Apple Mail Privacy Protection turned open rates into fiction years ago, and most dashboards still haven't caught up. Here's what MPP breaks and what to measure instead.
A founder in our network pulled up her onboarding sequence last month and saw a 71% open rate on the welcome email. She screenshotted it. Posted it. Felt great for about four hours. That number was mostly Apple Mail Privacy Protection.
Then she looked at the click rate on the same email: 1.4%. Activation from that sequence: flat for two quarters. Nothing had improved. Her email tool was just faithfully reporting that Apple's proxy servers had fetched her tracking pixel, over and over, for people who may never have opened the thing at all.
That gap — glorious opens, dead everything else — is the most common measurement problem we hear about from people running email in 2026. And it's five years old.
I'm not being superior about it. I built a re-engagement flow on open data in 2022, ran it for eight months, and only worked out what it was really doing when a customer wrote in asking why we kept telling her she'd gone quiet. She hadn't. She'd read every one.
Apple announced Mail Privacy Protection at WWDC in June 2021 and shipped it that September with iOS 15. On first launch of the Mail app you got a prompt: protect your mail activity, or don't. One option sounded like safety. The other sounded like volunteering to be surveilled.
People picked safety. Obviously.
Here's what turning it on actually does. When MPP is active, Apple pre-fetches the remote content in your email — images, and therefore your open-tracking pixel — through its own proxy servers, before the recipient does anything. The image gets cached. Your server sees a request from an Apple IP with a generic regional location attached, and your ESP writes down "opened."
Three things break at once:
So it's not just inflation. It's inflation plus deletion, in the same metric, and you can't separate them after the fact.
Fair question: if this shipped in 2021, why is it a 2027 story?
Because the share kept climbing, and the tooling never caught up. Litmus and Validity have both put Apple Mail at or near the top of the email client mix for years, and every new iPhone and Mac ships with MPP as the default-suggested answer.
Meanwhile the average marketing dashboard still puts open rate in the biggest font on the page. Five years on.
That part genuinely irritates me. The vendors know. They've published the caveat posts. And the number is still sitting up there at the top of the screen where a founder will screenshot it — while a startling number of lifecycle automations quietly fire on "opened in the last 90 days."
Two newer changes made it sharper.
Apple Mail started sorting mail. Since iOS 18.2, Apple's Mail app splits inbound mail into Primary, Transactions, Updates, and Promotions. Gmail did this in 2013 and senders spent a decade adapting. Apple doing it means a second major inbox is now making a placement judgment about your mail that you can't see in any report — and there's no Apple equivalent of Google Postmaster Tools to check. That's the gap I'd most like Apple to close. I have roughly zero expectation they will.
Apple Intelligence started summarizing it. Notification summaries and inbox previews now paraphrase your email into a line or two of generated text. Your carefully written subject line is no longer the only thing competing for attention on the lock screen. Preheader text matters more than it did. Sloppy first paragraphs get summarized into something that reads like nothing.
Neither of these hands you new data. Both of them raise the cost of flying blind on the old data.
The useful reframe: stop asking "did they open it" and start asking "did something happen that requires a human."
Clicks. A proxy doesn't decide to click your pricing link. Security scanners do click links automatically — you'll see them as clicks on every URL in the email including the unsubscribe, firing within seconds of delivery — so filter that pattern out and what's left is real intent. (Same class of problem our sister product ClickzProtect works on in ad traffic — the bot traffic data breakdown is worth a read if your click numbers have ever looked weirdly perfect.)
Replies. Underrated. Almost nobody games this. If you're running a founder-voice sequence and replies go up, that's real.
Product events. The account got created. The invoice got paid. The trial got extended. Tie the email send to the downstream event in your own database and you have a number Apple has no opinion about. This means measuring on your side, not your ESP's — which is more work and worth it. If you want the page-level half of that picture without dropping cookies on people, cookieless tracking covers how the attribution works when there's no persistent identifier.
Delivery events. Delivered, bounced, deferred, complained. These come from the receiving mail server, not from a pixel. They're the most trustworthy signals in the entire stack and most senders barely look at them. Our transactional API sends webhook delivery notifications and keeps message logs for exactly this reason — 1,000 emails a month are included in the base plan, which is enough to instrument a small SaaS end to end. Wiring up bounce and complaint webhooks takes an afternoon and covers most of what you were wrongly using opens for.
Spam complaint rate. For Gmail traffic, Google Postmaster Tools gives you this directly. Google's published bulk-sender line is 0.3%; in practice every deliverability person I trust treats 0.1% as the real ceiling, and I think they're right. This is the number that actually decides whether your mail lands. The 2027 deliverability numbers go deeper on where the thresholds sit.
Open rates weren't good before MPP either.
I know that's not the consensus take. The standard story is that Apple took away a reliable metric in 2021 and we've been coping ever since. But an open was never evidence of anything except that images loaded. Preview panes fired it. Accidental taps fired it. People who opened, recoiled, and deleted fired it. Gmail has proxied and cached images through its own servers since 2013 and nobody treated that as a crisis.
What Apple did was make the metric obviously broken instead of quietly broken. That's a favor.
The uncomfortable follow-on: a decent share of the "engagement-based list hygiene" advice floating around — prune anyone who hasn't opened in six months — has been pruning engaged Apple users and keeping dead Gmail addresses for years. If your suppression logic still runs on opens, you have almost certainly deleted real customers. I'd start by pulling that query and looking at what it removed last quarter. It's an unpleasant afternoon. I know, because I ran ours while writing this — and the suppression rule I spent twenty minutes cursing at turned out to be one I wrote.
(Not everyone agrees with me here. A deliverability consultant I trust argues opens still carry signal in aggregate on large lists, because the MPP share is roughly stable so the noise cancels out across segments. She might be right for a list of two million. For most of the people reading this, it isn't.)
Four things, in order of how much they'll hurt to skip.
Rewire your automations off opens. Any trigger that reads opened = true needs to become a click, a reply, or a product event. This is the whole ballgame. Everything else on this list is smaller.
Fix your unsubscribe path before you touch anything else. If people can't get out cleanly, they hit "Report Spam," and complaint rate is the metric with teeth. One-click unsubscribe is a hard requirement for bulk senders now — the List-Unsubscribe header has the implementation details.
Watch for Hide My Email churn. iCloud+ users can send you a relay address and switch it off later without telling you. The address doesn't warn you; it just starts bouncing. Hard-bounce handling catches it if you're actually processing bounces — see above, again — and quietly poisons your list if you aren't.
Stop debugging rendering problems by staring at open rates. If Apple Mail users specifically are reporting weirdness, that's a rendering or filtering issue, not an engagement one. We wrote up why mail lands in junk in Apple Mail separately, since the fix is almost always authentication, not content.
And the boring foundation under all of it: SPF, DKIM, DMARC, and MTA-STS configured correctly. None of that is affected by Apple Mail Privacy Protection. All of it decides whether the message shows up at all — which, when you can't measure opens, is the thing you'd rather not be guessing about.
Anyway. Go pull your suppression query. That's the actual homework here.
No. MPP proxies remote image loads, which is how open pixels work — it doesn't click your links for you. Clicks still come from a person deciding to act. The one caveat: corporate security gateways and link scanners do click links automatically to check them for malware, which produces its own false positives. Those show up as instant clicks on every link in an email, including the unsubscribe link, usually within seconds of delivery. Filter those and your click data is the most honest engagement number you have.
Not reliably, and anyone selling you a clean split is overselling. Some ESPs flag suspected Apple proxy opens by matching the requesting IP against Apple's published ranges and by spotting the prefetch pattern (open registered seconds after delivery, before a human plausibly read it). That gets you a rough segment, not a clean number. Apple also caches the image, so a genuine open minutes later often registers nothing at all. You lose in both directions.
Keep collecting them, stop making decisions with them. Opens are still useful as a relative trend on a single list over time and as a rough deliverability smoke alarm — if opens fall off a cliff across every segment at once, something broke in delivery, not in your copy. What they can't do anymore: drive re-engagement automations, decide list pruning, or settle a subject-line A/B test. Move those decisions to clicks, replies, and product events.
No. MPP is a feature of Apple's own Mail app, so it applies to mail read in Mail on iOS, iPadOS, and macOS. If someone reads your email in the Gmail app, the Outlook app, or a browser on the same iPhone, MPP isn't in the path — though Gmail has proxied and cached images through its own servers since 2013, which breaks geolocation and re-open counting in a different way. Either way, the device and location data in your reports is worth less than it looks.
Unlimited custom domain email hosting for $49/year flat — unlimited domains, unlimited mailboxes, 10 GB storage, full IMAP/SMTP. Built for agencies, freelancers, and anyone managing email across more than one domain.