Is Movable Ink Tracking Your Email? How to Block It

Ask whether Movable Ink email tracking uses a spy pixel and the honest answer is no, not in the way you mean. It does not slip a hidden beacon in beside the pretty pictures. It builds the pretty pictures themselves at the instant you open the message, so there is no separate pixel to find: every image is already doing the pixel’s job. That changes what to search for, and which blocking advice works.

Key Takeaways

• Movable Ink serves email content from mi-msg.com, a domain registered through Amazon Registrar on 9 January 2019 and carrying a wildcard TLS certificate for *.mi-msg.com issued by Amazon.
• Braze's integration documentation spells the image URL as https://mi-msg.com/p/rp/image.png?mi_u=%%email%%, placing the recipient’s email address directly in the query string.
• Movable Ink’s support centre lists the signals its rules read at render time: weather, location, device, time, language, website behaviour and arbitrary query parameters.
• That documented path returns a 42 byte GIF89a measuring 1x1 pixels, sent with cache-control: no-store, no-cache and a fresh x-uuid header on every single request.
• Movable Ink documents that Gmail’s proxy defeats its geolocation, but states that "the clickthrough URL is not proxied by Gmail" — so a click undoes the protection an open enjoyed.

What Is Movable Ink, and Is It a Tracking Pixel?

Movable Ink is a personalisation platform that generates email imagery at open time rather than send time, and it is not a tracking pixel product. It sells marketers the ability to show you a different picture depending on the weather where you are, the device in your hand, or how close a sale is to ending.

The mechanism has an unavoidable side effect. Movable Ink’s own support centre article on setting targeting rules describes content "targeted to their environment or a particular attribute the moment the creative is rendered". That moment is the moment you opened the email. To decide what to draw, the server must first be told you are looking, and told enough about you to choose. The personalisation and the surveillance are the same request.

How Does Open Time Image Generation Work?

The marketer puts a Movable Ink URL where an image would normally go, and the picture is composed when your client fetches it. Braze's partner documentation for Movable Ink gives the literal shape of that URL:

https://mi-msg.com/p/rp/image.png?mi_u=%%email%%

That mi_u parameter is you. In the Braze version it becomes mi_u={{${email_address}}}: your literal email address, travelling in a URL your mail client fetches automatically. Oracle's documentation for the same integration describes the same parameter as a user ID appended to all email links and events, and offers a SHA-256 hash, an MD5 hash, or an opaque customer ID instead. One vendor’s example hashes you, another’s ships you in the clear, and the recipient has no say over which the sender picked.

We requested that path. The server answered HTTP 200 with content-type: image/gif and 42 bytes of body — a GIF89a of exactly 1x1 pixels — alongside access-control-allow-origin: https://app.movableink.com — as close to a signature as infrastructure gets. Two details matter. The cache headers read no-store, no-cache, must-revalidate, which is how you guarantee a live request on every open. And the x-uuid header changed on each of four requests, so every fetch is individually identified before any personalisation happens.

What Can Movable Ink See When You Open the Email?

Movable Ink names the list itself. Its targeting rules documentation says content can be displayed based on a customer’s:

• Weather and Location, both derived from your IP at the moment of open. The worked example combines them into "a city-specific background image to the customer, along with the current temperature and weather forecast".
• Device, read from the user agent your mail client sends. The docs walk marketers through targeting an operating system by pasting in a user agent string.
• Time, simply when the request arrived, which is what makes countdown timers possible.
• Language, Website Behaviour and "anything else using query parameters" — an open ended slot the sender fills with whatever it knows about you.

As a recipient that is a decent profile: roughly where you are, what you are holding, and the second you looked. Our guide to detecting email tracking pixels in Gmail covers the general technique, though this case needs an adjustment, below.

Which Domains Should You Look For in the Message Source?

Start with mi-msg.com and the mi_u= parameter. Open the message, click the three dot menu on the message itself, choose Show original, and search for:

• mi-msg.com — the host Braze documents. Its DNS answers on every subdomain we tried, all pointing at the same Amazon CloudFront addresses.
• mi_u= — the recipient identifier. If the value after it is your own email address rather than a hash, that is worth knowing.
• movableink.com and movableink-templates.com — the latter is where projects.movableink.com resolves, via a CNAME to assets.movableink-templates.com.
• A subdomain of the sender’s own brand. Office Depot runs mi.officedepot.com, which CNAMEs to CloudFront and returns a page titled "Movable Ink Domain", with the same per request x-uuid header. This is the pattern that defeats blocklists.

Two dead ends, so you do not chase them. Both mi-cdn.com and miadgroup.com circulate as supposed Movable Ink hosts. Neither is: the first was registered in 2012 through a Chinese registrar with no connection we could establish, the second registered again through DropCatch in August 2026. Blocking either accomplishes nothing — check a domain before adding it to any filter list you maintain.

How Does Apple Mail Privacy Protection Affect It?

Apple Mail Privacy Protection breaks Movable Ink’s personalisation and inflates the sender’s open count at once, and Movable Ink says so itself. Apple’s description of the feature is blunt about the mechanism: "your IP address is hidden from senders" and "remote content is privately downloaded in the background when you receive a message (instead of when you view it)".

Both halves hurt. No IP means no weather and no city. Downloading on receipt rather than on view means the image is composed at a moment unrelated to when you read it, so the countdown timer starts from the wrong instant. Movable Ink states the consequence: "Apple’s iOS15 release prevents Movable Ink from using IP level data to customize content". It advises a device targeting rule as a fallback, then concedes that rule "cannot differentiate users based on whether they have enrolled in Mail Privacy Protection".

The inflation half is what senders complain about and recipients should welcome: Apple fetches the content whether or not you open the message, so the report fills with opens that never happened, as covered in how Apple Mail Privacy Protection creates fake email opens. Corrupting a metric is not withholding it, but against an open time personalisation engine it is unusually effective.

Does Movable Ink Wrap Your Links Too?

Mostly no. Link wrapping is generally the sending platform’s job: Movable Ink plugs into Salesforce Marketing Cloud, Braze, Iterable, Klaviyo and Adobe, and those platforms rewrite your links through their own redirect hosts — our breakdown of Salesforce Marketing Cloud tracking walks through one such chain. We probed for redirect endpoints on Movable Ink’s host and found none; requests to /click and /p/rp/redirect returned image responses carrying an internal 404, never an HTTP redirect. That is an indicator rather than proof, since we were guessing at paths.

One genuine click exposure is documented plainly. Because a Movable Ink block is an image with a destination attached, the platform notes that Gmail recipients "see the default content but click through to the targeted URL", because "the clickthrough URL is not proxied by Gmail". Read that as a recipient: Gmail’s proxy protected your IP while the image loaded, and the instant you click, it resolves without it.

What This Means for Your Inbox

The standard advice for spotting email tracking fails here. Nearly every guide tells you to hunt for a 1x1 image or a width="1" attribute. In a Movable Ink email the tracking image is the hero banner — 600 pixels wide, the thing you were looking at, and no dimension based heuristic will ever flag it.

Gmail changes the shape of this without removing it, in a way easy to misread as safety. Google proxies external images, which is why Movable Ink’s docs complain that Gmail "locates all recipients in Mountain View, California". Your city is genuinely hidden. What survives is the open, its timestamp, and the mi_u value identifying which recipient it was. We mapped that boundary in what Gmail's image proxy does and does not hide. Movable Ink’s own estimate that the proxy affects "about 2.5-5% of users" shows how narrow that protection is.

For senders rather than recipients, the European position is not ambiguous. The EDPB’s Guidelines 2/2023 on the technical scope of Article 5(3) of the ePrivacy Directive treat a tracking pixel as instructing the recipient’s device to send information to a remote server, which brings it inside the consent requirement. An architecture where the creative and the collection are one request makes that harder to satisfy, because there is no separable tracking component to switch off while the images keep working.

How Do You Block Movable Ink Tracking in Gmail?

Nothing is recorded unless your client fetches the image. Three actions, ordered by what they cost you.

Turn off automatic image loading. In Gmail, open Settings, See all settings, and under Images select "Ask before displaying external images". Against Movable Ink this is unusually effective, because the request never leaves your machine and the server learns nothing. It is also unusually disruptive, since here the blocked images are the entire message.

Read the source before you trust the sender. Use Show original and search for mi_u=. If your plain email address is sitting in an image URL, this sender chose the unhashed option — weigh that when deciding whether to stay subscribed.

Install a blocker that filters by host. The only option that keeps ordinary email usable while refusing the tracking request, and the only one that also handles the wrapped links your sender’s ESP adds. Our guide to how to block email tracking in Gmail covers the setup end to end.

Movable Ink Blockers Compared

No tool catches everything here, and the gaps are wider than usual because the tracker wears the costume of a legitimate image.

• Gmail’s image proxy. Not a blocker. It hides your IP and, in the Gmail app, strips the user agent. The open still lands, timestamped and identified.
• Apple Mail Privacy Protection. Strongest here against Movable Ink specifically, because it attacks the input the product depends on. It does not stop the request, and does nothing about clicks.
• Ugly Email. Flags tracked messages with an eye icon. Detection tuned for conventional pixels may not fire on a hero image.
• PixelBlock. Blocks open pixels and reports it, but leaves rewritten links alone.
• Trocker. Works across several webmail providers and shows where a tracker sits.
• Proton Mail and HEY. Block trackers by default at the provider level, genuinely strong, but you must move your email to get it.

Gblock sits in the extension category and its differences are specific rather than sweeping. It runs inside Gmail, so you keep your address. Its blocklist updates automatically, which matters against an estate built on wildcard DNS and customer CNAMEs. And it strips tracking links as well as pixels, covering the ESP half Movable Ink does not handle. Trade offs across the category are in our roundup of email tracker blocker extensions.

The honest limit is real: mi.officedepot.com is what a custom CNAME looks like, and a sender who configures one serves identical content from a hostname that reads like their own brand. Host based blocking is a very good filter here. It is not a wall.

The Practical Bottom Line

Most coverage of email tracking treats the pixel as a hidden intruder. Movable Ink dissolves that idea: the company did not hide a beacon in your email, it made the email out of beacons and sold that as a feature.

Which leaves no partial position to take. Every other guide in this series ends by noting you can block the tracker and keep the pictures. Here you cannot: the tracker is the picture. What you can still decide is whether an image loads at all, and that is decided in your own mail client. Our guide to email tracker Chrome extensions covers the tools that make it for you, every time.