Is Emarsys Tracking Your Email? How to Block It

If you shop online, Emarsys email tracking is almost certainly running in your inbox already. Emarsys is the customer engagement platform SAP bought in 2020, concentrated in retail and ecommerce, so its messages are the ones ordinary people actually receive: the 20% off email, the back in stock alert, the reminder about the jacket in your cart. Two systems are watching. One records that you opened the message. The other waits for the click, then stitches everything you browse afterward onto a named record in the retailer's database.

Key Takeaways

• SAP completed its acquisition of Emarsys in November 2020 and rebranded the product to SAP Engagement Cloud in March 2026.
• Emarsys tracks opens with a tracking pixel and reads the user agent request header to identify your operating system, device and email client.
• Emarsys links append Scarab parameters including sc_eh, an email hash, and sc_uid, which persist across the pages of the store as you browse.
• Web Extend, the ScarabQueue script on the retailer's site, reports product views, search terms, cart contents and purchases, and your click turns that anonymous stream into a named one.
• Emarsys told its own customers that open tracking is on by default at account level and that switching it off requires a support request, ahead of France's CNIL deadline of 14 July 2026.

What Is Emarsys, and Who Is Sending You Emarsys Mail?

Emarsys is an omnichannel customer engagement platform owned by SAP, sold as SAP Emarsys Customer Engagement and, since a rebrand covered by TechTarget in March 2026, SAP Engagement Cloud. SAP completed the acquisition in November 2020, when it had over 1,500 customers.

That customer base separates Emarsys from the other platforms in this series. Marketo and Eloqua only follow you if you handed a work address to a vendor. Emarsys skews toward fashion chains, grocers and marketplaces, so consumers with no interest in marketing software get Emarsys mail weekly.

Emarsys also owns the machinery on the far side of the click. It acquired Scarab Research, a Budapest recommendation engine company, in December 2013, which is why the parameters in your shopping URLs start with sc_. Readers of our breakdown of how Klaviyo tracks email opens will recognize the playbook, run here at enterprise scale.

How Does Emarsys Track Email Opens?

With a tracking pixel, and Emarsys says so itself. The company's write up on Apple Mail Privacy Protection states that an "email open is tracked by tracking pixels, a small image that gets downloaded from the servers of the sender," and that Emarsys uses the "information available in the user-agent request header to identify the operating system, the device, and the email client."

One open therefore carries four things back to the retailer: a timestamp, your IP address and the location it resolves to, the device and operating system in your hand, and your mail client.

The same post is candid about the limits. After Apple began proxying image loads, Emarsys watched average open rates climb roughly 10 percentage points to just over 25% by the end of 2021, driven by machine generated opens, because Apple's relay "masks the IP address and the type of device the open came from." Read that as a list of what the pixel collected before the proxy scrambled it. SAP's knowledge base article on Emarsys open tracking, link tracking and cookie placement sits behind a login.

What Does an Emarsys Click Tracking Link Do?

It routes you through a redirect, logs which link in which campaign you clicked, then hands you to the store with identifying parameters bolted onto the address. Emarsys campaign settings include a Link domain option, so the redirecting hostname is the retailer's choice and usually carries its branding.

What survives the redirect is the interesting part. Brave's team filed an issue on removing Emarsys and Scarab trackers from URLs naming the family: sc_customer, sc_eh, sc_uid, sc_src, sc_lid and sc_llid. sc_eh is a hash of your email address. Brave is blunt that their purpose is to identify individuals, and notes the page worked fine without them.

Most email tracking coverage treats the pixel as the villain and the link as a footnote. With Emarsys that ranking is backwards. A pixel produces one row in a report. These parameters produce a whole session, because they stay in the address bar from landing page to category to checkout. Our guide to email link wrapping and click tracking covers the general pattern.

How Does Web Extend Connect Your Inbox to Your Shopping?

Web Extend is the JavaScript Emarsys runs on the retailer's website, and it is why clicking matters more than opening. SAP's documentation on the Web Extend tracking code calls it the data collection module that tracks visitor interactions on the ecommerce site and feeds them to revenue attribution, the Automation Center, Smart Insight and Predict.

It is a script, scarab-v2.js, plus a queue object named ScarabQueue, onto which the retailer pushes commands as you browse:

• view reports the product you are looking at.
• category reports which section of the catalogue you are in.
• searchTerm reports what you typed into the site search.
• cart reports every item in your basket, with prices.
• purchase reports the completed order and its value.
• setEmail sets your email address as the unique identifier for all of it.

Emarsys is careful on one point, fairly so: Web Extend handles data in anonymous or pseudonymized form, and behaviour is tied to a real contact only once it reaches the Emarsys database. Matching a visitor to a contact requires the retailer to identify a known visitor explicitly.

A click on a tracked email link is that identification. sc_eh carries your email hash into a page where scarab-v2.js is already running, and the anonymous stream acquires a name. The chain runs backwards too, because the identification attaches to a browser profile that predates the click, so browsing you did while you believed you were anonymous stops being anonymous. Same move we documented in Braze's tracking setup, applied to shopping baskets. Emarsys describes Predict, its recommendation engine, as merging browsing across desktop, mobile and tablet into one profile. The abandoned cart email an hour later is the cart command.

How Do You Check Whether an Email Is Tracked?

Read the raw source. In Gmail on desktop, open the email, click the three dot menu and choose Show original.

• Search for sc_eh, sc_uid or sc_customer. Hits inside link targets mean Scarab identification is attached to your clicks.
• Search for width="1" or height="1" to surface pixel sized images whatever hostname serves them.
• On the store, watch the address bar. sc_ parameters still there several pages in are travelling with you.

A branded link domain defeats casual inspection, since the word Emarsys may appear nowhere. Our walkthrough on detecting email tracking pixels in Gmail covers other platforms.

How to Block Emarsys Email Tracking

There is no single switch. The two halves need different answers.

Stop Gmail loading images automatically. Open Gmail settings, choose See all settings, then General, find Images, and select "Ask before displaying external images". The open pixel then waits for your permission. Two caveats: Gmail already proxies remote images, so the retailer never saw your raw IP here anyway and still sees the fetch, and this does nothing about clicks.

Do not follow the link in the email. Copy the destination, delete everything from the question mark onward, paste the clean URL. Better still, search for the product yourself. The click is the identifying event, so this is the most effective manual habit, and the least sustainable on a phone at 8am.

Unsubscribe when you no longer want the mail. Emarsys adds List-Unsubscribe headers to every message, in both mailto and HTTPS form, which powers the native unsubscribe button Gmail shows at the top of a message. SAP documents it in the List-Unsubscribe reference. Stopping the mail stops the tracking on it. It does not touch Web Extend.

Use a blocker extension. The only option covering both halves without changing how you read mail.

Which Blocker Actually Covers This?

Several tools do a real job. Here is where each one stops.

• PixelBlock blocks tracking pixels in Gmail and flags each one with a red eye icon. Pixel focused, so tracked links are untouched.
• Ugly Email marks tracked messages in the inbox list before you open them, a useful early warning. Detection keys on known senders and services.
• Trocker marks pixels and flags tracked links, across Gmail, Outlook and Yahoo.
• Proton Mail blocks remote content by default and proxies images, killing opens at the mailbox level. You have to move your mail there, and link parameters still fire.
• HEY screens senders and strips spy pixels as a core feature, reporting who tried. Again, changing provider.

Gblock sits alongside the first three and differs in two ways that matter here. The blocklist updates automatically, which counts because retailers serve pixels from branded subdomains a static list never anticipates. And it strips tracking parameters from links, so the sc_ family does not follow you onto the store. It runs inside Gmail. The same problem shows up wherever a platform serves mail from unbranded hosts, which is why Acoustic mail arrives from domains like mkt1234.com instead of anything you would recognise.

No extension promises complete coverage. Custom tracking domains defeat domain matching, and nothing protects you once you fill in a form on the retailer's site. We put the category side by side in our roundup of the best email tracker blocker extensions, and the step by step lives in our guide to blocking email tracking in Gmail.

Where Does Consent Stand?

Shifting, and Emarsys has already had to move. France's CNIL published a recommendation treating email tracking pixels as trackers requiring prior consent, enforceable from 14 July 2026. Emarsys then ran a webinar walking its own customers through the response, and the instructions are revealing. Step one: ask SAP support to disable automatic open tracking at account level. Step two: build a custom contact field storing whether a person consented. Step three: edit every template so tracking fires only when that field is set.

Read that backwards and you have the default state described precisely. Tracking is on unless somebody files a support ticket, consent is stored nowhere until a marketer builds a field for it, and scheduled campaigns keep tracking until templates are rewritten. Our coverage of the CNIL pixel deadline has the regulatory detail.

Outside France none of that applies to you yet, and waiting on a regulator in someone else's country is a poor plan. Turn off automatic image loading, treat every link in a marketing email as a redirect, and put something in the browser that strips the parameters before they reach the store.