Is Firstup Tracking Your Email? How to Block clicks.onfirstup.com

Firstup email tracking is not a marketing tool aimed at strangers. It is your employer, counting when you opened the company announcement. Firstup is an employee communications platform, and the host doing the counting is clicks.onfirstup.com. We requested one of its tracking paths on 26 August 2026 and got back a 43 byte transparent GIF, one pixel by one pixel. Every number your employer reads rests on one question: did your mail client fetch it?

Key Takeaways

• clicks.onfirstup.com answers its bare root with HTTP 404, but the path /wf/open returns a 43 byte GIF89a image measuring 1 by 1 pixel, checked on 26 August 2026.
• Firstup's help article on allowing images states that "Firstup relies on image downloads to track email opens, as well as link clicks to track further engagement."
• Firstup's Campaign Delivery report contains a "Total Activity by User" table the company describes as "a measure of activity at the individual user level."
• Firstup tells customers that a click "will be counted both as a click and a unique open," so blocking the pixel alone does not keep you out of the open column.
• Firstup's data export and deletion articles both state they do "not apply to Email-Only communities."

What Is clicks.onfirstup.com?

clicks.onfirstup.com is the host Firstup uses to record email opens and link clicks, and Firstup names it in its own documentation. The article Allowlist Emails from Firstup asks customers to allowlist seven domains, and clicks.onfirstup.com and clicks.socialchorus.com are two of them.

Probing fills in the rest. The bare root returns HTTP 404 from nginx behind Amazon CloudFront, and its four A records sit in the AWS range 18.66.218.0/24. Only generated paths resolve. Request /wf/open and the server answers HTTP 200, content type image/gif, exactly 43 bytes of GIF89a data at 1 by 1 pixel. The same path on clicks.socialchorus.com returns an identical response, which is no coincidence: onfirstup.com redirects to advocate.socialchorus.com, and the Content Security Policy header there names both parents plus onfirstup.eu as trusted origins. Firstup explains the split itself, saying "we are in the process of shifting from one parent domain to another." Our guide to blocking email tracking in Gmail shows how to find a pixel like this in raw message source.

What Does Firstup Report to Your Employer?

Opens, clicks, delivery counts and a table of activity attributed to named employees. Firstup's article Allow Images and Links in Email from Firstup states the mechanism in one sentence: "Firstup relies on image downloads to track email opens, as well as link clicks to track further engagement." The granularity is the part employees would not guess. The guide on how to read the Campaign Delivery report documents a panel called "Total Activity by User" and defines it as "a measure of activity at the individual user level." That is not an aggregate open rate. It is a roster.

Location is narrower than you might fear, and accuracy matters here. Firstup's Metrics Glossary says locations "are based on the IP address of the users' devices," refreshed weekly, but adds that "email-only users would not have IP address information." Peer platforms report the same shape of data, as we found writing about ContactMonkey email tracking and PoliteMail.

Why Doesn't Blocking the Pixel Take You Out of the Report?

Because a click counts as an open, and Firstup documents that fallback openly. Its article on uncounted email opens due to Apple Mail Privacy Protection advises communicators to "include links to other relevant content," because "when recipients click on these links, their actions will be counted both as a click and a unique open." Stop the image and the open still lands, one click later. The same page offers a third suggestion worth reading twice: "Standardize on an email client that does not interfere with email tracking pixels." Firstup means Apple's Mail Privacy Protection. The proposed remedy is not a better metric. It is picking your workforce's mail client on the basis of how measurable it leaves them.

The error runs the other way too, and Firstup admits it. The allowlisting article warns that links "may be 'clicked' by a link scanner on the recipient's email server," producing "a link click being reported even though the end-user has not clicked any links." So the roster mixes people who read nothing with people who read everything, unmarked.

Does Firstup Ask Your IT Team to Weaken Email Security?

It asks customers to allowlist its domains past their email security controls, and in one case recommends bypassing a security product outright. The guidance is explicit: "we recommend working with your internal technology team that handles email security to allowlist images/prevent images being stripped in emails." The Elevated Email Open Rates Known Causes article goes further. For Microsoft Defender it advises: "Update Safe Links policy to allow list Firstup sender IPs/domains." For a competing product the mitigation is to add "an MS Exchange transport rule exception to bypass Avanan entirely."

Set that against what Google tells the same administrator. The Workspace page on how to set up an image URL proxy allowlist opens with one instruction: "Consult with your security team before configuring the Image URL proxy allowlist setting." One vendor asks the security team for an exception; the other asks you to check with it first. Same lever, opposite advice. Broken images are a genuine problem every sender solves, and none of this is unique to internal communications. But the fix is denominated in security controls removed, and the employee paying that cost never sees the invoice.

Can You Opt Out of Firstup Email Tracking?

Not as the recipient, and if you are an email only user the two self service privacy features do not reach you either. Firstup's Request Data Deletion article and its companion on exporting personal data both open with the same restriction: the feature "only applies to communities with access to the web or mobile app experience and, therefore, does not apply to Email-Only communities."

Where the buttons do exist, they are request forms rather than switches: Firstup describes the deletion flow as generating "an email request to your administrators," and your administrator is your employer. We searched the public help centre for a recipient facing control that switches open tracking off while you keep receiving company email, and could not find one. That is what we found, not proof that none exists in an admin console. Tracking looks like a property of how the campaign is sent, decided by the sender, the pattern we documented in Staffbase email tracking.

What Does GDPR Article 88 Say About Employer Email Tracking?

Article 88 lets each EU member state write its own rules for processing employee data, and it names workplace monitoring specifically. The text in Regulation (EU) 2016/679 requires those national rules to include "suitable and specific measures to safeguard the data subject's human dignity, legitimate interests and fundamental rights," with particular regard to "monitoring systems at the work place."

Marketing tracking is argued about in terms of consent, so people assume the workplace version turns on the same question. It does not. The Article 29 Working Party's Opinion 2/2017 on data processing at work concluded that the imbalance of power between employer and employee means consent is almost never freely given, and so is very unlikely to be a valid basis for monitoring at work. The employer must rely on legitimate interests instead, and defend the monitoring as necessary and proportionate. A nicer open rate chart is a thin case for logging by name when several thousand people read a message. National law layers on top: in several member states a works council holds codetermination rights over systems capable of monitoring staff. Bring onfirstup.eu, the EU sibling Firstup lists in its own allowlisting article, to that conversation.

How Do You Block Firstup Email Tracking in Gmail?

Turn off automatic image loading first, then handle links separately, because opens and clicks are different mechanisms and one setting stops only one. On Gmail desktop, follow Google's own instructions: open Settings, then See all settings, find the Images section, choose Ask before displaying external images and click Save Changes. The request to /wf/open then never fires unless you press "Display images below" yourself. What that does and does not buy you:

• It stops the open. No image request, no row in the open column, until you load images or click a link.
• Gmail's proxy was never the whole answer. Google says senders "can't use image loading to get information about your computer or location," but concedes that "sometimes, senders may know whether you've opened an email that has an image." Proxying hides who you are; it does not cancel the request.
• It does nothing to link tracking. Rewritten links are hyperlinks, not images, and Firstup counts that click as an open anyway.
• Mobile is separate. The Gmail app keeps its own images preference, so a desktop change leaves your phone loading pixels.

For the click side without an extension, hover a link and read the real host before clicking, or reach a familiar internal site by typing its address. Fine once, unbearable across a full inbox. Be honest about the tools, too: Ugly Email flags messages containing known trackers rather than dropping them, PixelBlock blocks pixel loads inside Gmail, and Trocker marks tracked mail across several browsers. Our side by side of the best email tracker blocker extensions covers the tradeoffs. Gblock does two jobs inside the Gmail tab you already have open: it stops tracking pixels loading, and it strips tracking redirects out of links, the half an images setting cannot reach. Its blocklist updates on its own, which matters when a vendor is mid migration between two parent domains. We have not run a verified test against a live Firstup campaign, and will not claim one without it.

What This Means for Your Inbox

One difference separates this from every newsletter tracker we write about: you can unsubscribe from a newsletter. Nobody unsubscribes from the all staff announcement, and the report carrying your name is read by people who decide things about your career. A weekly internal newsletter across a two year tenure is roughly 104 rows carrying your name, a timestamp and a yes or no on whether you looked.

What should unsettle a compliance officer more than the tracking is the quality of what is tracked. By Firstup's own troubleshooting documentation, security scanners manufacture clicks nobody made, Apple Mail manufactures opens nobody made, and a single click quietly manufactures an open. All three land in the same table as genuine reads, unlabelled, and targets get set on the total. The mechanism generalises too: /wf/open returns the same 43 byte GIF on clicks.socialchorus.com, and onfirstup.eu sits on the same footing for EU customers. You cannot fix an employer's dashboard. You can decide whether the request leaves your browser at all, and every number downstream starts there.

Sources: Firstup: Allow Images and Links in Email from Firstup; Firstup: Allowlist Emails from Firstup; Firstup: Elevated Email Open Rates Known Causes; Firstup: Uncounted Email Opens due to Apple Mail Privacy Protection; Firstup: How to Read the Campaign Delivery Report; Firstup: Metrics Glossary; Firstup: Request Data Deletion; Google: Turn images on or off in Gmail; Google Workspace: Set up an image URL proxy allowlist; EUR-Lex: Regulation (EU) 2016/679, Article 88; Article 29 Working Party: Opinion 2/2017 on data processing at work. Domain, header, DNS and HTTP response observations were made on 26 August 2026 and may change.