A system comprises email message parsing circuitry, tracking code suspect analyzer circuitry, and message modification circuitry. The email message parsing circuitry is operable to, after reception of an email message via a SMTP connection and prior to the email message being made available in an inbox of a recipient of the email message, scan the email message to extract a tracking code suspect. The tracking code suspect analyzer circuitry is operable to analyze the tracking code suspect to determine, based on one or more characteristics of the tracking code suspect, whether the tracking code suspect is tracking code and, upon a determination that the tracking code suspect is tracking code, notify the message modification circuitry. The message modification circuitry is operable to replace the tracking code suspect in the email message with replacement content.