Is Pardot Tracking Your Email? How to Block It

Pardot email tracking is not a switch a marketer flips when they feel like being nosy. It is the default state of the product. If you filled in a form for a B2B software vendor or scanned a badge at a trade show, the nurture sequence that followed was very likely sent by Pardot. What makes this platform worth its own page is not the open pixel, because every marketing tool has one of those. It is what happens the moment you click a link.

Key Takeaways

• Salesforce renamed Pardot to Marketing Cloud Account Engagement in April 2022, and the tracking behaviour is unchanged under the new name.
• Salesforce documents that Account Engagement inserts an invisible single pixel image into HTML emails, and that loading it counts as an HTML open.
• Account Engagement grades your open by duration: under 2 seconds is Glanced, 2 to 8 seconds is Skimmed, 8 seconds or more is Read.
• Clicking a tracked link fuses the anonymous visitor_id cookie to a named prospect record, retroactively attributing your earlier browsing on that website to you.
• The default Account Engagement cookie duration is 3,650 days, and unsubscribing does not delete it.

Is Pardot Tracking Your Email?

If a company sends you marketing mail through Pardot, assume it is tracking your opens and your clicks. Salesforce's Tracking Email Engagement documentation states that email opens are tracked in all business units by default. An administrator can turn the pixel off. Very few do.

Salesforce announced in April 2022 that Pardot would become Marketing Cloud Account Engagement, a change The Spot covered from World Tour Sydney. Four years on, practitioners still say Pardot and the tracking hostnames still contain the word, so the old name is the useful one. For the wider picture, see our breakdown of how Salesforce tracks email across its platforms.

What Does Pardot Actually Record When You Open an Email?

It records that you opened it, when, from what address, on what device and mail client, and how long you looked at it. Salesforce is direct about the mechanism: open tracking is handled by an invisible, single pixel image inserted into HTML emails, and when you open the message the image loads and is counted as an HTML open.

Duration is the part worth pausing on. Account Engagement's engagement and activity report metrics do not stop at a binary opened flag. The Interaction tab reports Glanced or Unread for an email held open under 2 seconds, Skimmed for 2 to 8 seconds, and Read for 8 seconds or more. Your attention is measured on a stopwatch.

Salesforce concedes the limit too: the pixel only works if your mail client fetches it.

How Does Pardot Rewrite the Links in an Email?

Every trackable link is replaced with a redirect through the sender's tracker subdomain, which logs the click and then forwards you on. Salesforce's email link tracking documentation puts it plainly: Account Engagement uses your tracker subdomains to rewrite and uniquely track link clicks in emails. Uniquely is the operative word. The URL is generated per recipient, so the platform knows which individual clicked.

The default tracker domain is go.pardot.com, easy enough to spot in a status bar. The alternative is what defeats casual inspection. Salesforce instructs customers to add a tracker domain by pointing a CNAME record for a subdomain of their own site at go.pardot.com, so the link reads go.examplevendor.com instead. Same infrastructure, same logging, no visible trace of Salesforce.

The CNAME exists for a reason beyond branding. It makes the tracking cookie a first party cookie on the vendor's own domain, surviving the restrictions that gutted third party cookies. Salesforce's cookies and activity tracking page confirms the belt and braces approach: first party cookies for tracking, third party for redundancy. Our guide to email link wrapping covers the pattern.

How Does Pardot Link Your Email to Your Website Browsing?

Clicking a tracked link cookies your browser and welds that cookie to your named prospect record. Almost nobody clicking a link in a vendor email knows this happens.

• The vendor drops the Account Engagement tracking code onto its site before the closing body tag. As Salesforce Ben's walkthrough documents, it carries piAId for the account and piCId for the campaign, and loads a script from pi.pardot.com.
• Anyone landing on the site gets a cookie named visitor_id plus the account identifier. Salesforce is accurate that it holds no personally identifying information. That is not the same as anonymous.
• The platform logs the pages you viewed, their titles, time on each, the referrer and every timestamp against that visitor ID.
• Then you click a link in a Pardot email. The rewritten URL identifies you, and the visitor_id and the prospect record are fused together.

The consequence runs backwards through time. Browsing accumulated while you were unidentified does not stay anonymous. One click on a "read the case study" button converts months of quiet pricing page research into a timestamped log with your name and job title on it.

Now consider how long that cookie lives. The default and maximum duration is 3,650 days, per The Spot's admin guide to Pardot web tracking cookies, with a configurable floor of 180 days. Ten years. The US Bureau of Labor Statistics put median employee tenure at 3.9 years in January 2024. The cookie a vendor set while you evaluated them at your last job is built to outlive that job by six years.

What Does a Sales Rep See About You?

A number and a letter, sitting beside your name in Salesforce, both derived from behaviour nobody asked you about. Salesforce's Trailhead module on lead scoring and grading teaches marketers to read the two together.

Score is a running total of engagement. Opens, clicks, page views, downloads and form submissions each carry point values, weighted so a form submission counts for more than a click. Scoring ships enabled by default, and your score climbs on activity you cannot see. Grade is a letter from F to A measuring how well your title, company size and industry fit the vendor's ideal customer profile.

Score is what you did; grade is who you are. A rep filtering for A grade prospects whose score jumped this week is looking at people who read an email carefully and then went back to the pricing page. Our writeup on Marketo describes the same loop.

Does Unsubscribing Stop Pardot From Tracking You?

No, and this is where most privacy advice about marketing email goes wrong. Unsubscribing sets the Opted Out field on your prospect record, which governs whether the vendor may send you mail. It says nothing about the visitor cookie already in your browser.

Web tracking is controlled separately, by a cookie called pi_opt_in carrying a true or false value. Salesforce's guidance on external opt in management for Account Engagement tracking is explicit that disabling tracking by default requires the customer to enable built in opt out management. Whether you get a choice is the vendor's decision, so you can stop the mail and stay cookied.

How to Block Pardot Email Tracking

No single setting stops all of it. Here is what each option genuinely does.

1. Turn off automatic image loading in Gmail. Open Settings, See all settings, General, scroll to Images and select "Ask before displaying external images". The pixel will not fire until you approve images. Two caveats: it breaks every legitimate image you receive, and Gmail already proxies remote images, so the sender was seeing a Google data centre address rather than your home IP anyway.

2. Do not click the links. This matters most for Pardot, because the click is the identity event. Right click, copy the address, and read it. If it points at go.pardot.com or a go. subdomain of the sender, search for the destination page and reach it directly. To confirm a message is tracked, open Show original from the three dot menu and search for pardot, for go., and for width="1", as our walkthrough on detecting tracking pixels in Gmail explains.

3. Ask for plain text where the option exists. Account Engagement cannot insert the pixel into text emails, and a few vendors offer a text only setting in their preference centre. It does not stop link rewriting, but it removes the open pixel entirely.

4. Run a blocker extension. The only option that works without you thinking about it every morning, which is the difference between a technique and a defence.

How Do the Blockers Compare?

Several good tools exist, and each solves a different half of the problem. Naming the gaps beats pretending one of them is complete.

• Ugly Email flags tracked messages with an eye icon in your Gmail list before you open them. Excellent for awareness; it tells you a message is tracked rather than rebuilding the links inside it.
• PixelBlock blocks open pixels in Gmail and marks attempted opens with a red eye. Focused on the pixel, so rewritten links still redirect normally.
• Trocker marks pixels and highlights tracked links across Gmail, Outlook and Yahoo Mail. Broader coverage, at the cost of heuristics that occasionally flag ordinary images.
• Proton Mail blocks remote content and proxies images by default, which is strong protection. It also means moving your email to Proton, and does nothing for the Gmail account your employer gave you.
• HEY strips spy pixels and reports who tried to track you. Same tradeoff: a paid service you migrate to, not an addition to the inbox you have.

Gblock sits alongside the first three, with two differences that matter for Pardot. Its blocklist updates automatically, the only sane response to a platform whose customers each serve tracking from their own go. subdomain. And it strips tracking links so the redirect never fires, the half that converts anonymous browsing into a named history. It runs inside Gmail, so you keep your address.

No blocker can promise complete coverage, ours included; custom tracker domains defeat list based matching some of the time. Our comparison of email tracker blocker extensions and our guide to blocking email tracking in Gmail lay out the tradeoffs.

The same split between the pixel and the rewritten link shows up in every marketing automation platform. If your inbound mail comes from a competing suite, see whether Act-On is tracking your email and how to block it, which pairs a per recipient open pixel with a Beacon Tracker cookie that follows you onto the web.

The Bottom Line

Most privacy coverage fixates on the open pixel, because a pixel is easy to explain and easy to be indignant about. For Pardot that is the smaller half. The pixel tells a vendor you looked at their email for six seconds. The click tells them that the person who spent three weeks comparing their pricing against a competitor's, back when they thought nobody was watching, was you. None of this is hidden. It is in Salesforce's own Account Engagement documentation, written for the buyers rather than the watched.