During the holidays, you expect a surge of spam emails, especially if you’re shopping online. But it may be even worse than you suspected. 

Don’t miss any of our unbiased tech content and lab-based reviews. Add CNET as a preferred Google source.

On Wednesday, Proton, an encrypted email service, released its spam watch report, which audited marketing emails sent over 28 days, including the Black Friday weekend. The report showed that 80% of retailers are embedding hidden trackers into their marketing emails that tell them whether you open the email, the device you’re using to view it, and if you click on any of the links. If you open up one of these emails, you’re setting yourself up for more spam.

The report raises questions about consumer privacy and how retailers are using our data. 

Hunting for embedded tracking links

Proton created an inbox specifically to capture marketing emails between Nov 4 and Dec 1. Before the email is displayed, it goes through Proton Mail’s servers, which scan the message code against a database known for detecting domains and pixel signatures. Proton also used its own enhanced tracking protection feature to block retailers from collecting extra information. It examined 50 of the largest retailers that have both online and brick-and-mortar locations, analyzing the timestamp, sender, subject line, and whether such an email carried an embedded tracking link or pixel.

Proton researchers combined the data with loyalty-program membership counts, each retailer’s US market share, and the number of emails sent by similar retailers. Proton broke down these companies into four groups. The retailers they dubbed «worst of the worst» are those that email frequently and include the most tracking links. Some stores actually managed not to bombard their customers with emails containing trackers, and Proton labeled them the «most respectful» senders. 

Specific stores, and where they ranked

The worst of the worst list included CB2, Anthropologie, Victoria’s Secret, VS Pink, and Crate and Barrel.

«These brands represent the highest daily frequency across the full study window — the ones constantly vying for attention,» the study noted.

But Nike, Bass Pro Shops, H&M, New Balance and Burlington scored in the most respectful group, sending no emails with trackers during the time Proton monitored the email.

«The Spam Watch findings confirm a harsh reality: the inbox has become a high‑volume, high‑noise channel where brands battle for attention while silently gathering data on every open,» said Anant Vijay Singh, Head of Product at Proton Mail, in a statement. «This is not accidental–it is an engineered assault on your attention and your privacy.»

Do this to reduce spam emails

Maintaining your private data from third parties is a genuine concern for many people. This latest report further supports fears consumers have about how corporations are using their personal data. 

In some cases, to protect yourself, you can opt for data removal services such as Operty. 

You can reduce spam marketing emails by using email protection services similar to DuckDuckGo or — yes, the company that ran the study — Proton. 

iPhone users who pay for iCloud Plus have access to a Hide My Email feature, which can also help minimize spam.