Is Shopify Email Tracking You? How to Block It

Shopify email tracking is unusual, though not in the way you would expect. The merchant sending that abandoned cart reminder picks from four open tracking options in their admin, and one of them actually asks you for consent, which almost no email platform offers. Then you read the fine print on the strictest setting and find that switching open tracking off leaves your link clicks recorded anyway. Everything below comes from Shopify's published help pages plus DNS, WHOIS and TLS lookups run on 21 August 2026.

Key Takeaways

• Shopify states that "Shopify Messaging tracks the following data from your email campaigns: Open rates, Link clicks, Unsubscribes, Spam complaints".
• Merchants pick from four open tracking settings under Settings then Notifications: "Optimize open tracking (recommended)", "Track all email opens", "Ask for consent" and "Do not track".
• Under "Do not track", Shopify states that "Other analytics for your email marketing campaigns, such as the number of clicks from subscribers, are still collected", so no setting disables click tracking.
• The domain shopifyemail.com was registered on 8 March 2018 through MarkMonitor, registrant organisation listed openly as Shopify Inc., and t.shopifyemail.com resolves to Shopify's 23.227.39.20 behind Cloudflare.
• Opens are recorded per customer, not as an anonymous count: a shopify_email.opened segment filter takes activity_id, count and date parameters, with data retained for 26 months.

Does Shopify Email Track When You Open a Message?

Yes, by default, and Shopify says so in one unambiguous sentence rather than burying it.

Shopify's data privacy and legal compliance page for email marketing lists the collection in four words: "Open rates, Link clicks, Unsubscribes, Spam complaints". The same page tells merchants where the control sits, "To turn off open tracking for your subscribers, go to Settings > Notifications in your Shopify admin", which confirms the default state is on.

A naming note, because it makes the docs confusing. Shopify Email is now Shopify Messaging: SMS was folded in during December 2025 and automations moved into the Messaging app on 24 March 2026, per the Shopify changelog. The tracking behaviour did not change.

What Are Shopify's Four Open Tracking Settings?

They run from full collection to none, and the third asks you before counting you, which is close to unique in this industry. The Shopify Messaging analytics documentation describes each:

• Optimize open tracking (recommended). Shopify "collects the open rates for your email marketing campaigns, and helps to maintain your sender reputation", pitched as balancing "customer data privacy choices with data reporting".
• Track all email opens. The maximal setting, which Shopify says "gives you the most detailed open rate reporting".
• Ask for consent. "Subscribers can opt into tracking by clicking Opt in to email open tracking in the footer of your email marketing campaigns."
• Do not track. "Your email open rate isn't reported. Other analytics for your email marketing campaigns, such as the number of clicks from subscribers, are still collected."

Read that last one twice. The strictest setting Shopify offers is scoped entirely to opens, click tracking survives it, and no equivalent switch for links appears anywhere in the documentation. Compare Loops, whose single account wide toggle kills opens and clicks together: Shopify gives you four choices about the pixel and zero about the redirect.

What Is shopifyemail.com?

It is a domain Shopify registered in 2018 and openly owns, used for the web endpoints its email product needs rather than for sending mail.

The registry record is refreshingly plain: created 8 March 2018 through the corporate registrar MarkMonitor, registrant organisation "Shopify Inc.", no privacy shield. Contrast vialoops.com and mailersend.net, both parked behind the Icelandic proxy Withheld for Privacy, where inspecting a link teaches a recipient nothing.

On 21 August 2026, t.shopifyemail.com resolves to 23.227.39.20, the address Shopify publishes for merchant storefronts, and answers over Cloudflare with a Google Trust Services certificate carrying exactly one subject alternative name, which is what you provision for a purpose built endpoint. Its root and guessed paths such as /o and /pixel.gif all return a 301 to https://shopify.com/, while click.shopifyemail.com, track.shopifyemail.com and o.shopifyemail.com do not resolve at all. The apex is not a sending domain: its SPF record is the bare v=spf1 ~all.

Here is where we stop short of a claim. Shopify does not publish the hostname or URL shape of its open pixel or click redirect anywhere we could find, and we did not capture a live campaign message. The evidence points at t.shopifyemail.com, but pointing is not proving. Check a real message rather than anyone's inference, ours included; our guide to detecting email tracking pixels in Gmail covers the thirty second version.

What Does a Merchant Actually See?

Not a percentage on a dashboard. A row with your name on it, filterable and reusable for months.

The reporting surface is the mild part: open rate, click rate, bounce, unsubscribe and spam rates, plus sessions and sales attributed to the campaign. Segmentation is where the granularity shows. Shopify's customer segment filter reference documents a family of email event filters written in ShopifyQL: shopify_email.opened, shopify_email.clicked, shopify_email.delivered, shopify_email.bounced and shopify_email.marked_as_spam. Each takes optional activity_id, count and date parameters, so a query shaped like shopify_email.opened MATCHES (activity_id = 135195754518) returns the specific people who opened one specific campaign. Shopify's September 2022 changelog entry put it plainly: "You can now build customer segments based on email-related behaviors and actions."

That count parameter means repeat opens by the same person are tallied rather than collapsed, and segment data is retained for 26 months, so the record of you opening a promotion outlives it by two years. One thing Shopify does not document, and we will not assert: whether device, browser or IP derived country from an open reaches merchants the way rival platforms expose it.

Does Apple Mail Privacy Protection Stop Shopify Email Tracking?

It breaks the useful part of the open signal for Apple Mail users and does nothing for anyone reading in Gmail on the web.

Apple's Mail Privacy Protection legal page describes a two relay design: remote content routes "through two separate relays operated by different entities", where "the first knows your IP address, but not any third-party Mail content you receive" and "the second knows the remote Mail content you receive, but not your IP address". Mail also "downloads remote content in the background by default, regardless of whether you engage with the email", so every pixel fires whether or not a human looked.

That is almost certainly why Shopify's default is named "Optimize open tracking" and cites sender reputation rather than accuracy: prefetched opens make the raw number meaningless, so the optimized figure is presumably a filtered estimate, as we covered in Apple Mail faking half of all email opens. The catch is simple: MPP protects the Apple Mail app, not Gmail's web interface.

How Do You Block Shopify Email Tracking in Gmail?

The open is an image request and the click is a redirect, so both can be interrupted in your browser, which matters more here than usual because no Shopify setting turns clicks off. Our step by step guide to how to block email tracking in Gmail walks through these with screenshots.

• Stop images loading automatically. Gmail Settings, then General, then "Ask before displaying external images", documented on Google's Gmail image settings page. The pixel never loads. Product photos stay blank too, and clicks are untouched.
• Block the tracking host before the request leaves. Gblock strips tracking pixels out of messages inside Gmail, so the fetch never happens and you keep the images you wanted.
• Treat every link as instrumented. Shopify records clicks under all four settings. Reach the product page from the store's own site, or let Gblock strip the redirect so the real destination opens directly.
• Take the consent option seriously. A footer reading "Opt in to email open tracking" means that merchant chose the consent setting and is not counting your opens unless you click. Not clicking is the whole point.
• Know the limits. Delivery, bounces, unsubscribes and spam complaints are logged server side, and orders are attributed through your store session regardless. Blocking removes the open and the click, not your row in the list.

How Does Gblock Compare to Ugly Email, PixelBlock and Trocker?

All of them block pixels; they differ on whether tracked links are handled and whether the blocklist keeps itself current. We lay out the trade offs in our roundup of the best email tracker blocker extensions.

Ugly Email is MIT licensed, flags tracked Gmail threads with an eye icon and blocks the pixel locally. Trocker is free and open source, spans several webmail providers, and is the one free tool that also marks tracked links. PixelBlock does straightforward pixel blocking, though its Manifest V2 lineage means you should confirm you are on a maintained build. Proton Mail and HEY bake protection into the client, which is genuinely strong and beside the point if your mail lives in Gmail.

Gblock's claim is narrow rather than superior: it works inside Gmail instead of asking you to switch providers, it strips tracking links as well as pixels, and its blocklist updates itself, so a rebranded platform does not require you to notice and write a rule. Where the merchant cannot turn click tracking off at all, link stripping carries the weight. Our overview of email tracker Chrome extensions and how to block them covers the other side of the same market.

Why Email Users Should Care

Ecommerce is the highest volume category most inboxes receive, attached to something the sender already knows well: what you bought, when, for how much, and where it shipped.

An open event is thin on its own. Joined to an order history in the same admin and queryable by activity_id against a named campaign, it becomes a behavioural profile with purchase data welded to it. Shopify's privacy policy states that where it "acts as processor or service provider of your Personal Data on behalf of Shopify merchants, you need to directly contact the merchant you interacted with", so an access or deletion request goes to each individual store rather than to Shopify. The policy is also notably silent on email opens, covering "cookies and similar tracking technologies" then deferring to a cookie policy written about the storefront, not the inbox.

The compliance picture is unsettled. France's CNIL and Italy's Garante have both treated an open pixel as terminal access that generally requires prior consent under ePrivacy, since a pixel is not necessary to deliver the message you asked for. On that reading, "Ask for consent" is the only one of Shopify's four options clearly on the right side of the line for EU recipients, and it is neither the default nor the recommended choice. Shopify pushes the obligation downstream anyway: "You're responsible for ensuring that your email opt-in collection methods comply with regional laws and regulations."

The Honest Summary

Shopify deserves credit here. It owns its tracking domain openly under its real corporate name, documents what it collects in a list a normal person can read, and ships a consent based open tracking option most of the industry does not bother to build.

The gap is the one nobody advertises. Four settings govern the pixel and none governs the link, so a merchant who deliberately picks the most privacy respecting option still holds a per customer record of every link you followed, retained for 26 months and queryable by campaign. That is not a loophole a merchant chose. It is the shape of the product. The image your mail client fetches and the redirect your browser follows are the only two steps on your side of the wire, and the only two you get a vote on.