Is Oracle Responsys Tracking Your Email? How to Block It

Oracle Responsys email tracking is probably running on mail already sitting in your inbox, and unlike its enterprise sibling it does not need you to have filled in a demo form. Responsys is Oracle's B2C campaign management platform, used by airlines, retailers, telcos and banks to send high volume consumer mail. Three things fire in sequence: a pixel when the message renders, a redirect when you tap a link, and a second pixel on the retailer's own order confirmation page that ties the purchase back to the email that produced it.

Key Takeaways

• Oracle documents that Responsys places three pixels in a tracked email, the open tracking pixel plus the Oracle Responsys Display and Oracle ID Graph pixels, at the top of the message by default.
• Responsys Contact Event Data feeds expose the operating system, OS vendor, browser, browser type, device type and the raw User Agent String for every recorded open.
• Remote IP address is available as a standard field on the open, click and conversion event feeds, released by Oracle under its Controlled Availability program.
• Conversion tracking is a 1x1 IMG tag on the retailer's confirmation page that reports ORDERID, ORDERTOTAL, NUMITEMS and CUSTOMERID against a cookie written when you clicked the email.
• Branded domain delegation puts the redirect, the pixels and the hosted forms on a sub-domain such as news.example.com, so the word Responsys may appear nowhere in the message you receive.

What Is Oracle Responsys, and How Is It Different From Eloqua?

Responsys is Oracle's B2C campaign management platform, aimed at consumer brands sending at scale, while Eloqua is the B2B marketing automation product aimed at long sales cycles. Oracle sells both. They share a parent company and almost nothing else architecturally.

That distinction decides who is in your inbox. Eloqua mail arrives because a software vendor wants a signature on a six figure contract, and we covered how Eloqua's recipient GUID deanonymizes months of browsing separately. Responsys mail arrives because you bought shoes once, booked a flight, or opened a current account. The volume is the point: nobody phones you after a Responsys open, but the platform is measuring purchases, and it is measuring them in currency.

Contact data lives in a profile list, with additional behavioural and demographic attributes stored in profile extension tables, which Oracle describes as tables for storing attributes that define the behavioral, demographic or profile preference characteristics of your contacts. Your open history is not a report. It is a row you can be queried on.

How Does the Responsys Open Tracking Pixel Work?

Responsys embeds an invisible image in the message and counts the request for that image as your open. Oracle's Email Campaign Designer additional settings documentation states it plainly: "To track HTML opens, Oracle Responsys places an open tracking pixel, as well as the Oracle Responsys Display and Oracle ID Graph pixels, at either the top or bottom of the message."

Read that sentence twice. Three pixels, not one, and the third is called ID Graph. Oracle notes the default placement is the top, chosen because some mobile devices truncate long messages and a pixel at the bottom would never fire. The default is tuned so a glance at a preview pane counts.

What that request carries is not a mystery either, because Oracle sells the export. The Contact Event Data output files documentation defines event 4 as Opened and event 44 as Email Async Open or Auto Opened, the latter existing to separate machine fetches from human ones. Available fields for an open include operating system, OS vendor, browser, browser type, device type and the raw User Agent String. Oracle separately offers Remote IP Address as a standard field on the open, click and conversion feeds, under its Controlled Availability program.

Timestamp, device, mail client, IP. An IP resolves to a city and an internet provider, which is how a "you were browsing near our Manchester store" segment gets built without anyone ever asking for your location.

What Happens When You Click a Responsys Link?

Your click goes to Oracle's Response Handler first, gets logged against a specific numbered link, and only then forwards you to the page you wanted. Oracle's guide to setting up link tracking and external tracking describes the mechanism as a link table, either selected from existing tables or generated automatically from the links in the email, so each link is an addressable row rather than a URL.

The same page documents external tracking, which "automatically appends tracking parameters to link URLs" for third party analytics services. Two details from Oracle's description matter to you as the recipient: the parameters are pre-defined by the account administrator, and required parameters "are selected by default and cannot be omitted." Whatever the retailer wants stapled to your click, it is stapled before the page loads. This is the same URL rewriting pattern covered in our breakdown of email link wrapping and click tracking.

Why Doesn't the Word Responsys Appear Anywhere?

Because the sending brand almost certainly converted to a branded domain, and Oracle recommends it. Oracle's page on converting to a branded domain lists what the branded sub-domain covers: the From address, the Responsys hosted Reply To address, image links, and the redirection links known as the Response Handler URL. That single Response Handler URL appears in tracked links, conversion tracking image pixels, the address bar for Responsys hosted forms, and View Message in Browser renderings.

Oracle's recommended example is a sub-domain in the form news.example.com, delegated with NS records pointing at Oracle Responsys nameservers. Oracle is explicit that the sub-domain must not be in use by anyone else, because Oracle will manage all traffic on it.

The consequence is one most privacy coverage misses. Blocklists that match on vendor hostnames are structurally weak against Responsys, because every customer's tracking infrastructure sits on a hostname that looks like the brand's own website. A domain you have no reason to distrust is running a redirect operated by a company you never heard from.

How Does Conversion Tracking Follow You to Checkout?

A cookie is written when you click the email link, and a second pixel on the confirmation page reads it back with your order attached. Oracle's conversion tracking overview gives the tag as a transparent 1x1 IMG placed inside the body of the acknowledgment page, on the pattern http://rsp.ServerName.net/pub/cct?_ri_=...&_ei_=..., with WIDTH and HEIGHT of 1.

The documented parameters are where it stops being a read receipt:

• ORDERTOTAL reports what you spent.
• ORDERID reports the specific order, and Oracle requires it to be unique.
• NUMITEMS reports how many things you bought.
• CUSTOMERID reports who you are in the retailer's own system.
• Custom parameters such as ITEM and COLOR are supported, and Oracle's own example uses Shirt and Red.

Oracle's SameSite cookie guidance adds an unexpectedly useful admission. When the redirection link and the website share a base domain the cookie is first party and unaffected by browser restrictions; when they differ it is third party and needs SameSite=None;Secure to survive. Branded domain delegation is therefore not cosmetic. Putting the redirect on news.example.com makes the conversion cookie first party on example.com, precisely the class of cookie that Safari, Firefox and Chrome's privacy work does not touch.

How Do You Check Your Own Inbox for Responsys Tracking?

Open the message in Gmail on desktop, click the three dot menu, and choose Show original for the raw source. Then search it.

• Search for responsys and _ri_. Either one is a strong signal.
• Search for width="1" and height="1" near the top of the HTML body, since that is Oracle's default pixel position.
• Compare the link hostnames against the brand's real website. A sub-domain such as news. or email. handling every link, while the site itself is on www., is the branded Response Handler.

A clean looking message proves nothing, for the branding reason above. Our walkthrough on detecting email tracking pixels in Gmail covers the same inspection across other platforms.

How to Block Oracle Responsys Email Tracking in Gmail

No single control stops all three stages. Here is honestly what each option reaches.

Turn off automatic image loading. In Gmail, open Settings, then See all settings, then General, find Images, and choose "Ask before displaying external images". All three pixels then wait for your permission. Two limits: it is all or nothing, breaking legitimate images in every message, and it does nothing to click tracking or conversion tracking. Click one link and the redirect fires regardless.

Never follow the link in the email. Copy the destination, or better, go to the site yourself and find the product. The click writes the conversion cookie, so avoiding it is the single most effective manual habit and the one nobody sustains on a phone before coffee.

Clear cookies between the click and checkout. Oracle states outright that recipients who clear cookies at that moment prevent the conversion being recorded. It works. It is also an absurd thing to ask a person to do while buying a jumper.

Use a blocker extension. The only approach that covers the pixels without changing how you read mail.

Which Blocker Actually Covers This?

Several tools do genuine work, and they stop at different points.

• PixelBlock blocks tracking pixels in Gmail and flags each attempt with a red eye icon. Pixels only, so tracked links pass through.
• Ugly Email marks tracked messages in the inbox list before you open them, which is useful early warning. Detection keys on known senders and services.
• Trocker marks pixels and flags tracked links, across Gmail, Outlook and Yahoo.
• Proton Mail blocks remote content by default and proxies images. That kills opens at the mailbox level, but you have to move your mail there, and the redirect still fires on click.
• HEY strips spy pixels as a core feature and reports who tried. Again, a change of provider.

Gblock sits with the first three and differs in two ways that bear directly on Responsys. The blocklist updates automatically, which matters more here than for almost any other platform, because Oracle's own branded domain guidance means each sender's pixels arrive on a hostname invented for that brand. And it strips tracking parameters from links, so the external tracking parameters the account administrator marked as un-omittable do not travel with you onto the site. It runs inside Gmail. No extension catches everything, custom domains are genuinely hard, and nothing protects you once you type your card details into the checkout. We put the category side by side in our roundup of email tracker Chrome extensions and how to block them, and the step by step lives in our guide to blocking email tracking in Gmail.

Where Does Consent Stand?

Moving, slowly, and only in some places. France's CNIL published a recommendation on tracking pixels in email treating them as trackers requiring prior consent under Article 82 of the French Data Protection Act, with an information and opt out deadline of 14 July 2026. We covered the detail in our analysis of the CNIL deadline.

Responsys is a harder case for regulators than most, and worth saying out loud: the conversion pixel is not on the sender's email at all, it is on the retailer's own confirmation page, running on the retailer's own domain, writing a first party cookie. That is the configuration browser vendors have spent a decade deciding not to break. Whatever happens to third party cookies, this survives it.

Which leaves the practical answer where it started. Switch off automatic image loading, treat every link in a promotional email as a redirect that has already been logged, and run something in the browser that strips the parameters before they arrive at the store.