Social Security Pinged Your Inbox Four Days Before the Election

“Under President Donald J. Trump, the Social Security Administration (SSA) is transforming into a model of excellence, one that meets and exceeds customer expectations for fast, accurate, and secure service.”

That is the first line of an email the Social Security Administration sent me, and likely millions of other Americans, four days before the midterm election. It was a victory lap: shorter wait times, more online accounts, nothing for me to do, no deadline, no change to my benefits. It also reports back when I open it, roughly where I am when I do, and every link I click. So why does a press release need to know if, when and where I opened it?

I only noticed because my email runs through EMail Parrot, the privacy service I built, and it stripped all of that out. Here is what was inside, and what nothing published says about where that data goes.

In short:

• 1 hidden tracking pixel and 13 of 13 links tracked, all unique to my copy
• Every read of the email can reveal when, from what IP address (approximate location), and on what device
• I could find no SSA privacy review saying who sees this data or how long it is kept
• Federal websites need your opt-in for this kind of tracking. Email doesn’t.
• France and Italy now require consent for exactly this kind of tracking

Every open is a ping

The email was sent through Granicus (GovDelivery), a private contractor many federal agencies use for mass email. It carried one hidden tracking pixel, and all 13 of its links were rewritten to pass through a tracking server first, every one unique to my copy. It did not contain my Social Security number, name or benefit details, only my email address.

Think of a tracking pixel like a submarine’s sonar ping. It is a single, timestamped reading: at this moment, this person was here, doing this. When my mail app loads that invisible image, the tracking server can log:

• That I opened it, tied to my individual copy
• When, to the second
• My IP address, which maps to an approximate location, usually city or internet provider level
• My mail app and operating system, which hints at phone versus computer
• Which links I click, and when, for every one of the 13

SSA already has my home address. What it does not have, from that, is where I am on a given day. An open from my home network and an open from a hotel across the country, or foreign country, look different.

There are honest limits to this location data. Gmail app and web client load images through Google’s own servers, which hides the reader’s true IP. Apple Mail’s privacy feature pre-loads images, which muddies open data. Phone networks often map to a city far from the actual user. So any single reading can be wrong. But noisy readings can be filtered, and the ones that remain still carry a date, a time and a place.

Where the data goes, and what we don’t know

The tracking server is not at a Granicus address. It is at govlinks.ssa.gov, which reads as if it were SSA’s own website. A domain that looks first-party does not mean the data stays first-party.

Granicus collects the opens and clicks. Granicus says its agency customers can “monitor email open and click rates of subscribers,” and that the tracking can be turned off, but only by the agency, not by the person being tracked.

What each agency actually sees, and how long the data is kept, is supposed to be written down in a Privacy Impact Assessment. Many agencies publish one for this exact system: the FTC, SEC, IRS, CMS and others. The FTC’s version, for example, says its staff see only aggregate open and click numbers, and that subscriber addresses are deleted after a year.

I could not find one published by the Social Security Administration. That leaves basic questions without public answers:

• Does SSA see opens and clicks per person, or only totals? Can they get this from Granicus if they wanted to?
• Is the IP address and implied geolocation of each open kept, and for how long?
• Can this data be shared with, or requested by, other parts of the government?
• Is it linked to anything else SSA holds about me?

None of this means the answers are bad. It means nothing published says they are good.

Why this lands differently in 2026

The tracking itself is not new. The EFF documented this same Granicus pixel-and-link setup in 2019, naming SSA among the agencies using it. What has changed is the environment around it. A few facts from the past year:

• August 2025: SSA’s chief data officer filed a whistleblower complaint alleging that DOGE staff copied SSA’s master record of Social Security numbers, about 300 million entries, into a cloud environment he described as vulnerable. SSA disputed the claims. (NBC News)
• 2025 to 2026: DHS overhauled its SAVE verification system to connect to SSA records for the first time, and invited states to run entire voter rolls through it. A federal judge blocked it in June 2026, finding violations of the Privacy Act and the Social Security Act. On September 25, the Supreme Court let it resume for individual checks during the pre-election period. In Texas, about 20 percent of voters it flagged were later confirmed as citizens. (OPB)
• July 2026: After SSA sent beneficiaries a different promotional email, a group of senators wrote to the commissioner calling it unsolicited and asking where SSA got recipients’ email addresses, possibly from my Social Security account sign-ups.
• October 30, 2026: This email arrives, with per-person tracking, four days before a national election.

Each of these is a separate fact. I am not claiming they are connected. But the walls between government data systems are lower than they were in any previous election, and SSA’s own records are now part of what crosses them. Will this data sit unused on the contractor’s systems or will it be shared and analyzed?

Europe would have asked first

France and Italy now treat email tracking pixels much like cookies. France’s CNIL rules took effect July 14, 2026. Italy’s Garante deadline passed October 29, 2026, the day before this email arrived. Under both, measuring whether an individual opened an email requires that person’s specific consent, separate from signing up for the mailing list. Germany’s data protection authorities have said guidance is coming, though none has been published yet. (We covered the French and Italian rules and Italy’s deadline earlier this year.)

That raises a question I can’t answer. SSA pays benefits to Americans living in France and Italy, and an email address does not say what country its owner is in. Some of them almost certainly got this email. Did they consent to being tracked? The irony is that the only way the sender would learn a reader is in Europe is through the very pixel that would need that consent. As a practical matter, a foreign government is generally shielded from European enforcement. But if a French or Italian company sent this email, it would need consent. The US government didn’t ask.

What I’m pushing for, and what I’m watching

We expect our government agencies to act fairly and to be above suspicion. A self-promotional email with per-person tracking, sent days before an election with no clear need for per-recipient tracking, works against that. Two fixes would cost SSA almost nothing:

1. Publish the Privacy Impact Assessment for SSA’s use of GovDelivery, as other agencies do, so the public knows what is collected, who sees it and how long it is kept.
2. Turn off per-recipient tracking on bulletins. Measuring a press-release email needs totals, not a record of who opened it, when and from where.

I am also writing this down now, with a date on it, so we can look back. The window that matters runs from election day, November 3, to January 3, 2027, when the new Congress is sworn in. Nothing published says the data from this email will be gone before then. If any of it shows up somewhere it shouldn’t, this post is the record that this risk was clear to see.

Protecting yourself today

• Turn off automatic image loading in your mail app. That blocks most tracking pixels.
• Don’t click links in tracked emails. Type the address yourself: ssa.gov works fine without a tracking stop on the way.
• Check your subscriptions at public.govdelivery.com, and unsubscribe from bulletins you didn’t ask for.

Or let something else do it. I only saw what was in this email because EMail Parrot removed it: the pixel, the link wrappers, the remote images. Your mail arrives clean, and the sender’s ping comes back empty. If your government’s email can track you, anyone’s can.

Technical details

For readers who want the specifics, here is what the raw message contained:

The subscriber IDs and encrypted token sit in the email headers. The tracking pixel and link wrappers sit in the HTML body. The plain-text version of the same email had campaign tags but no link tracking.

Bill is the founder of EMail Parrot, a privacy-first email service. The raw email analyzed here is available on request with personal identifiers redacted.