Many email readers display email messages using a Web browser. If the message contains graphics retrieved from the web when the mail is opened, the loophole allows the recipient to be assigned a unique serial number in a "cookie," which will later be silently transmitted as the recipient surfs the Web. Many companies encode the recipient's email address in the URL (web address) of the graphic, so that their servers can match the cookie to the email address.

Jason Catlett, President of Junkbusters Corp. said "Cookie leaks are the bug from spammers that keeps on bugging. It's intolerable that email can be used to silently zap a nametag onto you that might be scanned by a site you visit later. It's like secretly barcoding people with invisible ink."

At the FTC's hearings on online profiling last month privacy groups called for an immediate halt to the practice. Andrew Shen, Policy Analyst at the Electronic Privacy Information Center (EPIC) said that "The lack of government action continues to place the average user -- unaware of the tracking and surveillance technologies at work -- at the mercy of companies that often abuse their privacy."