Is Xero Tracking Your Email? How to Block It

Probably less than you fear, and for an unusual reason. Xero email tracking is mostly not email tracking at all. On the evidence Xero publishes, opening the message in Gmail tells the business nothing; clicking the blue button inside it tells them plenty. The status moves to Viewed when someone loads the hosted invoice page at in.xero.com, which is why the loudest complaints about this feature come from Xero's own customers, who want it to fire more often.

Key Takeaways

• Xero's online invoice link resolves to in.xero.com plus a long opaque token unique to that invoice, per the example response in Xero's published API specification.
• The Invoice schema in Xero's Accounting API carries six status values (DRAFT, SUBMITTED, DELETED, AUTHORISED, PAID, VOIDED) plus a SentToContact boolean, and no viewed or opened field anywhere in the document.
• Xero's cookie notice states that web beacons let the company "recognize when someone has visited our websites or opened an email that we have sent them" — a statement about mail Xero sends, not about the invoice your electrician sends.
• Xero Community Manager Kelly Munro confirmed on 7 July 2026 that the new invoice editor lets a sender strip the online invoice links and QR code out entirely.
• Xero reported 4.41 million subscribers in its FY25 results for the year ended 31 March 2025, so the default reaches millions of invoice recipients who never chose it.

Does Xero Tell the Sender You Opened the Invoice?

No. It tells the sender when you opened the invoice page, a related but different event. An invoice emailed from Xero shows as Sent and moves to Viewed once the online invoice loads. Opening the email, reading the amount in the preview pane and opening the attached PDF do not move it.

The clearest corroboration is not in a help page, it is in the complaints. On Xero's forum, the request for a notification when a customer has viewed an invoice or quote was submitted on 23 December 2022 and still carries 49 votes with no delivery date. One commenter names the gap exactly: "The online quote isn't opened, The PDF gets opened instead, And you're left with no visibility." A vendor running a beacon in the message would not have that problem.

A second, colder piece of evidence: search Xero's published Accounting API specification for the words viewed or opened and you get nothing. The Invoice object exposes six statuses and a SentToContact flag described as a "Boolean to set whether the invoice in the Xero app should be marked as 'sent'." Viewed lives in the web interface only, never surfaced as invoice data.

Is There a Tracking Pixel in a Xero Invoice Email?

We found no evidence of one, and Xero documents none. That is a careful sentence, so here is the boundary around it.

Xero Central does not state whether invoice mail carries a remote image beacon, and Xero publishes no image host, no redirect domain and no open tracking field for the invoice send path. What it does publish is a link straight to in.xero.com with a token in the path, rather than a wrapped redirect through a marketing host. The sender gets one signal, it fires on a page load, and you choose whether to generate it. Compare QuickBooks email tracking, where Intuit's own help page warns senders that Viewed "may not appear if the customer's email doesn't auto-allow image downloads." Two accounting platforms, the same status word, two entirely different mechanisms underneath it.

Check your own copy rather than taking our word for it: our walkthrough on detecting email tracking pixels in Gmail covers Show Original and what a beacon looks like in raw source. Xero sends invoice mail from message-service@post.xero.com, an address 468 voters have asked Xero to let them replace with their own domain, moved to In Discovery on 12 March 2026.

What Does Xero's History and Notes Log Record?

Every change to the transaction, with the name of the person who made it and a timestamp. Xero's page on viewing history and adding notes to transactions describes an entry added each time a user creates, edits or otherwise changes a transaction, recording who did it and when.

The API mirrors that shape, exposing four fields on a history record: Details, Changes, User and a UTC DateUTC stamp. Notice who the log is about: it is an audit trail of the sender's staff — who approved the invoice, who edited the amount, who emailed it and to which address. You appear in one line, the send, and that line names your email address rather than your behaviour. Xero Central does not publish which recipient side events land in History and Notes versus which only change the status badge, so treat any article offering a list as guessing.

What Does Loading in.xero.com Actually Reveal?

More than the word Viewed suggests, because a web session is richer than an image request. Loading the hosted page makes you a visitor on a Xero property, and Xero's privacy notice describes service usage data as including "page views and searches, login information, clicks, content interaction, length of visits", alongside device data collected "using tags and pixels, including your IP address, ISP, the browser you use to visit our websites, device type and location".

What reaches the sender's dashboard is narrower than what the platform sees, and still enough to read you. The timestamp says when. A second visit says you came back. The gap between Viewed and paid says you looked and did not act, which is the most useful fact in any collections conversation. Nobody chasing money needs your device type; they need to know you saw it on Tuesday and stayed quiet until Friday.

Does Xero's Own Email Track You?

Yes, and Xero says so in plain words — but this is a separate pipeline from the invoice your builder sends. Xero's cookie notice states that the company uses "web beacons (sometimes called 'tracking beacons' or 'clear gifs')" which are "tiny graphics files that contain a unique identifier that enable us to recognize when someone has visited our websites or opened an email that we have sent them".

That is conventional open tracking, disclosed properly, in mail Xero sends to its own audience. It says nothing about invoices, and conflating the two is how most coverage of this topic goes wrong. Xero's privacy notice draws the line itself: it does not apply to data subscribers "enter into our services about their own customers, suppliers, employees or other third parties", because there "our subscribers control that personal data and we process it only as a service provider (or 'processor')".

How Is This Different From a Read Receipt You Agreed To?

A read receipt asks. This does not, and the asymmetry is the whole complaint. The classic read receipt is a standardised request, defined by the IETF in RFC 8098, and your mail client is free to refuse it. The Viewed flag is generated by an action you took for a different reason: paying attention to a bill. Nobody clicks Review and pay in order to file a timestamp, yet that is what the click does first.

For anyone with a compliance brief, the processor line above is the one that matters. Xero is the processor; the business is the controller. So a record showing a named customer loaded an invoice at 22:14 on a Sunday sits under the accountability of a sole trader who has never written a retention policy. That is the structural consequence of shipping behavioural data to millions of micro controllers at once.

How Do You Block Invoice Email Tracking in Gmail?

Start with the honest part: nothing hides a visit to in.xero.com. That page is first party code doing the job you asked for. What you can control is everything around it, and the rest of your accounting inbox, which is thick with ordinary beacons.

• Read the amount without loading the page. If the sender attached the PDF, open that: a file on your own machine makes no network request. Xero's attach setting lives in the sender's browser, so ask once and they can make it stick.
• Switch Gmail to ask before loading images. Settings, See all settings, General, Images, then Ask before displaying external images. This does nothing to a Xero invoice status and plenty to the payment reminders and accounting newsletters around it. The cost: every logo in your inbox goes blank.
• Run a blocker inside Gmail. An extension drops known tracking requests while normal images still render, which is the version people leave switched on past week two. It also strips wrapped redirect links, which Gmail's image setting ignores.
• Expect the reminder anyway. Xero's automatic invoice reminders are scheduled against the due date, not your silence. No blocker stops them arriving.

The broader routine lives in how to block email tracking in Gmail, and it is worth doing for the inbox as a whole rather than for Xero.

Which Blocker Should You Use?

Four real options, on the axes that actually differ. None changes what happens when you load a Xero invoice page, and any tool claiming otherwise is selling you something. The wider field is covered in our roundup of the best email tracker blocker extensions.

So what is a blocker for, if Xero's own signal sits outside its reach? Everything else in the same folder. Payment platforms, bookkeeping services and the accountant's newsletter all send mail with beacons in it. Xero is the unusual case here, not the representative one.

Why Email Users Should Care

Because invoices are the mail you cannot ignore. A newsletter you skip costs nothing; an invoice is an obligation from somebody you have a live financial relationship with, and the timing of your reply is negotiating information. Xero reported 4.41 million subscribers for the year ended 31 March 2025 in its FY25 results, so this is millions of dashboards quietly noting your attention.

The comforting part is that Xero hands you the switch: the trigger is a click, not a render, so your inbox is not leaking on its own. The uncomfortable part is that the switch is disguised as the thing you wanted to do, and the button is large and blue and says Review and pay. Read the amount from the PDF when you only want the number, load the page when you intend to settle, and put a blocker in front of the hundred other emails a week that never offer you the choice.

The Honest Summary

Xero comes out of this better than its competitors, which is not the conclusion a privacy article is meant to reach. Viewed is a page load on a Xero domain, not a beacon in your mail; the API carries no viewed field; the tracking is so limited that Xero's own customers keep filing requests to make it stronger. We went looking for a pixel and did not find one.

Keep the caveat attached. Xero Central never publishes the mechanism outright, so this conclusion is drawn from the link format, the API schema and the behaviour Xero's own users describe, not from a sentence Xero wrote. If Xero changes any of that, the remedy stays the same: refuse the request before it leaves your browser, and decide for yourself when a sender gets to know you were there.