Is Gorgias Tracking Your Email? How to Block It

You email a store about a late parcel. A reply lands an hour later, signed by someone named Maya, sent from the store's own address, with nothing in it that looks like software. Behind it sits Gorgias, the helpdesk running support for thousands of ecommerce brands. The sensible question, before you decide whether you need to block email tracking on messages like this one, is what that reply reports back. Gorgias email tracking turns out to be thinner than you would guess, and it does not live where you would look for it.

Key Takeaways

• Gorgias's documented support statistics cover CSAT, first response time, resolution time, open tickets, closed tickets and messages sent, and not one of them reports an email open.
• "Open" in a Gorgias report means a ticket nobody has resolved yet, not a message you read.
• Gorgias masks campaign shortlinks with link.gorgias.win by default, per its own click tracking documentation, and merchants can swap that for a branded subdomain by pointing a CNAME at clients.gorgias-convert.com.
• Those shortlinks carry three UTM parameters — source, medium and campaign — and Gorgias allows exactly one custom click tracking domain per account, however many brands it runs.
• Mail sent through Gorgias shows "via Gorgias.io" at the end of the sender address until the merchant verifies its domain with SPF and DKIM, at which point the only visible tell disappears.

What Is Gorgias, and Why Does Its Email Look Like the Store?

Gorgias is a customer support helpdesk built for online shops, heavily concentrated on Shopify. Its product page claims it is "Trusted by 17,000 brands" and sells a single queue that lets a team "manage all support messages from every channel in one centralized inbox."

The people receiving Gorgias mail are not prospects on a purchased list. They are shoppers who wrote in first, asking where a hoodie is, and the answer comes back wearing the shop's name rather than the vendor's. Gorgias documents how that disguise is completed: its SPF and DKIM release note says that once a merchant verifies its domain, "email sent via Gorgias will no longer have via Gorgias.io at the end of the sender's address."

So the tell exists by default and vanishes after a DNS change. Gorgias's domain verification guide frames this as deliverability, which it genuinely is — verification "reduces bounce rates, prevents emails from landing in Spam." The privacy side effect is incidental and total.

Does Gorgias Track Your Email Opens?

No open tracking is documented anywhere in the product, and the evidence is the metric list rather than a claim on a marketing page. Gorgias's support performance statistics documentation enumerates what a manager can see: CSAT, first response time, resolution time, messages per ticket, open tickets, created tickets, closed tickets, tickets replied to, messages sent, ticket handle time, one touch tickets and agent online time.

Every entry measures the support team. None measures you. No open rate, no read receipt, no "customer viewed this reply" column — and a product that shipped one would advertise it in exactly this list.

Which leaves the word that causes all the confusion. "Open tickets" is a queue count. It means conversations nobody has resolved, and it falls when an agent closes the thread, not when you read the message. Search a Gorgias dashboard for "open" and you will find that metric and assume the worst. It describes a workload, not a reader.

Gorgias does put analytics on a pixel in one place, and its Help Center tracking guide is explicit that the place is a website: merchants "track your Help Center searches by using a tracking tool such as Google Analytics or Google Tag Manager." That never touches the reply in your inbox. Gorgias lands where Hiver landed when we checked it: helpdesks count queues, sales tools count you.

Does Gorgias Track Link Clicks?

Yes, on one class of link, and Gorgias names the domain itself. Its click tracking setup guide describes campaign "shortlinks that start with link.gorgias.win," explains that "we insert links or product cards into a Chat campaign or helpdesk conversation," and states that "Gorgias tracks three UTM parameters to track the effectiveness of each campaign - source, medium, and campaign."

• The default host is link.gorgias.win. A redirect domain on the .win TLD — the one Gorgias hostname a shopper is ever likely to see in a link preview, and it looks exactly like the sort of domain security training says never to click.
• It is replaceable. Merchants create "a CNAME so that it points to clients.gorgias-convert.com" and their shortlinks become link.brand-name.com. Gorgias warns it "may take up to 48h for all the changes to take effect."
• One domain per account. Gorgias "can only set up one domain for click tracking," so a group running several brands either shares one tracking host across all of them or falls back to the Gorgias shortlink.

That second point is why hostname spotting fails as a strategy. Once the CNAME resolves, a tracked redirect reads link.yourfavouritestore.com and looks entirely first party — the pattern our guide to how email link wrapping works warns about. Judge behaviour, not spelling.

Now the honest limit. Gorgias ties the shortlink to links and product cards that Gorgias itself inserts, which points at campaigns rather than at a sentence an agent types by hand. Its Convert documentation describes an "add-on product that enables ecommerce brands to elevate their customer experience by easily launching onsite campaigns," and the CartConvert integration recovers abandoned checkouts over SMS. Neither is a bulk email engine. We could not verify whether a plain URL pasted into an ordinary reply gets rewritten, and we will not assert either answer without it.

What Does the Support Agent Actually See About You?

Less than the average sales rep, and Gorgias spells the sidebar out. Its ticket customer documentation says the menu below your name "will show you the customer notes, their email address, their location, and the local time." Four fields. An agent can also pull your order history through the Shopify integration, because you are a customer of that shop asking about your order.

Compare that with a tracked open in a sales tool: a timestamp, a count, a city, sometimes a device string, refreshed every time you glance at the thread. The Gorgias sidebar is static. It does not tick over while you read.

Two caveats. That location is almost certainly derived from an IP address or a Shopify shipping address, so "Gorgias does not track opens" is not the same sentence as "Gorgias knows nothing about where you are." And Gorgias documents no device or browser field on the email side at all, so we are not importing one from another vendor's dashboard to tidy the story. For the general version of this question, see whether someone can tell you read their email.

Why Email Users Should Care

Because "which vendor" is the wrong question. A single order generates mail from at least three pipelines: the helpdesk answering you, the marketing platform pushing the next sale, and the transactional sender confirming shipment. Their appetites for telemetry differ wildly, and they all arrive under the same friendly name. Gorgias comes out clean on opens. The newsletter one message below it almost certainly does not, which is why we looked at what Shopify Email tracks separately.

There is a trust asymmetry here too. Support email is the one category where you made contact first, which makes it the category where nobody hovers a link before clicking. That reflex is what a wrapped redirect relies on, and it is why the .win domain is such a strange artefact: the least suspicious message in your inbox carrying the most suspicious looking hostname in it.

So the takeaway is not "Gorgias is safe, relax." A clean helpdesk does not make a clean inbox, and the defence has to be ambient rather than per sender. You cannot audit every vendor behind every reply you receive. You can make the fetch fail by default.

How Do You Block Gorgias Email Tracking in Gmail?

Treat the pixel and the link as separate problems, because only one of them exists here. First, the reassurance that actually gets people to act: blocking tracking does not block the email. Your support reply still arrives and still answers the question about your parcel.

1. Stop images loading on their own. In Gmail's settings, on the General tab, find Images and select "Ask before displaying external images." Per Google's documentation for the setting, no remote image renders without approval, so no beacon from any sender fires. The cost is indiscriminate: every logo and product photo in your inbox now sits behind a prompt, which is why most people revert within a fortnight.

2. Do not mistake Google's image proxy for protection. Gmail routes remote images through Google's servers, hiding your real IP address and user agent from the sender. It does not stop the request. The fetch still happens and an open can still be logged; proxy caching makes the count unreliable rather than absent. Our walkthrough on how to block email tracking in Gmail covers where each layer leaks.

3. Read the link before you click it. Hover any link in a support reply and check the status bar. A destination on link.gorgias.win, or on a link. subdomain of the shop's own domain, is a redirect rather than the page itself. Copy it, delete everything after the question mark, and paste the clean address. To confirm what a specific message contains, open it, use the three dot menu, choose Show original and search the raw source — the method our guide to detecting email tracking pixels in Gmail sets out. That is also how you verify our finding instead of taking our word for it.

4. Run a blocker so you stop having to remember. An extension working inside Gmail can drop tracking requests before the message renders and strip known tracking parameters from links, while ordinary images still display. The honest comparison, since no single tool covers everything:

On a Gorgias reply specifically, none of these will find much to do, and that is a result rather than a disappointment. Choose on the rest of your mail, where the two differences that bite are how fresh the blocklist is and whether the tool touches links at all. Our roundup of the best email tracker blocker extensions compares them in more depth.

What Should a Store Running Gorgias Do?

If you operate the desk rather than write into it, the ground moved in 2026 and the shortlink is the piece that needs a decision. France's CNIL published its recommendation on tracking pixels in email in April 2026, setting out when consent is required under article 82 of the French Data Protection Act. Italy's Garante issued guidance the same month. Both point the same way: prior consent for marketing measurement, with a carve out for deliverability measurement tied to transactional mail the recipient asked for — order confirmations, password resets, security alerts.

• Classify the message, not the tool. A reply resolving a delivery complaint is transactional. A campaign nudging a discount code is marketing, and UTM tagged shortlinks inside it are measurement that needs a consent basis in France.
• Do not let the branded domain launder the category. Pointing a CNAME at clients.gorgias-convert.com changes what the link says, not what it does or what consent it requires.
• Audit what agents paste. Any tracking parameter reaching a customer came from a URL somebody copied out of a marketing tool into a support reply.
• Know your own posture. Gorgias's privacy notice lists "cookies, log files, pixels, tags, web bugs, web beacons, clear GIFs" among its tracking technologies, then scopes that notice to its own business purposes and states it "does not apply to information we process as a service provider or processor on behalf of our Clients." For your shoppers' data, the obligation is yours.

So Is Gorgias Tracking Your Email?

Not in the way the question usually means. No open pixel is documented, no read receipt exists, and the word "open" in a Gorgias report counts unresolved tickets — the published metric list measures the support team rather than the reader. What does report back is a click on a campaign shortlink, and Gorgias publishes that hostname openly rather than hiding it. Hover before you click, keep a blocker running for everything else, and spend your suspicion on the newsletter rather than the parcel reply.

Verified and unverified. Confirmed from Gorgias's own documentation, read on 11 September 2026: the click tracking domain link.gorgias.win, the CNAME target clients.gorgias-convert.com, the three UTM parameters, the one domain limit, the support statistics list, the ticket sidebar fields, the Help Center analytics scope, and the "via Gorgias.io" sender suffix. Not verified, and therefore not asserted: any Gorgias email open pixel hostname or URL path, because none is documented and a guessed domain would be worse than none; and whether a plain URL typed by an agent into an ordinary reply is rewritten as a shortlink. Sources: Gorgias, Set up a custom domain for Click Tracking; Gorgias, Support Performance Statistics; Gorgias, Ticket Customer; Gorgias, Convert; Gorgias, Help Center Tracking; Gorgias, SPF & DKIM Support; Gorgias, Privacy Policy; CNIL, Recommandation relative aux pixels de suivi dans les courriers électroniques; Google, Display images in Gmail.