Is Staffbase Tracking Your Email? How to Block It

The company newsletter arrived at 08:41 with the CEO's photo on top and a link to the new travel policy below. You gave it four seconds. Staffbase email tracking turned that into a data point: skimmed, desktop, timestamped. It does not stop at whether the message was delivered, or even whether you opened it. It estimates how long you looked, logs the links you clicked, and hands internal comms a list of everyone who never opened it.

Key Takeaways

• Staffbase Email is the rebranded Bananatag, the Kelowna based email tracking tool that merged with Staffbase in an announcement dated March 4, 2021.
• Staffbase documentation defines three read time buckets: glanced at 1 to 2 seconds, skimmed at 3 to 8 seconds, and read at 9 seconds or longer.
• Read time is measured by a pixel that holds its connection open while the message is displayed, so Staffbase states read times cannot be recorded when a client blocks or reroutes images.
• France's CNIL required consent or a documented opportunity to object for email open pixels by July 14, 2026, and Italy's Garante set an October 28, 2026 deadline.
• Setting Gmail to "Ask before displaying external images" stops the open pixel and the read timer, but not rewritten tracking links.

What Is Staffbase Email?

Staffbase Email is internal communications software that lets HR and comms teams build branded newsletters, send them to employee distribution lists from inside Outlook, and measure engagement afterwards. It started as Bananatag, a Canadian email tracking product, and joined Staffbase after the two companies announced their merger in a March 2021 press release describing a combined company of roughly 450 employees serving about 1,000 customers. The Bananatag name was retired. The tracking engine was not.

Nobody signs up for Staffbase. It arrives as an Outlook add in installed by IT and a distribution list you are on because you are on the payroll, which is why most employees have never heard the name. Universities publish onboarding pages for it: the UCSF IT service page documents it as the successor to Bananatag for campus wide messaging, detailed analytics and heat maps included. This is the third internal comms tracker we have profiled after ContactMonkey and PoliteMail, and the pattern holds: same pixel, same redirect, aimed at staff rather than at customers.

What Does Staffbase Track About You?

More than an open rate. Staffbase's own read time documentation describes engagement bucketed by how long a message was actively displayed, and the analytics documentation describes per recipient counting of first opens and of clicks per link. Depending on how your employer configured the account, a comms dashboard can surface:

• Whether you opened the message at all, and when, to the second
• An estimated reading duration, bucketed as glanced, skimmed or read
• The device type, since open and click totals can be filtered by it
• Which specific links you clicked, counted per recipient per link
• Approximate location, derived from the IP that requested the pixel
• A list of non openers, with a follow up email aimed at exactly those people

Staffbase documents that recipients on follow up lists are anonymized, a real control worth crediting. But the feature exists only because the system knows who did not open the email. Anonymization is a presentation choice applied to data collected either way.

Read time is where this diverges from marketing tracking. A marketing pixel answers a delivery question: did this reach a human. A read time bucket answers an attention question: did this human care. Five seconds separates skimmed from read in a chart your director may see. No email marketer has ever held that number about you while also approving your promotion.

How Does the Tracking Actually Work?

Two mechanisms do most of the work, and one is unusual. The first is the standard open pixel: an invisible image, typically a 1x1 transparent GIF, served from the sender's tracking infrastructure with a URL carrying an identifier tied to that send and that recipient. Your mail client renders the message, requests the image, and the request is the open event. To find one in your own inbox, see how to detect email tracking pixels in Gmail.

The second mechanism is the read timer, and here Staffbase does something a plain newsletter does not. Instead of firing one request and finishing, the pixel request stays connected while the message is actively displayed. The server measures the lifetime of that connection and converts it into buckets. It is a long lived HTTP request used as a stopwatch.

Two consequences follow, and Staffbase states both. Read time requires the pixel to be fetched directly rather than through an image proxy, and if images are blocked outright no read time is recorded at all. Gmail routes remote images through Google's caching proxy, which is also why the location a sender records for a Gmail recipient is Google infrastructure, not a home address. Outlook desktop, the more common deployment here, offers no such buffer.

Click tracking is the third piece and obeys none of those rules. Links are rewritten to point at a redirect on the tracking domain, which logs who clicked what and when before bouncing you to the real destination. Image blocking cannot touch it, because you make that request deliberately. Staffbase exposes tracking and link tracking as separate sender side switches, and neither is yours.

Is Employer Email Tracking Legal Under GDPR?

In the EU, individually attributed open tracking of employees sits on uncertain ground, and 2026 narrowed it further. Two regulators concluded that the open pixel is functionally equivalent to a cookie and needs prior consent. France's CNIL set July 14, 2026 as the date by which senders had to give clear information and a real opportunity to object, covered in France's deadline for email tracking pixels. Italy's Garante followed with Provision No. 284 and an October 28, 2026 deadline, detailed in our breakdown of the Garante's pixel rules. Both regimes exempt only a shared pixel producing aggregate, anonymized counts. A per recipient identifier attached to a reading duration is the opposite of that.

Employment law makes this harder. Consent is a weak basis at work because the employer holds the power, and the European Data Protection Board's Guidelines 1/2024 on legitimate interest require a documented assessment of purpose, necessity and proportionality, not an assertion that measurement is useful. Article 88 GDPR then lets member states layer employment specific rules on top.

Germany is the sharpest example, and Staffbase is headquartered there. Section 87(1) no. 6 of the Works Constitution Act gives works councils co determination rights over technical systems capable of monitoring employee behaviour or performance. A dashboard sorting named staff into skimmed and read qualifies on any honest reading, and deploying one without a works agreement is a live exposure.

The gap most comms teams miss is proportionality. "We need to know whether our communications land" justifies aggregate measurement. It does not justify per employee attribution, because the purpose is achievable without it. That is where a supervisory authority will land.

How Do You Block Staffbase Email Tracking?

You block it on the recipient side, because there is no recipient side setting inside the product. Every toggle belongs to the sender. Two layers cover different halves of the problem.

Layer one: stop automatic image loading. In Gmail, open Settings, See all settings, General, find Images, and choose "Ask before displaying external images." Google documents this in its Gmail image settings guide. In Outlook the equivalent lives in Trust Center settings, under automatic download of pictures in HTML email. This is the baseline defense because it defeats the open event and the read timer in one move: no image request means no connection to time. The cost is that every legitimate image also stops rendering, and a design heavy newsletter becomes a wall of alt text and empty boxes.

Layer two: strip the beacons, keep the pictures. A blocker extension parses the message before it renders, removes known tracking pixels, and rewrites tracking links back to their real destinations so a click never touches the logging redirect. Images still load and layouts still work. Gblock does this inside Gmail with an auto updating blocklist, which matters because tracking vendors rotate domains and hand maintained lists decay within months.

Know the limits. Plain text reading kills the pixel but mangles the message. Blocking pixels does not hide a click if you follow a rewritten link anyway. And nothing client side changes what your employer's mail server or endpoint software sees. The fuller walkthrough is in how to block email tracking in Gmail.

Which Blocker Should You Actually Use?

Pick on the merits, not on the pitch. Ugly Email flags tracked messages with a visible icon and is excellent for awareness. PixelBlock blocks pixels in Gmail and is deliberately minimal. Trocker covers Gmail and other webmail and handles some link unwrapping. Proton Mail and HEY block remote content at the server by default, the strongest protection here, and also mean changing provider, which is not an option for the work account where Staffbase reaches you.

Gblock's differences are narrow: the blocklist updates automatically rather than depending on a maintainer's spare time, it strips tracking links rather than only pixels, and it runs inside Gmail without changing how your mail looks. It will not stop a click you choose to make on a rewritten link, does nothing in Outlook desktop, and is no defense against corporate device monitoring. We compare the options in our roundup of the best email tracker blocker extensions.

One thing worth saying out loud. If your employer mandates a communications tool, blocking pixels is a personal privacy measure, not a way around workplace policy. You still have to read the memo. You are declining to broadcast how long it held your attention, which is a different thing entirely.

What This Means for Your Inbox

Marketing spent a decade arguing about whether open data is personal data, and regulators in France and Italy have now largely answered yes. Internal communications skipped that argument, because the recipients had no unsubscribe link to click. The telemetry we documented in sales and marketing trackers across Gmail arrived inside the company, pointed at staff, wearing a friendlier badge.

The exposure is cumulative rather than dramatic. One newsletter tells your employer almost nothing. Fifty across a year produce a passive record of when you sit at your desk, which evenings you check work mail, which benefits pages and internal job postings you clicked, and how much attention you gave the messages leadership cared about. Nobody set out to build that profile. The dashboard assembles it anyway.

The fix is the one that works against every commercial tracker, because the technology underneath is identical. Stop the beacon at the client and unwrap the link before you click it. Your employer still learns the memo was delivered. They stop learning that you gave it four seconds. Workshop, a competing internal communications platform, goes a step further by giving every employee a unique pixel: see whether Workshop is tracking your work email.

Staffbase is not alone. Firstup serves a 43 byte pixel from clicks.onfirstup.com and counts a click as an open when the pixel is blocked, and Poppulo ties its named Not Opened By list to IT allowlisting.