About Bots and Email Tracking

by Chris | May 28, 2026 | Email Marketing

Why Email Engagement Tracking Is More Complicated Than Ever

For years, email marketers relied on a simple formula: opens and clicks measured subscriber engagement. If someone opened your emails regularly, they were interested. If they clicked, even better.

That world no longer exists.

Today, engagement tracking is increasingly distorted by privacy protections, image caching, automated security systems, and inbox provider behavior that generate artificial opens and clicks. Metrics that once guided segmentation, deliverability decisions, and campaign optimization are now far less reliable than many marketers realize.

The problem is not limited to Apple Mail Privacy Protection (MPP). Gmail image pre-fetching, corporate email security scanners, and anti-phishing systems also contribute to inflated engagement metrics across nearly every major email platform.

Yet despite the known inaccuracies, most major ESPs (Email Service Providers) still report these events as opens and clicks.

Here’s why.

The Original Problem With Email Opens

Email opens were never a perfect metric.

An “open” is typically recorded when a hidden tracking pixel loads inside an email. But that only works if:

• Images are enabled
• The recipient’s email client loads remote content
• The request comes directly from the user’s device

Even before privacy changes, opens could be undercounted because some users blocked images. But marketers still treated opens as directionally useful because the errors were relatively consistent.

That changed dramatically with privacy-focused email clients and automated filtering systems.

Apple Mail Privacy Protection Changed Everything

In 2021, Apple introduced Mail Privacy Protection (MPP) as part of iOS 15 and macOS Monterey.

MPP works by preloading email images — including tracking pixels — through Apple proxy servers, often shortly after delivery rather than when the recipient actually reads the message.

As a result:

• Opens may be recorded even if the user never saw the email
• Open timestamps become unreliable
• Device and location tracking become obscured
• Engagement rates appear artificially inflated

For marketers, this created immediate reporting problems.

A recipient who ignored every campaign could suddenly appear “highly engaged” simply because Apple automatically loaded the tracking pixel.

This especially impacted:

• Engagement-based segmentation
• Re-engagement campaigns
• Sunset policies
• Deliverability optimization
• Send-time optimization algorithms

Many marketers initially assumed Apple MPP was the primary source of fake opens. It’s a major factor, but it’s not the only one.

Gmail and Google Image Pre-Fetching Also Affect Open Tracking

Google and Gmail have long used image caching and proxying systems that interfere with traditional tracking methods.

When Gmail receives an email, images are often fetched through Google proxy servers instead of directly from the recipient’s device.

This improves:

• Security
• Performance
• Privacy
• Malware filtering

But it also creates ambiguity in engagement data.

In some cases, Gmail image pre-fetching or proxy behavior can:

• Trigger opens before human interaction
• Mask recipient IP addresses
• Obscure device data
• Consolidate multiple opens into a single cached request

Google’s systems behave differently from Apple MPP, but the end result is similar: open tracking becomes less trustworthy.

And that’s before security software enters the picture.

Security Bots Create Fake Clicks Too

If inflated open rates were the only issue, marketers could simply rely more heavily on clicks.

Unfortunately, clicks are increasingly affected by automated security scanners.

Corporate email systems, enterprise firewalls, and security products frequently inspect links before a human user interacts with the email. These systems are designed to detect phishing attacks, malware, and malicious redirects.

Common examples include:

• Microsoft Defender Safe Links
• Proofpoint
• Mimecast
• Barracuda
• Cisco Secure Email
• Corporate gateway filters

These tools may automatically:

• Open links
• Scan redirects
• Visit landing pages
• Trigger click tracking URLs

As a result, marketers see clicks that never came from a real person.

Typical indicators of bot clicks include:

• Clicks occurring seconds after delivery
• Multiple links clicked instantly
• Impossible geographic patterns
• Clicks without corresponding human behavior
• Extremely short session durations

This is increasingly common in B2B email marketing, where enterprise security layers are aggressive.

Why ESPs Don’t Simply Filter Out Bot Opens and Clicks

Marketers often ask a reasonable question:

“If these are obviously fake interactions, why don’t ESPs just remove them?”

The answer is more complicated than it appears.

1. There Is No Universal Definition of a Bot Event

Not every automated event is clearly identifiable.

Some opens come from:

• Apple proxies
• Gmail caching systems
• Security scanners
• Privacy-focused browsers
• VPNs
• Corporate proxies
• Real users behind network filtering layers

The same IP ranges or user agents can sometimes represent legitimate user activity.

Aggressive filtering risks removing genuine engagement data.

2. Inbox Providers Continuously Change Their Behavior

Apple, Google, Microsoft, and enterprise security vendors regularly modify their systems.

Detection rules that work today may fail tomorrow.

Maintaining accurate filtering requires:

• Continuous infrastructure updates
• Large-scale behavioral analysis
• Constant monitoring of proxy and bot patterns

Even large ESPs struggle to keep pace.

3. False Positives Create Serious Customer Problems

If an ESP incorrectly suppresses legitimate opens or clicks:

• Automations may fail
• Segmentation becomes inaccurate
• Revenue attribution breaks
• A/B testing data becomes distorted

Many ESPs prefer reporting all measurable events rather than risk removing real interactions.

In other words, overcounting is often viewed as less dangerous than undercounting.

4. “Open Rates” Are Still a Widely Expected Metric

Despite their flaws, open rates remain deeply embedded in email marketing.

Customers expect to see:

• Open percentages
• Unique opens
• Click-to-open rates
• Engagement dashboards

Completely removing questionable activity would significantly lower reported metrics, often causing confusion or customer dissatisfaction.

Some ESPs therefore choose disclosure over aggressive filtering.

5. Bot Detection Is Expensive at Scale

Advanced bot filtering requires:

• Massive behavioral datasets
• Machine learning models
• Real-time pattern analysis
• Constant infrastructure tuning

For high-volume ESPs processing billions of events daily, this becomes technically and financially expensive.

Many providers implement partial filtering instead of attempting perfect accuracy.

What Marketers Should Do Instead

Modern email measurement requires a shift in mindset.

Instead of relying heavily on opens alone, marketers should prioritize:

• Click quality
• Website behavior
• Conversions
• Purchases
• Replies
• Session depth
• First-party engagement signals

It’s also important to analyze engagement patterns holistically rather than trusting a single metric.

For example:

• An “open” without any downstream activity may be meaningless
• A click occurring one second after delivery may be automated
• Repeated site visits and conversions matter far more than pixel loads

The future of email analytics is increasingly focused on intent signals rather than raw engagement counts.

The Bottom Line

Major ESPs are not ignoring the issue. The reality is that filtering fake engagement perfectly is technically difficult, operationally risky, and often impossible with complete certainty.

For marketers, the key takeaway is simple:

Treat opens and clicks as directional signals — not absolute truth. Be cautious about using email engagement events for automations.

The most valuable engagement metrics now happen after the email itself:

• Website activity
• Product usage
• Purchases
• Replies
• Lead quality
• Customer retention

That’s where real intent lives.

Related Reading:

• Why open-based sunset policy fails in 2026 (based on Klaviyo data)
• What to do with inactive email subscribers