4 ms·

SendGrid appends a tracking pixel even when disabled

132 points by crisp 5y ago

ricardobayes 5y ago
Also other tools like hotjar have an explicit option to override DNT (do not track). Feels like it should be illegal.
mmaunder 5y ago
Anyone from Sendgrid here? Would love some clarification on this.
capableweb 5y ago
Personally I stopped using SendGrid when they forced everyone to start using insecure 2FA (requiring a phone number instead of the normal OTP/TOTP that can be setup via any authentication app), presumably to force more people to use Twillio services or something.
- remus 5y ago
  I stopped using them because of their awful support. The shared IP address our emails were coming from must have gotten on to a blacklist because 35% of our emails started being rejected overnight (not even making it to spam!) and their response was "just wait a few weeks, email reputation improves with time" like you can run a business when there's a 1 in 3 chance of any communication with a customer disappearing?! Moved to SES and been smooth sailing since (and a lot cheaper).
  - petercooper 5y ago
    The support has gotten worse since Twilio took over. Even if you ignore delays, they struggle to understand problems quickly. We've had a couple of incidents where they are hitting our webhook over and over for days and prove unable to diagnose it properly. The service at a technical level is pretty good. It does the job, the pricing is fine, and deliverability is good. I think their IP address space is considered a bad neighborhood by some spam filtering systems though, since we can't send email to systems protected by Mimecast (sorry Red Hat, Packt, Siemens, et al.) despite our own dedicated IPs having very solid reputation and histories.
- lambic 5y ago
  Their 2FA uses the twilio authenticator app now.
- vertis 5y ago
  Yeah, Twilio tried to force that on me as well. Couldn't enable 2FA auth without a phone number and since I'm a digital nomad phone numbers and sim cards are a pain point. Opted just not to use Twilio. It's bizarre because they own Authy so could have pushed more people towards that instead.
petercooper 5y ago
Heavy Sendgrid user here, and while the customer support agent quoted in the post does say this, I can confirm we are not experiencing the same issue with normal emails sent via the API. (Just for anyone who was worried.)
- crisp 5y ago
  That's probably the only way with SendGrid to strip down all of the trackers. Single Send is simple to use but apparently dude's gotta write his own mailer script to send emails via the API.
  - petercooper 5y ago
    I've taken a look and a lot of this single send/marketing stuff seems new (to me – it could well be a few years old!). I don't think it was in place when we started using Sendgrid several years ago. Sendgrid has only been an email "pipe" to us – no campaign or list management, email designing, etc. I think they've added that stuff on top of their traditional offering in recent years.
    - shantara 5y ago
      I suggest checking Tracking settings in your Sendgrid account. I found myself in a similar situation with a tracking pixel being embedded in my personal email notifications. After checking the settings page, turns out Open tracking and Click tracking were enabled, even though I always disable everything spyware-related in every account I create. I can only assume they were silently added and enabled at some point during the last couple of years.
      - petercooper 5y ago
        Even better, I checked the actual HTML received from a few recent campaigns - no Sendgrid tracking either at link or image level, luckily! :-)
      - crisp 5y ago
deleted 5y ago
[deleted]
adders 5y ago
Not an expert at all, but my basic understanding of GDPR is if you outsource a service to a 3rd party and they collect data or do any processing that they shouldn't, you are essentially responsible.
- crisp 5y ago
  It makes sense. I'm the one selecting the tooling afterall so I should also be responsible for making sure to comply with whatever laws/directives there are. This being said, it feels unfair when you try to comply but somebody fucks you over.
jwr 5y ago
BTW, don't use SendGrid unless you intend to pay them lots of money for a dedicated IP. I've been using them for a couple of years now and it's extremely frustrating, because they are used by spammers and do not react quickly enough or simply do not care. Some of your E-mails will end up sent from IPs that landed in various anti-spam blackhole systems already and will never reach their destination. This happens regularly and makes SendGrid totally useless for transactional E-mail (I prefer to send it myself) and problematic for things like product updates. I complained to them about this problem many times and it is my impression that this is a way to force-upsell customers to higher plans with dedicated IPs.
- crisp 5y ago
  Thanks for the insight. It's the only mailer service I've used so far but seems like I gotta do some exploring.
  - technothrasher 5y ago
    I've been exploring lately, and the only two I've actually tried so far are SendGrid and Amazon SES. Both of them have a free tier that lets me play. Both of them have so far had pretty poor deliverability due to being in blacklists, though SendGrid has been better. I'm just looking for something that doesn't cost an arm and a leg for the minimal email volume I send, and that has better deliverability than sending myself with a VPS, as there's usually at least one bad actor in any /24 your typical VPS will land in and that punishes your deilverability.
    - npsomaratna 5y ago
      Postmark works well for transactional email. We've seen consistently good deliverability over time.
      - technothrasher 5y ago
        Thanks! It was on my list to check out, I guess I'll do that now :)
jiveturkey 5y ago
There's additionally a mail setting for list management that interacts with tracking. That one might need to be disabled as well. This is very poorly documented.
- crisp 5y ago
  Thanks for helping out, I'll go through the settings one more time. The customer service just repeated the same mantra that the tracking pixel is always added, regardless of what the Open Tracking setting is.

132 points by crisp 5y ago

ricardobayes 5y ago

Also other tools like hotjar have an explicit option to override DNT (do not track). Feels like it should be illegal.

mmaunder 5y ago

Anyone from Sendgrid here? Would love some clarification on this.

capableweb 5y ago

Personally I stopped using SendGrid when they forced everyone to start using insecure 2FA (requiring a phone number instead of the normal OTP/TOTP that can be setup via any authentication app), presumably to force more people to use Twillio services or something.

remus 5y ago
I stopped using them because of their awful support. The shared IP address our emails were coming from must have gotten on to a blacklist because 35% of our emails started being rejected overnight (not even making it to spam!) and their response was "just wait a few weeks, email reputation improves with time" like you can run a business when there's a 1 in 3 chance of any communication with a customer disappearing?! Moved to SES and been smooth sailing since (and a lot cheaper).
- petercooper 5y ago
  The support has gotten worse since Twilio took over. Even if you ignore delays, they struggle to understand problems quickly. We've had a couple of incidents where they are hitting our webhook over and over for days and prove unable to diagnose it properly. The service at a technical level is pretty good. It does the job, the pricing is fine, and deliverability is good. I think their IP address space is considered a bad neighborhood by some spam filtering systems though, since we can't send email to systems protected by Mimecast (sorry Red Hat, Packt, Siemens, et al.) despite our own dedicated IPs having very solid reputation and histories.
lambic 5y ago
Their 2FA uses the twilio authenticator app now.
vertis 5y ago
Yeah, Twilio tried to force that on me as well. Couldn't enable 2FA auth without a phone number and since I'm a digital nomad phone numbers and sim cards are a pain point. Opted just not to use Twilio. It's bizarre because they own Authy so could have pushed more people towards that instead.

petercooper 5y ago

Heavy Sendgrid user here, and while the customer support agent quoted in the post does say this, I can confirm we are not experiencing the same issue with normal emails sent via the API. (Just for anyone who was worried.)

crisp 5y ago
That's probably the only way with SendGrid to strip down all of the trackers. Single Send is simple to use but apparently dude's gotta write his own mailer script to send emails via the API.
- petercooper 5y ago
  I've taken a look and a lot of this single send/marketing stuff seems new (to me – it could well be a few years old!). I don't think it was in place when we started using Sendgrid several years ago. Sendgrid has only been an email "pipe" to us – no campaign or list management, email designing, etc. I think they've added that stuff on top of their traditional offering in recent years.
  - shantara 5y ago
    I suggest checking Tracking settings in your Sendgrid account. I found myself in a similar situation with a tracking pixel being embedded in my personal email notifications. After checking the settings page, turns out Open tracking and Click tracking were enabled, even though I always disable everything spyware-related in every account I create. I can only assume they were silently added and enabled at some point during the last couple of years.
    - petercooper 5y ago
      Even better, I checked the actual HTML received from a few recent campaigns - no Sendgrid tracking either at link or image level, luckily! :-)
    - crisp 5y ago

deleted 5y ago

[deleted]

adders 5y ago

Not an expert at all, but my basic understanding of GDPR is if you outsource a service to a 3rd party and they collect data or do any processing that they shouldn't, you are essentially responsible.

crisp 5y ago
It makes sense. I'm the one selecting the tooling afterall so I should also be responsible for making sure to comply with whatever laws/directives there are. This being said, it feels unfair when you try to comply but somebody fucks you over.

jwr 5y ago

BTW, don't use SendGrid unless you intend to pay them lots of money for a dedicated IP. I've been using them for a couple of years now and it's extremely frustrating, because they are used by spammers and do not react quickly enough or simply do not care. Some of your E-mails will end up sent from IPs that landed in various anti-spam blackhole systems already and will never reach their destination. This happens regularly and makes SendGrid totally useless for transactional E-mail (I prefer to send it myself) and problematic for things like product updates. I complained to them about this problem many times and it is my impression that this is a way to force-upsell customers to higher plans with dedicated IPs.

crisp 5y ago
Thanks for the insight. It's the only mailer service I've used so far but seems like I gotta do some exploring.
- technothrasher 5y ago
  I've been exploring lately, and the only two I've actually tried so far are SendGrid and Amazon SES. Both of them have a free tier that lets me play. Both of them have so far had pretty poor deliverability due to being in blacklists, though SendGrid has been better. I'm just looking for something that doesn't cost an arm and a leg for the minimal email volume I send, and that has better deliverability than sending myself with a VPS, as there's usually at least one bad actor in any /24 your typical VPS will land in and that punishes your deilverability.
  - npsomaratna 5y ago
    Postmark works well for transactional email. We've seen consistently good deliverability over time.
    - technothrasher 5y ago
      Thanks! It was on my list to check out, I guess I'll do that now :)

jiveturkey 5y ago

There's additionally a mail setting for list management that interacts with tracking. That one might need to be disabled as well. This is very poorly documented.

crisp 5y ago
Thanks for helping out, I'll go through the settings one more time. The customer service just repeated the same mantra that the tracking pixel is always added, regardless of what the Open Tracking setting is.