Should You Tell People You're Tracking a Document?

If you want to see exactly what a reader's record looks like before you decide how to describe it, create a free tracked link and open your own document through it — 50 files, 50 links, 12 months of history, no card — or look at the live demo on sample data first. The rest of this page is what to say about it.

What does your reader actually see when they open a tracked link?

A cookie notice, and nothing about reading. When someone opens a PDFTrackr share link the document loads in a page we serve, and a bar at its foot carries one sentence:

“We use cookies to measure site usage.”— the consent bar on every PDFTrackr share link, read 2026-08-28

Beside it are links to our privacy and cookie policies, and Accept and Decline buttons. That is the whole of the notice.

The viewer does say three other things to a recipient, and it is worth knowing what they are before you write your own sentence. A link that asks for an address carries one line under the box: “Your email is shared with the document's sender.” A link sent from a free account shows a dismissible card once during the read, carrying “See who finishes yours. Free →”, which advertises the product to your reader rather than describing what you will see. And every gate card is footed “Protected by VeoDocs”. None of the three says that the sender is shown which pages were read.

Read that sentence the way a recipient would. It tells them a website is measuring usage, which is what almost every website they opened today told them. It does not tell them that a specific person will be shown which pages they reached and how long they spent on each one. Those are different disclosures, and only the first is being made. The second is described in the privacy policy, where a reader who goes looking finds that we identify a visit without cookies — the IP address and browser user-agent combined into a one-way, daily-rotating hash — and that the IP itself is used only to look up an approximate country and is then discarded.

So the honest position is this: the product hides nothing, and it does not do your telling for you either. A recipient who reads a privacy policy can find out; one who does not will not be told. If you want the person on the other end to know before they open it — and the rest of this page argues you do — the sentence has to come from you.

Where does the professional line sit? Between hidden software and a link you sent

Between something the recipient could not have known about and something they chose to open. The clearest statement of it comes from a bar association rather than a vendor. In January 2018 the Illinois State Bar Association issued Professional Conduct Advisory Opinion 18-01, on tracking software in emails and other electronic communications. Its holding, in our own words rather than dressed up as a quotation from theirs: a lawyer may not use such software in communications with clients or other lawyers without first obtaining each recipient's informed consent. Bloomberg Law reported it under the headline that lawyers cannot secretly track emails.

The carve-out is the part worth carrying into ordinary business correspondence: it does not extend to the visible kind — an Outlook read receipt or delivery notification, which the recipient is shown and can decline, sits outside the prohibition. The distinction is not the measurement. It is whether the person on the other end had any way of knowing.

That is the line an email tracking pixel fails and a tracked link can pass. A pixel is a transparent image in the message body that loads as the mail client renders it, with no action by the recipient and no notice to them — what a PDF tracking pixel is and why it mostly does not work goes through the mechanism. A tracked link is the opposite shape: the recipient sees a link, decides whether to click, and lands on something visibly a hosted viewer rather than a file on their disk. It can pass the line; it does not pass automatically, because clicking a link is not the same as being told what the sender will see. One sentence from you closes that gap.

What are you actually disclosing? Six things, and none of them is the reader

A document, a moment, a depth, a duration, a country and a device — plus, if you asked for one, an address the reader typed in. A reading record says this document was opened at this time, from roughly this country and on this kind of machine, these pages rendered, each held attention for about this long, and the reader stopped here. The country and the device are the two that come nearest a person, and both are coarse: a country rather than a place, and mobile, tablet or desktop rather than a machine you could pick out. It does not identify a person on its own. The definitional groundwork is at what PDF tracking is; what matters for a disclosure is that the honest description is short. Every item is on the free plan — page-level reading data is the product here, not the upsell — so nothing above depends on what you pay.

One item deserves a sentence of its own, because it changes what the number means. Automated opens — corporate mail-security scanners that follow every link in an inbound message, and link previewers that fetch a URL to build a thumbnail — are classified and excluded from the counts. That matters to a disclosure in a way that is easy to miss: without it, the first “view” you tell your reader about is frequently not theirs at all. In our own production data 14.2% of recorded views — roughly one in seven — registered no page at all, and whether PDF view counts are real is where that dataset and its method live. Telling someone you can see they read it, on the strength of a scanner's open, is a worse outcome than not telling them anything.

There is a regulatory floor under this and it points the same way. Where personal data are collected from the person themselves, Article 13 of the General Data Protection Regulation requires that they be told, at the time of collection, who is processing it and for what purposes. Whether a given reading record is personal data in a given jurisdiction is a question for a lawyer, not for this page. The practical reading holds either way: there is no version of this where the recipient finding out later goes better for you than the recipient being told first.

Four ways to send a document, and what each lets the reader know

Read the second column. It is the one the ethics opinions turn on, and it separates the methods far more sharply than what the sender learns.

The middle two rows are the interesting pair: they measure almost the same thing and sit on opposite sides of the line. A pixel and a read receipt both report that a message was opened. One asks and one does not, and that difference is what the Illinois opinion turns on. A tracked link starts on the read receipt's side — opening it is a deliberate act — and then leaves a gap only the sender can close.

How do you say it in one line?

Name the mechanism, name what you will see, and stop. The failure mode is not bluntness but vagueness: a reader told “we use analytics” fills the gap with something worse than the truth. Three versions, by situation:

Sending a proposal or a deck. I've sent this as a link rather than an attachment so I can tell whether it arrived and which sections you spent time on — that way I follow up on the right thing rather than chasing you. This version costs nothing: the reason is one the recipient recognises.

Sending a contract or anything with a signature at the end. The link records that it was opened and how far through you got. Say the word and I'll send the file itself instead. Offering the plain file turns a notification into a choice, and it is rarely taken up.

Sending to a team — a handbook, a policy, a training document. This link shows me who has opened it and how far they read, so I can stop chasing the people who already have. Internal reading is where saying nothing is most likely to be discovered and resented, and where the stated reason is most obviously true.

One thing not to write, in any of the three: a promise about what you cannot see. Every version of that sentence we have tried is either vague enough to be worthless or specific enough to be a claim the recipient cannot check. Describe what the record holds, and let the smallness of it do the reassuring.

If you have never seen one of these records from the sender's side, fix that before writing the sentence. Open the demo dashboard on sample data, or send yourself a tracked link and read your own session back. Describing what you have seen is the difference between a sentence that reassures and one that hedges.

Keep reading: what PDF tracking is, what a PDF tracking pixel is, whether PDF view counts are real, and how free PDF tracking works.