Email Leaks More Than Its Contents
Email was built in the open, decades before privacy was a concern. Every message carries a paper trail of where it came from, and a single loaded image can tell the sender you read it — from where, and when.
I use a private messenger now. But most of the serious mail in my life is still email. Is that as private?
No — and it is worth being honest about why. Email is old. It was designed to move text between machines in the open, long before anyone worried about who was watching. Privacy was bolted on later, unevenly.
Which is why it is my favourite. People guard their chats and forget their inbox tells me half of what I want without my ever reading a word.
The headers are a travel log
Every email carries headersMetadataData about your data — not what you said, but who you said it to, when, from where, and how often. most people never see: a stack of Received lines recording each server the message passed through, often with an IP addressIP addressThe number that identifies where your traffic comes from on the internet — roughly, which door it should be delivered back to., plus the time and sometimes the program that sent it. The body is what you wrote; the headers are where it has been.
Received: from laptop.home (203.0.113.45) by mail.example.com
Date: Tue, 24 Aug 2026 19:42:03 +0100
X-Mailer: SomeMailApp 7.2 (macOS)
Subject: dinner?
- Line 1The sending machine's IPIP addressThe number that identifies where your traffic comes from on the internet — roughly, which door it should be delivered back to. — often your home connection — recorded in the header before the message even left. A rough location, for free, from a one-word email.
- Line 3The client and operating system, announcing themselves. None of this is the content, and all of it describes you.
Your email is encrypted in transit with TLSTLSThe encryption behind the padlock — it scrambles the contents of a page between your device and the site so nobody in between can read it.. Does that mean the provider cannot read it?
The pixel that reads you back
Open an email and images often load from the sender's server. A tracking pixel is a tiny, invisible image whose only job is to be fetched: the moment you open the message, your device quietly requests it, and the sender learns you read it, when, and from which IPIP addressThe number that identifies where your traffic comes from on the internet — roughly, which door it should be delivered back to.. A read receipt you never agreed to.
# their server log, the instant you open the email:
GET /pixel.gif?id=you-specifically 203.0.113.45 09:14:22
# opened, by this recipient, from here, at this time
# you sent all of that by doing nothing but reading
You get a marketing email and simply open it to read, loading its images. What has the sender likely learned?
What actually helps
Treating email like a private channel
- Assuming "encrypted" means the provider cannot read it
- Loading remote images, sending opens and IPs back to every sender
- One address for everything, linking every account and contact togetherTreating email as a postcard
- Blocking remote images; loading them only when you trust the sender
- Using per-purpose aliases so a leak in one place does not join the rest
- Reserving email for what can be a postcard; a real secret needs end-to-end
- For a serious adversary, composing over [[tor|Tor]] so the header IP is not yoursEmail is not going away, and it does not have to be dangerous — but it is a postcard, not a sealed letter. Match how you use it to your threat modelThreat modelFour honest answers: what you are protecting, from whom, what happens if it fails, and how much trouble you will go to., and keep the sealed things off it.
So the contents are only half of it. The headers and the pixel are the rest, and both leak by default.
Right. Block remote images, split your addresses with separate identitiesCompartmentalisationKeeping separate parts of your life in separate identities that share nothing — so a breach or a link in one cannot spread to the others., and remember the provider can read the body. Email is fine for a postcard and wrong for a secret.
And every inbox that trusts it hands me a travel log and a read receipt, free. I rarely need the words.
Legal
Reading the headers of mail sent to you, and protecting your own inbox, is ordinary self-defence. Planting a tracking pixel to profile someone, or reading headers to locate a person who has not contacted you, is surveillance — the very thing this lesson teaches you to notice and refuse.
So email carries a travel log in its headers, is readable by its provider, and reports your reading through remote images. Block those images, keep your addresses apart, and treat it as the open postcard it is. Next: how to actually choose a messenger — for the metadataMetadataData about your data — not what you said, but who you said it to, when, from where, and how often. it keeps as much as the contents it hides, and one more property, forward secrecyForward secrecyA property where stealing today's keys does not unlock yesterday's messages — each conversation is protected even if a key later leaks..