Sep 06, 2026 · 9 min read
Is OneSignal Tracking Your Email? How to Block It
The pixel is the ordinary part. What makes OneSignal different is where the open lands: on a profile that already holds your device, your timezone, and whether you let that company's app buzz your phone.
A promo arrives from an app you installed months ago and forgot about. You open it on the couch, read two lines, close it. A row has already been written. OneSignal email tracking is on by default, and the open you just logged does not sit in an anonymous pile — it attaches to a named profile that knows your device model, your country, and whether you granted that app push permission.
Key Takeaways
- OneSignal's documentation states that it "automatically tracks link clicks within emails when Track link clicks is enabled" — a setting that is "on by default."
- OneSignal email reports show Total Opens, Unique Opens, Total Clicks and Unique Clicks, plus per subscription rows carrying External ID, Subscription ID, Device and a Clicked Timestamp.
- A single OneSignal profile holds up to 20 subscriptions across push, email, SMS and in app, so an email open enriches a record that already contains app behaviour.
- Senders point a CNAME at their own subdomain, so the pixel and the rewritten links carry the brand's domain rather than anything recognisably OneSignal.
- The CNIL classified email tracking pixels as trackers requiring consent in deliberation n° 2026-042 of 12 March 2026, with a 14 July 2026 deadline for informing contacts already on file.
Does OneSignal Track Email Opens?
Yes, through a tracking pixel served from the sending domain, and through click tracking that rewrites every link in the message.
Open tracking is the usual invisible image request, fired when your client renders the message. Click tracking is spelled out more plainly. OneSignal's guide to URLs and links describes it as "rewriting URLs to capture the click event, then redirecting the User to the original destination," confirms it is on by default, and tells a sender who wants it off to uncheck Track link clicks or set disable_email_click_tracking: true.
That default matters more than the feature does. Nobody at the sending company had to decide to track you. Somebody would have had to decide not to.
What Does a OneSignal Open Tell the Sender?
When you opened it, how many times, on what kind of device, and which named person in their database did it.
OneSignal's email message reports documentation lists the aggregate metrics. Total Opens is "the total number of times the email was opened, including repeats." Unique Opens is "the number of individual Subscriptions who opened the email." Total Clicks and Unique Clicks mirror that pair for links. The per recipient view is where it stops being marketing analytics and starts being a record about you:
- External ID — "your system identifier (if set)": the sender's own customer number or CRM record.
- OneSignal ID — the UUID OneSignal generates for the user.
- Subscription ID — the "unique subscription instance (device + app/browser)."
- Device — "browser or OS type."
- Sent Timestamp and Clicked Timestamp, the second a "timestamp if the user clicked, or – if not."
Add what OneSignal's data collection reference says it captures automatically — IP address, "the most recent country of the device or browser, in ISO 3166-2 format," device model, OS, language, timezone, push permission status — and the picture fills in. IP is "not stored on OneSignal servers for EU users," a genuine distinction and a narrow one: country survives, and country plus timezone plus the hours you read mail is a coarse but usable location signal.
Why Is a OneSignal Open Worth More Than an Ordinary Open?
Because of External ID, which fuses your email behaviour to your app behaviour under one identity.
This is the part almost nobody writes about. OneSignal's user model documentation defines External ID as "a unique string you assign to users to track them across devices and Subscriptions." An identified user holds up to 20 subscriptions — iOS app, Android app, web push, email, SMS — merged under one profile.
Follow the chain. You install a retailer's app and log in; the SDK registers a push subscription and starts recording session count, device model and timezone. Later you hand that retailer your email at checkout. Both carry the same External ID. Now an open at 11pm is not a lonely row in an email tool — it is a timestamp appended to a profile that already knows how often you open the app and which phone you carry.
On a standalone email platform, an open tells the sender you opened an email. Here it also refreshes the recency score on a cross channel profile. Same pixel, same cost, considerably richer landing place.
Why Doesn't the Pixel Look Like It Came From OneSignal?
Because senders CNAME a subdomain of their own to OneSignal, so the pixel and the rewritten links wear the brand's domain instead.
The practice is industry standard, but OneSignal documents the consequence unusually clearly. In its explainer on the email tracking guidance from France and Italy, the company tells senders that deleting the CNAME record from their DNS means "open and click events will no longer be logged for emails sent from that domain," and suggests running a secondary sending subdomain without the record for recipients who have not consented.
Read that from the recipient's side and it says something useful: the CNAME is the tracking, and whether you get tracked is decided in a DNS zone file you will never see. It also explains why searching an email's source for the string "onesignal" is a poor detection method — the pixel may sit at email.brandname.com. That is the hard case for every blocklist based tool, ours included, and why the durable defence is structural: refuse remote image loads by default. For the two tracking types side by side, see open tracking versus click tracking.
How to Block OneSignal Email Tracking in Gmail
Stop the images loading, then stop trusting the links, in that order.
1. Turn off automatic image loading
In Gmail on the web, open Settings → See all settings → General → Images and choose Ask before displaying external images. You get a "Display images below" prompt instead of a fetch. The mobile apps have a separate toggle under Settings → your account → Images, so set both.
Three real limits. It is all or nothing, so every legitimate image breaks too. One reflexive tap on "Display images" fires the pixel retroactively. And it does nothing about click tracking: tap a rewritten link and the open you avoided is superseded by a click carrying the same identity.
2. Know what Gmail's proxy does and does not do
Google's help page on image settings says senders "can't use image loading to get information about your computer or location" and "can't use the image to set or read cookies in your browser." True as far as it goes: images route through Google's proxy, so the sender sees Google's servers, not your IP. What Google does not stop is the fetch. It still happens, still carries a pixel URL unique to you, still writes an open with a timestamp. Proxying hides your address, not your attendance.
3. Use a blocker that never issues the request
A pixel blocker strips the tracking image before your client asks for it, so there is no fetch to proxy and no row. It leaves ordinary images alone, which is why people stay with it after abandoning the Gmail toggle in week two. Full walkthrough: how to block email tracking in Gmail.
4. Inspect links before you click
Hover any button and read the status bar. An unfamiliar subdomain with a long opaque path is a redirect, and clicking logs an event against your profile. Right click, copy the address, paste it somewhere readable — the real destination often sits in a query parameter at the end. Better still, find the offer on the sender's site and skip the email entirely.
Which Blockers Actually Work Against This?
Several, with honestly different trade offs, and two of them mean changing email provider rather than installing anything.
| Tool | What it does | What it does not do |
|---|---|---|
| Ugly Email | Free; flags tracked messages with an eye icon in the Gmail list before you open them | Detection first rather than blocking first; coverage depends on known signatures |
| PixelBlock | Free, zero configuration, blocks open pixels in Gmail | Update cadence has been intermittent; rewritten click URLs pass straight through |
| Trocker | Open source, works beyond Gmail, marks where a pixel sits and flags tracked links | Heuristic coverage maintained by volunteers |
| Proton Mail | Blocks remote content by default and proxies images; encrypted mailbox | Means moving your email, and does nothing for the Gmail account you already have |
| HEY | Screener plus a spy pixel blocker that names the tracker inside the message | Paid, and again a provider switch rather than a fix for Gmail |
| Gblock | Auto updating blocklist, blocks pixels and strips tracking links, runs inside Gmail with no provider change | Gmail on Chromium browsers only; paid after the trial |
None of these is magic against a custom tracking domain nobody has catalogued yet, and any comparison pretending otherwise is selling you something. Tools that pair list matching with structural rules — blocking tiny transparent images, unwrapping redirects whoever hosts them — degrade more gracefully. Longer breakdown of the free options: our Ugly Email, PixelBlock and Trocker comparison.
What This Means for Your Inbox
Most people file email tracking under marketing nuisance: a company learns you opened a newsletter, sighs at the number, sends another. That framing undersells what a cross channel platform does with the same event. An open logged through OneSignal is a recency signal on an identity graph. It can trigger a journey, move you between segments, and help decide whether your phone buzzes tomorrow, because the profile holding your open is the profile that governs push. From the inbox, that is a system where reading a message quietly changes what your device does next.
Then the ordinary arithmetic. Open times reveal when you sleep and when you check mail at work. Device strings reveal what you upgraded to. None of it is dramatic alone; all of it accumulates inside a vendor that says it powers 200,000 apps and 1.3 trillion messages a year. Blocking the pixel will not delete the profile — the app install did that — but it stops you topping it up, for free, every time you read something.
You cannot edit the sender's DNS. You can refuse the fetch. Our roundup of email tracker blocker extensions covers the wider field, and email tracker Chrome extensions compares the specific ones worth installing.
Frequently Asked Questions
Does turning off images stop OneSignal tracking?
It stops open tracking, not click tracking. With "Ask before displaying external images" on, the pixel is never fetched and no open is recorded. Click any link in that same message and the rewritten URL logs a click tied to the same External ID, telling the sender everything the open would have and then some. Images off is half a defence.
Can OneSignal see if I forwarded the email?
Not as a forwarding flag, and the effect is worse than one. The pixel and the rewritten links are unique to your subscription, so forwarding with images intact means your colleague's client fetches your pixel and logs the open against your record.
Is OneSignal email tracking legal?
In the EU it now generally requires consent for marketing purposes. The CNIL's recommendation on tracking pixels in emails, deliberation n° 2026-042 of 12 March 2026, treats a pixel measuring opens or clicks as a tracker under Article 82 of the French Data Protection Act, with narrow exemptions such as deliverability measurement. Senders had until 14 July 2026 to inform contacts already on file and honour objections; Italy's Garante set a comparable expectation for around mid October 2026. In the US the law is far more permissive and most senders track by default.