Fifty of the largest US retailers collectively sent more than 10 billion marketing emails over the Black Friday weekend alone, nearly doubling their daily email output during that four-day shopping surge.
Even more concerning, 80% of these messages embedded tracking pixels or links designed to harvest user data.
The report, published by Proton, the Swiss privacy company behind Proton Mail, is based on an investigation from November 4 to December 1, 2024, using a controlled Proton Mail inbox to analyze volume, timing, and embedded surveillance tools. The researchers mapped incoming emails against public data such as loyalty program membership counts and market share to estimate each brand’s total daily output.
The results show that, on a typical day in November, the 50 audited brands sent an estimated 1.3 billion marketing emails per day. That number surged to 2.55 billion emails daily during the Black Friday to Cyber Monday window, equivalent to every US adult receiving dozens of messages in just one weekend.
Invisible “spy pixels” logged when and where users opened emails, while tracking links recorded every click to build detailed behavioral profiles. This form of digital monitoring occurred in 100% of emails from 80% of the audited brands. Notably, categories requiring higher levels of consumer trust, like home decor and intimate apparel, were among the worst offenders.
CB2, a home furnishings retailer, was the most invasive sender, averaging over two emails per day with 13 trackers embedded in each. Macy’s was the most prolific in terms of volume, once sending seven emails in a single day. J.Crew’s emails set a record for tracker density, with some messages containing up to 40 trackers, 185% more than any other brand. In contrast, Nike emerged as one of the most respectful senders, with fewer than one email every two days and minimal use of trackers.
On November 29, Macy’s sent approximately 210 million emails, an effort that, based on widely accepted CO2e metrics, generated 840 metric tons of carbon emissions. This is roughly equivalent to driving a gasoline-powered car 2.1 million miles.
No major brand met the so-called “Proton Gold Standard,” which calls for both low volume (less than 0.6 emails per day) and zero tracking. Even Nike, while close, fell short due to a single-tracked email. Burlington also missed the mark slightly, with 0.64 emails per day.
Proton, which now protects over 100 million user accounts worldwide, says it built its encrypted email platform to combat exactly this kind of intrusive digital behavior. Proton Mail blocks tracking pixels by default, masks IP addresses when loading email content, and scrubs tracking codes from links, allowing users to interact with messages without leaking metadata.
Users concerned about privacy should consider using privacy-respecting email services, creating burner addresses for online shopping, and regularly unsubscribing from promotional lists.
If you liked this article, be sure to follow us on X/Twitter and also LinkedIn for more exclusive content.
