Is Squarespace Email Tracking You? How to Block It

Squarespace email tracking hides behind no euphemism. The company writes it down: it adds "an invisible image" to campaigns and tracks "how often the image is loaded," in its own campaign analytics documentation. What that page never mentions is a setting to turn the image off, because there is not one. Every campaign carries the pixel, and the small business owner sending it usually has no idea the feature was a choice somebody else made.

Key Takeaways

• Squarespace tracks email opens with an invisible image loaded from its servers, and its help documentation describes no setting to disable it.
• Click tracking covers "most links in your campaign, including social icons and text links," excluding only unsubscribe, Powered by Squarespace, mailto and phone links.
• The campaign dashboard reports opens, clicks and unsubscribes as counts, and names individual addresses only in the unsubscribed row.
• Squarespace Commerce sends an abandoned checkout reminder 24 hours after a cart is left behind, meaning the platform logged the cart, matched it to your address and set a timer.
• Apple Mail Privacy Protection makes Squarespace report a campaign as opened "even if the user hasn't opened it."

What Does Squarespace Email Tracking Actually Record?

Two things: whether your mail client fetched a hidden image, and whether you followed a link that was rewritten to pass through Squarespace first.

The open pixel is a plain HTTP request. Your client asks Squarespace's servers for a tiny image, and that request carries what every HTTP request carries: your IP address, your user agent, the moment it happened. The dashboard reduces all of it to a number; the request always held more. The Princeton study "I never signed up for this!" found trackers in 70% of the mailing list emails it examined in 2018.

Click tracking works differently. The link you see is not the link you visit. Squarespace says clicked rates cover "most links in your campaign, including social icons and text links," excluding "unsubscribe, powered by Squarespace, email address, and phone number links." Everything else registers, which requires rewriting the URL so your request lands on Squarespace before bouncing onward.

What Does the Sender See in Their Dashboard?

Less than a Mailchimp or Klaviyo operator sees. Squarespace's documented campaign report shows delivered, opened, clicked and unsubscribed as aggregate figures.

The one place the docs describe individual addresses is unsubscribes: click the unsubscribed row on a sent campaign and you get the list of who left. Opens and clicks appear as counts of subscribers, not a browsable per person timeline. Next to the way Klaviyo builds a profile level event history, or Mailchimp's per contact activity view, Squarespace's reporting is thin. The other big site builder goes the other way: Wix publishes an API that returns every opener by name and timestamp.

A thin dashboard is not thin data collection. It is a rendering decision. The pixel request still happened, still hit a log, still tied a timestamp and an IP to a message addressed to one person. Squarespace's privacy policy states the company "acts as a data processor, service provider or similar term under applicable law" and handles that information "on behalf of, and pursuant to, the instructions of that particular Customer."

Why Does the Abandoned Cart Email Know What You Left Behind?

Because Squarespace Commerce watches the checkout, keeps the contents, matches them to the address you typed, and starts a clock. Its abandoned checkout recovery documentation says the reminder goes out 24 hours after a cart is abandoned.

Most recipients read that email as a helpful nudge and never connect it to tracking. It is the loudest signal in the system. An open pixel tells a store you looked at a message. An abandoned cart email proves the store recorded an unfinished action, tied it to your identity across a session boundary, and scheduled outreach a day later. The email is a receipt for surveillance that already happened on the website.

Squarespace also supports automations triggered by joining a list or buying a product. Those triggers are behavioural, and the resulting emails carry the same open pixel.

How Do You Find the Pixel in a Squarespace Campaign?

Open the raw message source and search it for the two shapes tracking always takes: a one pixel image, and a link whose visible text does not match its destination. Ninety seconds of work.

1. Open the campaign in Gmail on desktop. Click the three dot menu at the top right of the message, then Show original. A tab opens with headers and the full MIME body.
2. Click Download Original, or paste the whole thing into a text editor. The body is usually quoted printable encoded, so a trailing = will split URLs in half.
3. Search for width="1", height="1", width:1px and display:none. An image with those attributes is not decoration.
4. Search for <img and read every src pointing somewhere other than the sender's own domain. Pixel URLs usually carry a long opaque identifier and often no file extension.
5. Search for squarespace and sqsp. Sending infrastructure shows up in the headers regardless; what matters is those strings inside src and href attributes in the body.
6. Compare each button's label against its href. A redirect host with an encoded token instead of the shop URL means the link is instrumented.

Our walkthrough on detecting email tracking pixels in Gmail applies the same technique elsewhere, and how to tell if your email is being tracked is the short version.

Which Squarespace Domains Are Worth Knowing?

Here is the honest state of the evidence, because a wrong blocklist entry is worse than no blocklist entry.

• squarespace-mail.com — verified as email infrastructure. Squarespace's third party domain verification guide tells senders to add a DKIM CNAME at squarespace._domainkey pointing to squarespace-domainkey.squarespace-mail.com. A signing domain, documented by the vendor.
• sqsp.email — verified as Squarespace controlled, not verified as the pixel host. A DNS lookup returns 198.185.159.145 and 198.49.23.144, two of the four A records Squarespace publishes in its DNS records documentation. The domain is theirs. Whether your campaign loads its pixel from it, only the message source can tell you.
• Everything else, unverified. Squarespace does not publish the hostname it serves open pixels from. The community filter list at leavemealone-app/email-trackers carries 45 open tracking rules and, as of this writing, not one mentions Squarespace.

Which is the argument against hand rolled filters: a volunteer list covers the platforms somebody got annoyed by, and a website builder that grew into an email sender slips through for years.

How Do You Block Squarespace Email Tracking in Gmail?

Stop the image from loading, and stop the redirect from being followed. Those are the only two events on your side of the wire.

Turn off automatic image loading. In Gmail, open Settings, then See all settings, and under General set Images to Ask before displaying external images. That blunts the pixel across every sender at once. Real images stop loading too, and one absent minded click on "Display images below" fires the tracker anyway.

Do not rely on Gmail's image proxy. Google routes images through googleusercontent.com, hiding your raw IP. It does not stop the fetch. The open is still recorded, still timestamped, still attributed to you.

Use an extension that handles pixels and links. A blocker that strips the pixel before Gmail renders it, and rewrites instrumented links back to their real destinations, closes both paths. Our roundup of email tracker Chrome extensions and how to block them compares the approaches.

How Does Gblock Compare to Ugly Email, PixelBlock and Trocker?

They all block pixels. They differ on tracked links and on whether the blocklist maintains itself, the exact axis a thinly documented platform stresses. The trade offs are in our comparison of Ugly Email, PixelBlock and Trocker.

Ugly Email is MIT licensed, flags tracked threads with an eye icon and blocks the pixel locally. Trocker is free, open source, spans several webmail providers and is the one free tool that also marks tracked links. PixelBlock does clean pixel blocking, though its Manifest V2 lineage means checking you are on a maintained build. Proton Mail and HEY build protection into the client, which works well and is beside the point if your mail lives in Gmail.

Gblock's claim is narrow rather than superior. It runs inside Gmail instead of asking you to change provider, it strips tracking links as well as pixels, and its blocklist updates itself, so an undocumented host does not wait on a volunteer noticing it. It blocks tracking pixels and tracking links, not phishing. For the wider field, the best email tracker blocker extensions lays them out side by side.

Why Email Users Should Care

Squarespace newsletters arrive from florists, ceramicists, yoga studios and independent consultants, which is why this tracking gets a pass it never earned. Nobody suspects the pottery studio, and the pottery studio did not choose the pixel either. Sender and recipient are both downstream of a default neither picked.

The compliance position is uncomfortable. Squarespace's GDPR guidance tells site owners "being GDPR compliant is ultimately up to you," putting the obligation on a one person business that has never heard of terminal equipment access under the ePrivacy Directive. European regulators increasingly treat an open pixel as exactly that, requiring prior consent because the image is not needed to deliver the message. A sender who wanted to comply by switching open tracking off has nowhere in the interface to do it.

The number everyone argues about is broken anyway. Squarespace concedes that under Apple Mail Privacy Protection a campaign "will always be reported as opened, even if the user hasn't opened it," a distortion we measured when Apple Mail started faking half of all email opens. False positives for Apple users, false negatives for anyone blocking images, and the imposition on everyone else unchanged. A metric this noisy is a strange thing to keep mandatory.

The Honest Summary

Credit where it belongs: Squarespace documents the invisible image in public, names the link types it excludes from click tracking, and admits its open rates are unreliable. That is more candour than most of the industry manages, and more than Shopify offers on the click side.

The gap is consent. Shopify at least gives merchants four open tracking settings, one of which asks the recipient. Squarespace gives them zero. The image loads, the link redirects, and the only decision left belongs to the person opening the mail.