Is Bloomreach Tracking Your Email? How to Block It

Bloomreach email tracking is easier to spot than most, and the reason is a leftover. When Bloomreach acquired Exponea, the platform underneath kept its original hostnames, so the open pixel and the rewritten links still point at exponea.com. To block email tracking from this vendor, that hostname is where you start.

Key Takeaways

• Bloomreach's Custom CDN Domains documentation states that "the default CDN domain is cdn.exponea.com" and lists its jobs as email click tracking and the email open tracking pixel.
• All email links in a Bloomreach campaign "go through the CDN link and then redirect to the target URL," so the click is recorded before you reach the destination.
• Bloomreach Engagement records eleven campaign event statuses per recipient, including opened, clicked, unsubscribed and complained.
• Bloomreach's web tracking sets a cookie named __exponea_etc__, the anonymous identifier its customer profiles are built around.
• Bloomreach's own guidance says Apple devices account for about 52% of all email opens, and that Apple "preloads images on delivery, triggering your tracking pixel even if the email is never opened."

Does Bloomreach Track Email Opens and Clicks?

Yes, both, and Bloomreach treats them as standard rather than optional. Its email tracking and delivery statuses documentation presents tracking as out of the box across every email provider integration, and defines both events plainly. An open means "the pixel in the email was loaded." A click means you "clicked on a link inside the email, which also includes clicking on the unsubscribe link."

That parenthetical about the unsubscribe link deserves more attention than it gets. The one action that is supposed to end the relationship is itself a tracked event, filed against your profile alongside every other click.

The platform records a status per recipient at each stage: enqueued, enqueue_failed, suppressed, delivered, soft_bounced, hard_bounced, preblocked, opened, clicked, unsubscribed and complained. Not a campaign level tally. A row about you.

One honest caveat: we could not verify from public documentation whether an administrator can switch open tracking off per campaign, or what such a toggle would default to. Treat tracking as present unless the raw message says otherwise.

What Host Does the Bloomreach Pixel Load From?

By default, cdn.exponea.com. Bloomreach's Custom CDN Domains page states outright that "the default CDN domain is cdn.exponea.com," and lists what it serves: the consent page, surveys, "email click tracking, all email links go through the CDN link and then redirect to the target URL," and the "email open tracking pixel."

An unusually clean answer. One host handles both halves of the tracking, shared across every Bloomreach customer who has not customised it, so a single blocklist entry covers many senders at once.

A second Exponea host appears on the web side. The Custom Tracking Domain documentation notes that Bloomreach "most commonly uses the api.exponea.com domain to serve JS SDK, service worker for web push notifications, and all of our API endpoints." So api.exponea.com is what you meet on a sender's website, and cdn.exponea.com is what you meet in your inbox.

Both defaults can be replaced, and Bloomreach sells custom domains as a product, so a sender who has bought one serves the identical pixel from something like links.theirbrand.com. As for the parameters riding inside those URLs, we could not verify specific query string or identifier names from official documentation, so we will not name any. Treat the hostname as the reliable signal and the query string as unconfirmed.

Why a CDP Open Is Worse Than a Newsletter Open

Because the open is not the product. Bloomreach Engagement is a customer data platform, and its customer profile documentation describes a profile as one "that represents a single individual interacting with your website or app," storing "a combination of identifiers, attributes, and a full event history." It also merges separate records when it finds matching identifiers, including across devices.

Line those facts up. A standalone pixel produces a number in a report. A campaign event inside a CDP is a row appended to a durable timeline that already holds your browsing, app sessions and purchases. The open is trivial; its position in the file is not.

That file is anchored by the __exponea_etc__ cookie, named in Bloomreach's tracking documentation as the identifier the platform manages for you. Find it in your browser storage and the site you are on runs Bloomreach. The same architecture underpins every major CDP, which is why our breakdown of what Braze tracks in email and our look at Emarsys tracking read like variations on one blueprint. Cordial runs the same blueprint with a 30 day memory, which is why track.cordial.io is worth blocking on sight.

Here is the part worth being blunt about. Bloomreach's Custom Tracking Domain page describes the feature's purpose as "making the Marketing cookie a first-party server-side cookie resistant to tracking preventions," and frames the product as staying "compatible with the tracking protection mechanisms introduced by browsers." Defeating the privacy defences your browser ships with is not an unfortunate side effect here. It is the sales pitch on the feature page.

How Do You Tell If a Bloomreach Message Is Tracking You?

Read the raw source and search for the hostname. It takes about thirty seconds in Gmail on desktop.

• Open the message, then click the three dot menu at the top right of the message itself, not the toolbar.
• Choose Show original. A new tab opens with the full source, headers and all.
• Press Ctrl+F or Cmd+F and search for exponea. Hits on cdn.exponea.com inside an img tag are the open pixel. Hits inside href attributes are the rewritten click links.
• Nothing found? Search for width="1" and compare the link domains against the domain the mail came from. A mismatch usually means a custom tracking domain.

Our fuller walkthrough on detecting tracking pixels in Gmail covers the same method for other platforms. Useful for settling one sender. Nobody keeps it up as a routine.

How Do You Block Bloomreach Email Tracking in Gmail?

An open event exists only if your mail client fetches the image, so the whole game is stopping that request. Three approaches, with the tradeoffs stated honestly.

Turn off automatic image loading. In Gmail, go to Settings, See all settings, and under Images pick "Ask before displaying external images". No image loads until you approve it, so no pixel fires. Product photos, logos and receipts also stop rendering, which is why most people quietly switch it back within a fortnight.

Ask senders for plain text. Plain text cannot carry an image, so it cannot carry a pixel. Some newsletters offer the preference in their subscription centre. Most do not, and it does nothing about rewritten links, which survive plain text perfectly well.

Use a blocker extension. The only option that keeps images working while refusing the tracking request, because it filters by host instead of blocking everything. It also covers the click side, which the Gmail setting does not touch. Our guide to how tracking links are wrapped and rewritten explains why that half matters as much as the pixel.

Bloomreach Blockers Compared

No blocker catches everything, and the honest gaps between these tools are narrower than any of their marketing suggests. Where each one lands against Bloomreach specifically:

• Ugly Email. Flags tracked messages with an eye icon in the Gmail list before you open them. An early warning system rather than a stripper.
• PixelBlock. Blocks open pixels and reports the blocks, but leaves rewritten click links alone. A real gap here, since every Bloomreach link routes through the CDN redirect.
• Trocker. Works across several webmail providers and shows where in the message the pixel sits.
• Proton Mail. Blocks remote content and proxies images by default. Genuinely strong, but you are moving your email rather than filtering the account you have.
• HEY. Ships a spy pixel blocker that names the offending sender. Same tradeoff as Proton: a change of provider, not an addition.

Gblock sits in the extension category, and its differences are specific rather than sweeping. It runs inside Gmail, so you keep the account and interface you already use. Its blocklist updates automatically, which matters against a vendor like this one, because marketing platforms add and retire tracking hostnames continuously and a list frozen at install time decays quietly. And it strips tracking links as well as pixels, the half Bloomreach's CDN redirect depends on.

What it cannot promise is total coverage, and that limit is structural. A sender who has bought a Custom CDN Domain serves the identical pixel from their own subdomain, defeating hostname matching by construction. Our roundup of email tracker blocker extensions sets out where that ceiling sits for every tool here. Host blocking is an excellent filter, not a wall, and anyone claiming otherwise is selling something.

Why Is Bloomreach Open Data Unreliable in 2026?

Because roughly half of the opens Bloomreach records were never opens at all. Bloomreach's own guidance on Apple Mail Privacy Protection tells its customers that "Apple preloads images on delivery, triggering your tracking pixel even if the email is never opened," and that "these false opens inflate your open rate." The same page puts Apple devices at about 52% of all email opens.

MPP, introduced in 2021, routes image requests through Apple's proxy and fetches them on delivery regardless of what you do. It also blocks IP address collection and what Bloomreach calls activity linking. We covered the mechanism in our piece on how Apple MPP manufactures fake email opens.

Do not mistake that for protection you already have. Bloomreach states plainly that "MPP doesn't affect delivery, bounce, or click metrics," and tells customers to "use clicks and other non-open metrics to track real engagement from Apple Mail users." Marketers took that advice years ago. The industry has already moved its attention from the pixel to the click, which is exactly why blocking only the pixel in 2026 defends the metric vendors stopped trusting and leaves the one they now rely on untouched.

Where You Actually Have Leverage

Bloomreach documents its mechanics more openly than several larger competitors manage. But documentation is not a control. There is no recipient facing Bloomreach setting, and unsubscribing from one sender leaves the pixel intact on mail from all the others while being logged as a tracked click on the way out.

In Europe the legal position is at least clear. The EDPB's Guidelines 2/2023 on the technical scope of Article 5(3) of the ePrivacy Directive concluded that a tracking pixel instructs the recipient's device to send information to a remote server, which brings it within the consent requirement. That duty sits with the sender, not with Bloomreach, and nothing in your inbox reveals which senders took it seriously.

Which leaves one place where the decision is genuinely yours: your own client, in the moment before the request leaves your machine.