Private Browsing Isn’t What You Think: How Tracking Pixels Follow You Anyway

Private browsing: what it really does (and what it doesn’t)

“Private browsing,” “Incognito,” and “InPrivate” sound like a cloak of invisibility. In reality, these modes are more like borrowing a library computer that wipes the recent activity list after you leave. Helpful, yes—but it doesn’t stop the library’s security cameras, the websites you visit, or the internet provider carrying the connection.

Here’s what private browsing is genuinely good at:

• Not saving browsing history on that device/profile.
• Clearing cookies and site data when you close the private window (usually).
• Keeping logins separate—useful if you want to sign into a second account temporarily.

And here’s what it typically doesn’t do:

• Hide you from websites you visit (they still see your IP address and browser details).
• Stop tracking that happens within the session (trackers can still observe what you do while the window is open).
• Prevent email tracking at all—private browsing doesn’t change how your email client loads images.
• Block network observers like your employer’s network, school Wi‑Fi, or internet provider.

So if private mode doesn’t equal “untrackable,” what’s doing the tracking? One of the biggest culprits—surprisingly simple—is the tracking pixel.

Newsletter

Never miss out on great articles — just enter your email and receive a weekly update!

Go

I have read and accept the Terms & Policy

Tracking pixels, explained like a tiny “read receipt” you didn’t ask for

A tracking pixel (also called a web beacon) is usually a 1×1 transparent image or tiny snippet that loads from a server the moment a page or email is opened. It’s small enough that you never notice it—but loading it is the whole point.

Think of a pixel like this: you receive a letter, and inside the envelope is a paper-thin card that automatically mails itself back to the sender the instant you open it. The card doesn’t contain your life story—just a quick signal: “Opened at 9:42 AM, roughly in this city, on an iPhone, using this email app.”

When that pixel loads, it can transmit (or allow the server to infer) details such as:

• That you opened the email/page (and sometimes how many times).
• When you opened it.
• Your IP address (which often reveals approximate location and internet provider).
• Your device and app/browser type (from “user agent” and related signals).
• Which email campaign, message, or account you’re tied to (via unique IDs in the pixel URL).

In emails, a pixel is commonly embedded as an image, like:

• <img src="https://tracker.example.com/open?id=USER123&campaign=SPRING" width="1" height="1" />

That id=USER123 part is the magic trick: it makes the pixel unique per recipient. If you open the email, the tracking server knows exactly whose inbox it reached—no guessing required.

On websites, pixels show up in a similar way—often via analytics tools, ad networks, “like” buttons, embedded fonts, or invisible resources that quietly report back.

A quick everyday scenario:

You browse for a new backpack during lunch. Later, you open an email newsletter from an outdoor store and click a “See the new arrivals” button. That click leads to a page containing a tracking pixel from an ad network. Now the ad network can connect: newsletter click → product page view. Later that night, you see backpack ads in a totally different app. It feels spooky, but the mechanics are often just pixels plus shared IDs.

Notice what’s missing from that table: “private browsing mode.” Pixels don’t care whether you’re in Incognito. If the pixel loads, it can report back.

What actually helps: small, realistic changes that reduce pixel tracking

You don’t need a computer science degree—or a life lived entirely offline—to cut down pixel tracking. The biggest wins come from stopping automatic pixel loads, limiting cross-site tracking, and being picky about which apps get to follow you around.

1) In email, block remote images (this is the pixel’s main doorway)

Email tracking pixels usually work only if your email client loads images from the internet. If images don’t load automatically, the “opened” signal often doesn’t fire.

• Gmail (web): Images usually load by default, but you can adjust settings to ask before displaying external images (availability can vary by account type).
• Apple Mail: Features like Mail Privacy Protection can reduce sender visibility by preloading/obscuring some signals (helpful, though not perfect for every situation).
• Outlook: Many setups allow blocking external images or requiring approval.

If you want a simple habit: preview text-only first. If you trust the sender and want the visuals, then load images.

2) Use a tracker blocker in your browser

Many tracking pixels on websites come from known tracking domains. Content blockers can prevent those domains from loading at all.

• Browsers with built-in tracking protection can reduce a lot of “background” requests.
• Reputable extensions/content blockers can go further by blocking known trackers and pixel endpoints.

What this looks like in real life: a news site still loads, but dozens of hidden calls to ad-tech servers never fire—meaning fewer pixels sending “I saw this page” signals.

3) Tighten your phone’s ad tracking settings

Even when pixels can’t use cookies, mobile ecosystems often have advertising identifiers. Limiting ad tracking reduces how easily activity can be stitched together across apps.

• On iOS, app tracking permissions can prevent apps from accessing certain identifiers.
• On Android, you can reset or limit the advertising ID and review ad personalization controls.

This won’t stop every pixel, but it can reduce the “connective tissue” that turns separate sightings into a single profile.

4) Be cautious with “Continue with…” logins and link tracking

Convenient login buttons are great—but they can also create clean, consistent identifiers across many sites. Similarly, many newsletter links contain tracking parameters (long strings after a ? in the URL).

• If a link looks like example.com/page?utm_source=newsletter&utm_campaign=spring&id=123, the utm_ parts are usually campaign analytics; an id= or unusually specific token might be user-level tracking.
• Some privacy-focused browsers and extensions can automatically trim common tracking parameters.

5) Understand the trade-off: “free” services often pay the bills with measurement

Pixels aren’t only used for creepy reasons. Some are used for basic, legitimate measurement—like knowing whether a security email was opened, or whether a checkout button is broken. The problem is when measurement becomes persistent profiling across sites and apps.

A practical mindset is: allow what you need, block what you don’t. You might load images for receipts and order updates, but block them for marketing blasts. You might allow analytics on a small blog you trust, but block ad network trackers everywhere.

Once you start recognizing pixels as tiny “call home” elements—rather than mysterious surveillance—it gets easier to make calm, practical choices: stop automatic image loads where it matters, block common trackers in the browser, and keep your phone’s ad permissions on a short leash.