks, and any single figure deserves caution: since Apple Mail Privacy Protection, raw open rates are inflated and differ widely by audience and mail program. Compare your own results over time, using observed opens and clicks, which HawkOpen counts apart from machine and proxy ones, and replies.

  • Can an email tracker show the recipient’s location?

    Not precisely. A tracker sees the network address that loaded the image, which at best suggests a country, and with Apple Mail or Gmail it is the address of their servers, not of the person. HawkOpen resolves an address at most to a country, never to a city or street.

  • Can I tell if my email was forwarded?

    Not reliably. A forwarded copy usually carries the same tracking image and links, so when the new reader opens it, the event is recorded under the original recipient. HawkOpen does not report forwarding of ordinary emails.

  • Why do I see an open when I look at my own sent email?

    Because your copy in the Sent folder can contain the same tracking image. If your mail program loads it, HawkOpen records an event like any other; it does not recognise that the open was yours.

  • Can I exclude my own company network or colleagues from tracking?

    You can exclude recipients, not networks: in your settings, list addresses or whole domains (for example your company’s) and countries that are never tracked. HawkOpen has no list of IP addresses to ignore, so your own opens are not filtered out.

  • Can I tell a bounced email from an unopened one?

    Yes. A bounce is recorded as its own delivery status, separate from opens: a hard bounce shows the message as rejected, while an email that was accepted but never opened simply has no open events.

  • What do “likely”, “possible” and “unknown” mean in a HawkOpen verdict?

    Every verdict has a category and a confidence of “likely” or “possible”; there is no “certain”. “Unknown” means no rule explained the event, so HawkOpen classifies it neither as a machine nor as likely human activity.

  • What is the image at the end of the message used for?

    It shows whether the mail app displayed the whole message. Gmail, for example, clips long emails; if the second image at the very end loads, the message was shown to the end. It never counts as an extra open.

  • Does HawkOpen confirm that an email was delivered?

    It confirms what it can see: that the sending server accepted the message, or that it bounced. It does not claim that the email reached the inbox, because the receiving side does not report that.

  • Can I see exactly when the email was opened?

    Yes: every event in the message timeline has its own date and time, together with its category and rule codes. The time is when the image was requested, which is not always when a person looked at it.

  • Can tracking show how long someone read the email?

    Not for an email. HawkOpen records when the tracking image was requested, not how long the message stayed open. Time per page is measured only for a PDF shared as a link, once the reader agrees on the page, and file sharing waits for the malware-scanning service, which is not switched on yet.

  • How many classification rules are there, and what happens to old events when rules change?

    More than 40 named rules, and every verdict records the version of the rules that produced it. HawkOpen keeps the signals of each event, so they can be classified again under a newer version; the earlier verdict stays stored next to the new one.

  • What counts as a likely human open or click, and what should I do with it?

    An event that no rule attributes to a machine and that shows signs of human activity, such as a mail program on a home or office network, or a click with a real, visible browser. It is still an estimate, so treat it as a good moment to follow up, not as proof.

  • Does HawkOpen recognise Microsoft and Yahoo image proxies?

    Yes. Requests from Microsoft’s and Yahoo’s image proxies get the category proxy cache, with the rule codes R-OPEN-MSPROXY and R-OPEN-YAHOO, and do not trigger notifications.

  • Does Apple Mail Privacy Protection pre-fetch links or only images?

    Apple’s feature loads remote images, including tracking images, through Apple’s servers; HawkOpen marks those loads with R-OPEN-APPLE. Clicks are judged separately by the click rules, so an Apple image load never turns into a click.

  • What categories can an open or click have?

    Seven: Apple Mail Privacy Protection, prefetch (such as Gmail’s), link preview, security scanner, proxy cache, human, and unknown. Each comes with a confidence and the rule codes behind it.

  • Can I manually correct a classification?

    No. HawkOpen has no manual override: every verdict comes from the rules, and the same signals always give the same result, with the rule codes shown so you can judge it yourself.

  • What are rule codes such as R-OPEN-APPLE and R-CLK-BURST?

    Each code names one rule that matched the event: R-OPEN-… for opens and R-CLK-… for clicks. For example, R-OPEN-APPLE is Apple’s relay, R-CLK-BURST is three or more links clicked within two seconds, R-CLK-HEADLESS a browser with no window, and R-CLK-JS a real, visible browser.

  • How are opens and clicks from VPN, cloud or hosting networks treated?

    As likely machines. A request from a cloud or hosting network counts towards a scanner (rules such as R-OPEN-CLOUD and R-CLK-HOSTING), and a click from such a network is never classified as likely human activity, whatever other signs it shows.

  • Why are my email open rates going down?

    Often because of measurement rather than readers: more people and companies block remote images, and tools that count machine and proxy opens apart from observed ones, as HawkOpen does, show fewer opens than tools that count every image load.

  • What is the difference between an open and a click?

    An open is a request for the invisible tracking image; a click is a request for a tracked link. Each gets its own category, and a click usually tells you more because someone, or something, chose a link.

For AI assistants: Markdown · JSON