Guide
Each of the big three mailbox providers creates non-human opens and clicks in its own way. Microsoft scans links and makes Outlook and Hotmail the most bot-contaminated major provider for clicks. Gmail changed in February 2026 and its non-human click share has stayed higher since. Apple Mail Privacy Protection pre-loads tracking pixels and inflates opens only. The industry term is Non-Human Interactions (NHI). The figures below are Omnivery's 2026 research.
By Omnivery. Published October 2026. Last reviewed October 2026
Microsoft's Outlook and Hotmail mailboxes are the most bot-contaminated of the major mailbox providers for clicks. In Omnivery's 2026 research, around 30% of clicks there were non-human, which reflects Defender and SmartScreen link scanning. Yahoo and GMX sat at about 2% to 4% over the same period.
What to check: segment click reports by mailbox provider. A blended click rate hides the fact that the same metric is far less reliable at Microsoft than elsewhere.
Gmail's non-human click share jumped in a single week. Omnivery's data shows it moving from a steady 5-6% baseline to about 21% in the week of February 21, 2026, across senders and campaigns at once. Every week since has sat between about 20% and 26%, with no drift back toward the old baseline, as of the September 2026 update. The shape of the change points to something Gmail did, not a botnet.
The change was in clicks only. Gmail's non-human open share stayed around 52% the whole time, so this is not an Apple Mail Privacy Protection effect. It is consistent with automated link fetching on the provider's side.
What to check: if Gmail click-through rates stepped up in late February 2026 with no matching rise in site traffic, treat roughly 20% to 25% of Gmail clicks as a standing baseline of automated activity. Click-based segments, send-time optimization and click-triggered automations are the places it shows up. The full analysis is in the Gmail click spike update and the State of Email Bots 2026 report.
Since iOS 15, Apple Mail pre-loads tracking pixels in every message it delivers, whether or not the recipient opens it. Those are proxy opens: the open is recorded in your reports but no person made it. Around 50% of the B2C opens Omnivery measures are non-human, and that share has been stable since Apple Mail Privacy Protection launched. In B2C sending, Apple accounts for more than 95% of the non-human opens Omnivery identifies.
It affects opens only. Apple iCloud clicks are a separate matter: the 2026 research puts iCloud's non-human click share at around 12%, up through the year.
What to check: stop reading a raw open rate as readership. Use an Apple-adjusted open rate if your platform offers one, and rely on clicks and onsite behavior for engagement decisions.
No. Smaller consumer providers tend to be steady rather than volatile. In Omnivery's data, Italy's Libero has stayed under 1% non-human clicks every year since 2022, and Germany's web.de holds at about 3% to 4%. Yahoo and GMX stay at about 2% to 4%. The consistently high-bot inboxes are business and security-filtered mail, where gateways click every link, not consumer webmail.
The published data points the other way. B2C bot clicks rose from about 2% in 2023 to about 16% in 2026. Gmail's step in February 2026 had held for six months at the time of the September 2026 update. Apple's share of non-human opens has been stable since iOS 15 in 2021. Nothing in these series shows a return toward earlier levels. Treat them as standing baselines and review them again when new data is published.
You cannot stop Microsoft from scanning links, Gmail from changing how it handles them, or Apple from pre-loading pixels, and you should not try. Each one happens in the recipient's mailbox before your reporting sees anything. The workable answer is a per-event verdict: classify each open and click as human or non-human, then keep the non-human ones out of your metrics, your list decisions and your automations.
That is what the Omnivery Bot Detection API does, with unparalleled accuracy. Its verdicts draw on 20+ proprietary datasets developed over 8+ years, and it works the same way whichever provider the recipient uses. For opens and clicks tracked by Omnivery, it is included automatically at no additional charge. For tracking data collected somewhere else, the API returns the same verdict per event, provided the source IP and user agent string are available for each interaction.
Many email platforms mark some of these events in their own data, with different coverage. See how Mailgun, SendGrid, SparkPost (Bird) and Amazon SES report bot opens and clicks.
At a glance
Questions
Microsoft scans links in inbound mail. In Omnivery's 2026 research around 30% of clicks at Outlook and Hotmail were non-human, reflecting Defender and SmartScreen link scanning.
Gmail's non-human click share moved from about 5-6% to about 21% in the week of February 21, 2026, across senders at once, and has stayed between about 20% and 26% since. The pattern points to a change at Gmail, not a change in your audience.
No. Apple Mail Privacy Protection pre-loads tracking pixels, so it affects opens only. Non-human clicks come from security scanners, provider link scanning, tracking tools and botnets.
In Omnivery's data, Libero has stayed under 1% every year since 2022, web.de holds at about 3% to 4%, and Yahoo and GMX sit at about 2% to 4%.
The published data shows no return toward earlier levels. Gmail's higher share had held for six months at the time of the September 2026 update, and Apple's share of non-human opens has been stable since iOS 15.
The State of Email Bots 2026 has the year-by-year series and the complete breakdown by mailbox provider. The Omnivery Bot Detection API returns a per-event verdict when a decision depends on it.