Is EngageBay Tracking Your Email? How to Block It

You open a proposal on Tuesday evening. Wednesday morning a rep calls, and the timing feels off, because you never replied. A one pixel image loaded, a notification fired on a laptop somewhere, and a number attached to your name went up. EngageBay is an all in one CRM whose homepage sells it as "HubSpot Power at a Fraction of the Cost" to a claimed 46,000+ small businesses, and open tracking ships as standard.

Key Takeaways

• EngageBay's cookie policy states plainly: "We use clear gifs or pixels in our HTML-based emails to let us know which emails have been opened by recipients."
• EngageBay's link tracking includes a Yes & Push setting that, in its own words, "pushes a cookie to their browser" so the sender can then track that person across their website.
• Senders can hide the tracker behind their own domain by pointing a CNAME record with the host track at eb-pages.engagebay.com, so the address may never say EngageBay.
• Opens and clicks feed lead scoring through automation workflows, so one open can raise a numeric score and trigger a follow up nobody consciously decided to send.
• Italy's Garante, in Provision No. 284 of 17 April 2026, requires prior consent for pixels used for behavioural assessment, with a six month transition from 29 April 2026.

Who Sends You EngageBay Email?

Small companies, and the sales reps inside them. EngageBay bundles a CRM, email marketing, landing pages and a helpdesk into one cheap subscription, the sort of tool a fifteen person agency adopts without procurement review. It reaches you two ways: the bulk broadcast, measured in aggregate, and the EngageBay email tracker Chrome extension, which bolts onto Gmail and tracks the individual message a rep types by hand. A newsletter open is a rounding error; a tracked one to one email means somebody is watching your specific name.

Does EngageBay Track Your Email Opens?

Yes, and EngageBay documents it rather than hiding it. The company's cookie policy describes clear gifs as "tiny graphics with a unique identifier, similar in function to cookies" and then says it outright: "We use clear gifs or pixels in our HTML-based emails to let us know which emails have been opened by recipients."

That is the vendor describing its own mail, and customers get the same machinery. EngageBay's tracker product page promises "real-time notification pop-ups when someone is viewing your email, an attachment or downloading." Opening the message is one event, opening the attachment a second, downloading it a third.

What Does EngageBay Record When You Open the Message?

The fact of the open, the moment it happened, and enough network detail to place you roughly, filed against your contact record rather than a faceless total. A pixel is an ordinary HTTP request, so the server necessarily receives:

• A timestamp, accurate to the second the request lands.
• An IP address, resolving to an approximate city and to your network type: home, corporate or mobile.
• A user agent string, naming your mail client, browser and operating system.
• An open count, since the pixel refires on every reopen.
• Per link click events, showing which part of a proposal held your attention.

The click side is explicitly individual. EngageBay's guide to finding contacts who clicked a link walks a sender through a broadcast's Stats tab, selecting Clicks, choosing a URL, then bulk actioning "all the contacts who clicked on that URL" into a list or tag. The dashboard shows a percentage; underneath is a list of names. What the pixel cannot do is read your reply or tell whether you read a word.

The Link Setting That Goes Further Than a Pixel

Most writing about CRM tracking stops at the pixel and treats link tracking as a footnote. EngageBay's definitions for link tracking in email campaigns lists four options, and two of them reach past the inbox entirely:

• No — "doesn't track the links."
• Yes — "It tracks the link clicks that are clicked."
• Yes & Push — "Tracks the link clicks and It pushes a cookie to their browser and when they come back to any other page on your website, it would track them too and that is how it shows on Web Analytics"
• Yes & Push (Email Only) — "This will push a cookie to their email and only track when they click on the link from the email."

Read Yes & Push again. Clicking one link in one email is the handshake that deanonymises your future browsing on that company's site: every page you visit afterwards ties back to the address they mailed. That is the mechanism behind browsing a vendor's pricing page at 11pm and getting a call the next morning, and it starts with a rewritten link, not a form you filled in.

Rewriting is also why no image setting alone is enough, a pattern we take apart in our guide to email link wrapping and URL rewriting. Turning images off does nothing to a link.

How Do Opens Feed EngageBay's Lead Scoring?

Through automation, and silently. EngageBay's note on adding score based on email opens and link clicks gives the design in one sentence: "To add score based on email opens or link clicks we need to create either automation with some trigger or create a workflow and add the contacts to the workflow."

So the open is an input to a rule, not a line in a report. Your contact record carries a number, the number moves when the pixel fires, and crossing a threshold can route you to a rep or fire an alert. The score decides, and you supplied the input by reading your mail.

Which is why accuracy matters. A security gateway prefetching images to scan for malware fires the pixel too, and the score cannot tell that apart from interest. Block images and you look cold however carefully you read. Every suite on this foundation shares the flaw, which is why our breakdown of HubSpot's email tracking lands in the same place. EngageBay just sells it cheaper.

How Do You Spot an EngageBay Tracker in Gmail?

Read the raw message and hunt for an image one pixel across. On Gmail desktop this takes under a minute, using the same inspection our walkthrough on detecting tracking pixels in Gmail applies to any tracker.

1. Open the message, click the three dot menu, and choose Show original.
2. Press Cmd+F or Ctrl+F and search for width="1" or height="1". No genuine image is one pixel square.
3. Search for <img. Trackers sit at the end of the HTML body, past the signature, with an empty or missing alt attribute.
4. Search for engagebay. A hit in an image src or a link href settles it immediately.
5. Search for href=. Where the visible text names one destination and the address points elsewhere first, your click is counted before you arrive.

Why the Domain May Not Say EngageBay

Because senders are told how to remove the name. EngageBay's account settings documentation describes a Vanity URL that lets a customer "retain your own tracking URL across all your emails," set up by creating "a CNAME record in your DNS settings with HOST as 'track' and DESTINATION as 'eb-pages.engagebay.com." Tracking links from such a sender then read as track.theirdomain.com, with no vendor domain for a blocklist to match. A bare track. subdomain is the better tell, and it generalises past EngageBay. We could not verify a fixed pixel endpoint hostname from public documentation, so we will not invent one: judge the shape of the URL, not a specific string.

How Do You Block EngageBay Email Tracking?

Stop the images loading, then handle the links separately, because neither fix touches the other. In Gmail on desktop: Settings, See all settings, and under Images pick Ask before displaying external images, per Google's guide to turning images on or off in Gmail.

Why That Setting Is Not Enough

Three real gaps. It does nothing to rewritten links, so every Yes & Push cookie still lands when you click. It makes you decide per message, before you know whether the images are a tracker or your accountant's logo. And it strips images you wanted, which is why most people who switch it on switch it back off.

Nor is Gmail's default any protection. It routes remote images through Google's servers and caches them, hiding your IP address and user agent, but it does not stop the fetch. The pixel still fires, the open is still recorded, and the lead score still moves.

Which Blocker Handles Both Halves?

Named honestly, with the rewritten link as the deciding column. Our roundup of the best email tracker blocker extensions goes deeper.

Where Gblock fits, without inflation. It blocks tracking pixels and strips tracking redirects out of links before you click, the half no image setting touches and the half carrying the Yes & Push cookie. Its blocklist updates on its own, which is what a vanity domain scheme demands, and it runs inside Gmail, so your address stays put. What it cannot do is recognise a hostname nobody has reported, so against an unusual custom domain pair it with the Gmail setting above, in the order our guide to blocking email tracking in Gmail sets out.

What This Means for Your Inbox

A CRM pixel is not the newsletter pixel most coverage pictures, where your open vanishes into a percentage among a hundred thousand strangers. The sender knows your name and your deal size, and the log lands on your file beside the notes a rep typed after your last call. The scale is not new: Englehardt, Han and Narayanan's Princeton study, I never signed up for this!, examined over 12,000 emails from roughly 900 senders and found 85 percent carried embedded third party content, 70 percent of it trackers.

Name the asymmetry: you get no notification and no way to decline, while the sender gets a pop up the instant you look. Reading your own mail becomes a disclosure, and a numeric one. So answer in two layers. Set Gmail images to ask, which holds whatever domain the pixel sits on, then add something that strips tracking links. Treat any blocklist, ours included, as the convenient layer rather than the floor.

The Compliance Angle: Consent for Opens and Scoring

If you send EngageBay mail into Europe rather than just receive it, the ground moved this year. Italy's data protection authority issued Provision No. 284 on 17 April 2026, and, as Covington's summary of the Garante guidelines records, prior consent is required where pixels are "used to carry out behavioral assessments or analyses aimed at measuring and improving the performance of promotional campaigns." Anonymised deliverability measurement may escape that. Lead scoring a named contact plainly does not. The clock is short: six months ran from publication in the Official Gazette on 29 April 2026 to inform recipients and build a withdrawal mechanism, leaving roughly seven weeks from today, and recipients must be able to refuse the pixel while still receiving the emails.

The UK lands nearby from a different direction. The ICO's guidance on storage and access technologies treats tracking pixels alongside cookies, applying PECR regulation 6 wherever a technology stores or accesses information on a user's terminal equipment, with consent as the default. Yes & Push is the hardest case: it does not merely read, it writes a cookie to the recipient's browser because of a click in an email. That leaves a sender two consent questions, one for the pixel and one for the cookie.

Sources: EngageBay Cookie Policy; EngageBay: definitions for link tracking in email campaigns; EngageBay: Account Settings; EngageBay: finding contacts who clicked a link; EngageBay: how to add score based on email opens and link clicks; EngageBay: Email Tracking for Gmail, Outlook & Office 365; Covington: Italian DPA Publishes Guidelines on Email Tracking Pixels; ICO: What are storage and access technologies?; Princeton CITP; Google: Turn images on or off in Gmail. Documentation read on 10 September 2026. No fixed EngageBay tracking pixel endpoint hostname could be verified from public documentation, so none is asserted here.