This is a fairly common practice called a web bug, it is the main reason that mail clients do not automatically load external images (the second being to protect you from viewing unwanted spam images that could be unsettling; e.g., pornography).
Basically when you load an email with external images enabled and a link to an image like <img src='http://192.1.1.1/images/53512_58925.png'>
is in the source, their web server will log something like the following (example below is default access log for nginx
web server) when your browser/mail client fetches and downloads the image:
10.1.2.3 - - [10/Oct/2012:10:33:41 -0400] "GET /images/53512_58925.png HTTP/1.1" 200 1933 "http://192.1.1.1/images/53512_58925.png" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.81 Safari/537.1"
which gives them:
- your IP address of your computer where you viewed the email (
10.1.2.3
in this example),
- the timestamp of the access by the server's clock
[10/Oct/2012:10:33:41 -0400]
,
- the (first line of the) HTTP GET request to get the image (
GET /images/53512_58925.png
),
- the HTTP response code (200 meaning success),
- the size of the file being accessed (1933 bytes),
- the full URL of the file (192.1.1.1 is IP of email sender's server), and
- the User-Agent string of the client (indicating what web browser and possibly OS you are using).
To really track you accurately, they would need to have a unique URL for the image; e.g., the file 53512_58925.png could mean that user 58925 read the email with the ID 53512 or something. They could also do something with HTTP GET parameters something like <img src='http://192.1.1.1/images/logo.png?user_id=58925&email_id=53512'>
that would also be logged.
I'm not going to comment on the legality of it; laws vary and some countries that I do not live in have recently enacted strict IT privacy laws (e.g., against a similar policy cookie tracking without explicit user consent). Also this forum is not really intended to provide legal advice.
This has nothing to do with same-origin policy (used for limiting the power of remotely loaded client-scripts in languages like javascript; so going to unsafe-web-page.com shouldn't be able to read/modify browser data in other tabs) or XSS (where attackers exploit flaws inject content in web pages that are not their own).