Last reviewed:
Translated from German; if the versions differ, the German version applies.
Not legal advice: Legal content on this page appears only as verbatim quotations from statutes, court rulings or authority papers, with their source; quotations from German texts are our working translations. We do not assess them ourselves, and no lawyer has reviewed this page. It is no substitute for legal advice in your individual case.
Open rate and click rate
Open rate and click rate are the figures that appear on screen first after every send. Both look precise, but they are based on indirect measurements. Anyone who knows how they come about interprets them correctly – and makes better decisions about subject line, content and sending time.
How an open is measured
The sending platform builds a tiny, invisible image into every HTML email, loaded from its own server – the tracking pixel. When a mail program loads this image, the platform counts an open. This has three limits:
- No loaded images, no open. Anyone who blocks images or reads only the text version does not appear as an opener, even though they read the email.
- Loaded images do not mean read. With “Protect Mail Activity”, Apple Mail loads remote content privately in the background as soon as an email arrives and hides the IP address. According to Apple, senders then cannot tell whether a message was opened. To the sending platform, the request looks like an open.
- Unique and repeated opens. Platforms count “unique” opens (each email at most once) and “total” opens (every time the image is loaded). Check which figure your platform shows.
Our conclusion (not a measurement): today the open rate is at most suitable for rough comparisons within the same list over time – and even then only as long as the share of Apple Mail users does not change significantly.
How a click is measured
To measure clicks, the sending platform replaces every link with a redirect address on its own server. Anyone who clicks briefly lands there, is counted and is then forwarded to the actual destination. Clicks are therefore more reliable than opens – but not free of errors:
- Security filters open links. For its “Safe Links” service in Microsoft Defender for Office 365, Microsoft describes that addresses in incoming emails are checked before delivery and that addresses without a valid reputation can be opened asynchronously in the background (Microsoft’s term: “detonated”). RFC 8058 also notes that anti-spam software often fetches addresses in email header fields automatically, without anyone clicking.
- Consequence for the statistics (our conclusion): some of the measured clicks – especially for recipients at companies – may come from such checks. Clicks on all links in an email within a few seconds of delivery are a tell-tale sign. Some sending platforms filter out such patterns; ask whether and how.
Calculating the rates
| Metric | Formula | Example |
|---|---|---|
| Open rate | emails with at least one measured open ÷ delivered emails | 392 ÷ 980 = 40.0% |
| Click rate | emails with at least one click ÷ delivered emails | 49 ÷ 980 = 5.0% |
| Click-to-open rate | emails with a click ÷ emails with a measured open | 49 ÷ 392 = 12.5% |
The click-to-open rate inherits all the measurement problems of the open rate: if measured opens rise because of automatic requests, it falls without anything having changed in the content. You can calculate the values with the metrics calculator.
What the figures say – and what they do not
- Compare with yourself. Published averages mostly come from sending providers and depend on the industry, the list and the measurement method. The trend across your own mailings is more meaningful.
- Evaluate clicks by link. Which links are clicked says more about the content than the overall rate: what interests readers, what is skipped?
- Look at the goal. Most reliable is what happens after the click – sign-ups, enquiries, purchases, donations. These figures come from your website or shop, not from the sending platform.
- Small lists fluctuate strongly. With 200 recipients, two clicks more or less make a whole percentage point. When a difference is more than chance is shown on A/B testing.
Data protection: measurement per person
Opens and clicks can usually be attributed to individual recipients. Whether and on what basis such an analysis per person is possible under data protection law is not expressly answered by the texts quoted here: neither the EU General Data Protection Regulation (GDPR) nor Section 25 of the Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG, the German act on data protection in telecommunications and digital services) nor the guidance of the German Data Protection Conference (Datenschutzkonferenz, DSK) on direct marketing mentions tracking pixels or click measurement. The relevant passages in their wording:
The GDPR defines: “‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements” (Art. 4(4) GDPR).
On information when data are collected, it says: “Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information: […] the purposes of the processing for which the personal data are intended as well as the legal basis for the processing” (Art. 13(1)(c) GDPR).
Quotations from German laws, court rulings and authority papers are our working translations; only the German wording is authoritative (see the German version of this page). Under the heading “Sending advertising after an order and selection (profiling)”, the DSK writes in its guidance on direct marketing:
“More intrusive measures such as automated selection procedures to create detailed profiles, behavioural predictions or analyses that lead to additional insights, on the other hand, indicate that the data subject’s interest in the exclusion of the data processing prevails. In these cases it is profiling that can no longer be based on Art. 6(1) subpara. 1(f) GDPR and therefore requires obtaining explicit consent (cf. Art. 22(2)(c) GDPR) before the data processing.” (our translation) — DSK guidance on direct marketing (February 2022), section 1.3.2 b), p. 5
Section 25(1) TDDDG reads: “The storage of information in the end user’s terminal equipment or access to information already stored in the terminal equipment is only permitted if the end user has consented on the basis of clear and comprehensive information. The information of the end user and the consent must be provided in accordance with Regulation (EU) 2016/679.” (our translation) Subsection 2 begins: “Consent under subsection 1 is not required” (our translation) and names two cases (Section 25(2) TDDDG).
Whether loading a tracking pixel or calling a redirect address falls under these provisions is not expressly answered by the statute or the guidance. Some sending platforms can also evaluate opens and clicks in aggregated form only, without attributing them to individual recipients.