Is Poppulo Email Tracking You? Block newsweaver.co.uk

Poppulo email tracking is what sits behind that image. Poppulo is an internal communications platform for employee newsletters, and it counts who opened them. What separates it from a marketing tracker is the direction: the sender is the organisation that pays you, the recipient list is the staff directory, and the vendor's knowledge base asks your administrators to add its image server to your network's trusted zones so fewer opens go uncounted. That is a documented request, not an accusation, and the documents are quoted below.

Key Takeaways

• Poppulo was called Newsweaver until 6 May 2017 and still routes email images through newsweaver.com and the legacy newsweaver.co.uk, both on Amazon Route 53 and answering on any subdomain.
• Poppulo's knowledge base tells customers to allowlist either *.newsweaver.com or an account specific host such as acme-industries.newsweaver.com, so the per employer subdomain pattern comes from the vendor itself.
• Poppulo tells IT administrators to push automatic image downloading as a Group Policy setting "rather than individually on each employee workstation," removing the employee from the decision.
• Poppulo's reporting includes a "Not Opened By" figure listing "People who have not yet opened the email," and the vendor states it is only enabled for accounts with allowlisting configured.
• GDPR Article 88 lets EU member states write their own workplace rules and singles out "monitoring systems at the work place" as needing specific safeguards, a different legal footing from marketing consent.

What Is newsweaver.co.uk?

newsweaver.co.uk belongs to Poppulo, the internal comms vendor named Newsweaver until 2017. Whois at Nominet records it as registered on 6 March 2002 through Blacknight Internet Solutions, an Irish registrar, expiring 6 March 2028; Poppulo is headquartered in Cork. The sibling domain settles it outright: https://www.newsweaver.com/ returns an HTTP 301 from CloudFront with a location header pointing at https://www.poppulo.com.

The apex answers nothing. Requests over HTTP and HTTPS both time out, with no valid certificate, so a recipient who pastes the domain into a browser learns nothing. Subdomains behave differently. Every label we tried, including invented ones, resolved to the same Amazon CloudFront addresses in the 13.32.220.0 range, the signature of a wildcard DNS record. Certificate transparency logs show a wildcard certificate for *.newsweaver.co.uk and only two named hosts, admin and help. A wildcard is exactly what hides customer subdomains from public logs.

One honest limit. Poppulo's documentation names newsweaver.com as the image server, not the .co.uk variant, and no published page confirms that newsweaver.co.uk serves tracking pixels today. Both sit on Route 53, resolve any subdomain to the same CloudFront edge, and belong to the same company, so a blocklist should carry both. See our guide to blocking email tracking in Gmail.

Why Does Poppulo Still Use the Newsweaver Domain?

Because the infrastructure predates the brand by fifteen years, and moving a tracking host breaks every allowlist customers have configured. Poppulo's announcement, Newsweaver rebrands as Poppulo, dates the change to 6 May 2017 and quotes founder Andrew O'Shaughnessy saying the new name "comes from the Latin for people." The same post names Experian, Novartis, Rolls-Royce and Nestlé among the corporations already using the platform.

The effect on you is a naming gap. Mail arrives under your employer's brand while the request recording your open goes to a hostname carrying a name retired nearly a decade ago. Nothing in the domain says Poppulo or internal communications. It is the pattern we found behind PoliteMail's tracking hosts and ContactMonkey's: the sending infrastructure identifies itself, and the measuring infrastructure does not.

What Does Poppulo Report to Your Employer?

Opens, clicks, bounces and, when one feature is switched on, a named list of the employees who did not open. Poppulo's guide on resending to people who did not open tells the communicator to open the Reports area and "select the number in blue to see the full list of People who have not yet opened the email," then tag those people and send them a follow up. You cannot tag an aggregate.

Here is the detail linking the two halves of this article. Poppulo's page on why the Not Opened By figure is missing states the metric "may not appear in your account by default," that "Poppulo Support must manually enable it," and that support "can only do so for an account which has Allowlisting set up." Naming the employees who ignored the newsletter is gated on the employer first configuring its network so the pixel loads. The allowlist is not a delivery convenience. It is the precondition for individual reporting.

Compare what staff are told. Imperial College London publishes a page on Poppulo and your data describing the reporting category as "analytics and other reporting data which provides aggregated information on engagement with newsletter mailings," and noting that Poppulo processes IP address data. Imperial may well not have that metric enabled. The point is narrower: "aggregated" describes a setting, not a limit of the product. Ask which one your employer runs.

Why Is Your IT Department Told to Allowlist the Pixel?

Because image blocking is the biggest source of missing opens, and Poppulo asks customers to remove it. Its page on automatic image downloading opens by saying that "to improve monitoring and measurement of your IC emails and to improve open rates, your IT administrators can set group policy to enable automatic picture downloading," because doing so "allows us to track internal email opens more consistently." It then walks an administrator through Microsoft Intune, adding either "*.newsweaver.com (wildcard image server url) or your account specific image server domain (e.g. acme-industries.newsweaver.com)" to the trusted site zone list.

A companion page on adding the Poppulo Harmony server to trusted sites via Group Policy is blunter still. It says the change "is best implemented as a company wide Group Policy setting rather than individually on each employee workstation." Read that from your chair. The recommended deployment is the one you cannot decline.

Gmail users get their own document. Poppulo's page on setting up an image URL allowlist for Google Apps shows a Workspace administrator how to enter patterns so that "matching URLs will bypass image proxy protection." To its credit the page carries Google's warning verbatim, that "disabling the image proxy is not recommended." The general allowlisting best practice guide adds that more detailed documents for IT teams come through a Customer Success Manager, so the published material is not all of it.

Is Employee Email Tracking Legal Under GDPR?

It can be, but it does not run on consent the way a marketing pixel is supposed to. GDPR Article 88 lets member states set their own rules for staff data through law or collective agreements, and requires safeguards for "the transparency of processing" and for "monitoring systems at the work place." Consent is weak in employment, because a regulator will ask whether an employee can meaningfully refuse an employer. Where a works council exists, monitoring like this is usually a matter for agreement, not a setting a communications team switches on.

Poppulo is an Irish company, so the Data Protection Commission's employer guidance is the natural reference point. For anyone in a privacy role, transparency is the test most likely to fail. An employee reading a notice that mentions "aggregated" engagement reporting has not been told a communicator can pull a named list of who ignored the memo. If your organisation runs Not Opened By, the notice should say so.

How Do You Block Poppulo Email Tracking in Gmail?

Stop remote images loading, because the open is recorded by an image request and nothing else. In Gmail on desktop, open Settings, then See all settings, scroll to Images, select Ask before displaying external images, and save. Google documents the switch on its page about turning images on or off in Gmail. Imperial's staff page on understanding your Poppulo results confirms the effect from the sender's side.

The limits, because half measures here are worse than none:

• Gmail's default proxy is not blocking. Google routes images through its own servers, hiding your IP address and device. The request still happens, so the open still lands in the report.
• An administrator can override you. If your Workspace admin has entered Poppulo's pattern in the image URL proxy allowlist, the proxy is bypassed for that domain. Your own setting still stops the load, but the network level protection is not there.
• Link tracking survives image blocking. Clicking a link sends you through a redirect that logs it before forwarding you. No image setting touches that. See our explainer on open tracking versus click tracking covers the difference.
• Work devices are not your devices. If Group Policy forces automatic image downloading in Outlook on a managed machine, a local change may not stick. Read work mail in a browser you control.

For what a toggle cannot reach, an extension is the usual answer. Ugly Email flags messages containing known trackers. PixelBlock blocks pixel loads inside Gmail. Trocker is open source and marks tracked mail across several browsers. Gblock does both jobs those tools split: it stops tracking pixels loading and strips tracking redirects out of links, inside the Gmail tab you already have open. Its blocklist updates on its own, which matters when every customer gets a subdomain of a wildcard domain. We have not tested a live Poppulo send and will not claim we have. Our side by side of the best email tracker blocker extensions sets out the tradeoffs.

What This Means for Your Inbox

The internal newsletter is the tracked message nobody questions. You did not subscribe, you cannot unsubscribe, and it lands in the same inbox as everything else at work. Marketing trackers at least sit behind an opt out a regulator can point at. This one does not, which is why we have covered Staffbase, Workshop and PoliteMail in the same series, alongside Bananatag, which drops the same kind of pixel through s.bl-1.com. Five vendors, one architecture.

One open record is modest: a timestamp, an approximate location from your IP address, a device fingerprint from your user agent, and your identity from the campaign URL. Stack fifty two weekly newsletters and it becomes a year long log of when you read company mail, at what hour, from which network. That is the byproduct of a metric meant to tell a communications team whether the memo landed.

You will not win the argument about whether your employer measures engagement, and probably should not try. What you decide is whether the request leaves your browser. Everything downstream, the timestamp, the location, the named list, depends on that image loading.

Sources: Poppulo: Newsweaver rebrands as Poppulo; Poppulo Knowledge Base: Automatic Image Downloading; Poppulo Knowledge Base: Add the Poppulo Harmony Server to your IE Trusted Sites List via Group Policy; Poppulo Knowledge Base: Set Up an Image URL Allowlist for Google Apps; Poppulo Knowledge Base: Resend to People Who Did Not Open; Poppulo Knowledge Base: Why can't I see the 'Not Opened By' figure in my Reports Overview?; Poppulo Knowledge Base: Allowlisting; Imperial College London: Poppulo and your data; GDPR Article 88; Irish Data Protection Commission: Data Protection in the Workplace; Google: Turn images on or off in Gmail. Domain, DNS, certificate transparency, whois and HTTP header observations were made on 26 August 2026 and may change.