Explainers · Updated 2026-11-06
Why did a store email me after I visited its website?
You browsed a site, never typed your email, and got a marketing email anyway. Here is the hidden script that did it, which companies run it, and how to make them delete you.
You looked at a jacket, closed the tab, and an hour later the store emailed you about the jacket. You never typed your email. You may never have shopped there. It feels like a bug, or a leak. It is neither. It is a product the store paid for.
What happened, in plain terms
The store runs a small script on its pages, usually called an identity pixel or a visitor identification pixel. When your browser loads the page, the script sends a few signals about your browser to a data company. That company keeps a very large table that links browser cookies, device fingerprints and network addresses to email addresses it collected elsewhere, mostly from other websites where you did type your email at some point. If one of your signals matches a row in that table, the data company hands your email address, and often your name and mailing address, back to the store. The store drops you into its marketing list as if you had signed up.
The companies that sell this to stores describe it openly. One founder told a trade publication that a typical store customer gets about one complaint a day from people asking how the store got their email. That is the business working as designed.
Who runs these pixels
The names you will see most often on consumer shopping sites are Retention.com, Opensend, Customers.ai, Wunderkind, SafeOpt (now Minty) and AudienceLab. On business-to-business sites the equivalent products are RB2B, Warmly, Vector and Leadpipe, which return your name, employer and LinkedIn profile instead of a shopping email. Several of these are registered data brokers in California, which matters for what you can do next.
Is this legal?
In most of the United States, yes, as long as the company honors opt-outs and the store includes an unsubscribe link. Lawsuits are testing whether the pixels themselves violate state wiretap laws, and a few have survived early motions, but nothing has shut the practice down. Apple blocked identity-resolution scripts in Safari 27 in October 2026. Chrome and Firefox have not.
What you do have, in California and in a growing list of states, is a legal right to tell the data company to delete what it holds on you and to stop selling it. The company has 45 days to respond. The store cannot be made to forget what it already received, but the pipeline that keeps feeding it can be cut.
What to do about it
- Unsubscribe from the store's email. That handles the symptom.
- Find out which data company matched you. Pixel Shield's free extension lights up on any site running one of these pixels and names the company.
- Send that company a deletion and opt-out request. Each one has an address or form; our broker guides list the exact one, what they will ask for, and a request you can copy. Pixel Shield's paid plan prepares all of them for you with your details filled in.
- Expect a verification email from some of them. The request is not processed until you confirm it.
- Check again in a few months. The data tends to come back, which is why Pixel Shield re-checks every 90 days.