The fact patterns behind privacy claims.
Browse by the shape of the exposure, or by the law a plaintiff or regulator would use. Every finding carries a legal theory, a default severity and a default placement your team can tune.
Eight families of exposure.
Tracking & Advertising
The baseline of behavioral ad tech: pixels, beacons, cookies, real-time bidding and identity-match transmissions.
Consent Failure
Trackers that fire before consent, after Reject All or after a documented opt-out.
Fingerprinting
Cookieless device signatures built from canvas, WebGL, audio and other browser traits.
Session & Input Monitoring
Session replay, keystroke capture, form-field interception and clipboard access.
Sensitive Context
Ordinary tracking that runs inside logged-in account pages.
Consent & Preference Signals
Global Privacy Control and other legally recognized opt-out signals that aren’t honored.
Data Brokerage & Sharing
Visitor data flowing to vendors on official data-broker registries.
Location & Geolocation
Geolocation collected before consent or inside authenticated areas.
The laws behind the claims.
CIPA & Wiretap (ECPA)
California Invasion of Privacy Act and the federal wiretap act. The leading theory in web-privacy litigation.
Exposure families: Tracking, Consent Failure, Session, Fingerprinting, Sensitive Context
State privacyCCPA / CPRA
California’s consumer privacy law: sale and sharing of personal data, opt-outs and GPC.
Exposure families: Consent & Preference Signals, Data Brokerage, Tracking
VideoVPPA
The Video Privacy Protection Act: video-viewing data shared with ad platforms.
Exposure families: Tracking & Advertising on video pages
BiometricBIPA & Biometrics
Illinois’ Biometric Information Privacy Act and similar laws covering voiceprints and other identifiers.
Exposure families: Biometric & voiceprint technology
ChildrenCOPPA
The Children’s Online Privacy Protection Act: data collected from children under 13.
Exposure families: Children’s services and widgets
Consumer protectionState UDAP & FTC Act
State unfair and deceptive practices laws and Section 5 of the FTC Act.
Exposure families: Consent Failure, Data Brokerage, privacy policy gaps
HealthHIPAA & Health Privacy
The federal health privacy law for covered entities and business associates. The Health Privacy indicator shows whether it likely applies.
Read alongside: Sensitive Context, Tracking & Advertising, Session & Input Monitoring
How the exposure maps.
| EXPOSURE FAMILY | CIPA / ECPA | CCPA / CPRA | VPPA | BIPA | COPPA | UDAP / FTC | HIPAA |
|---|---|---|---|---|---|---|---|
| Tracking & Advertising | ● | ● | ● | ○ | ○ | ||
| Consent Failure | ● | ○ | ● | ||||
| Fingerprinting | ● | ○ | |||||
| Session & Input Monitoring | ● | ○ | |||||
| Sensitive Context | ● | ○ | |||||
| Consent & Preference Signals | ● | ● | |||||
| Data Brokerage & Sharing | ● | ● | |||||
| Location & Geolocation | ● | ○ | |||||
| Biometric & voiceprint technology | ● | ||||||
| Children’s services | ● | ○ | |||||
| Healthcare organizations | ● |
● primary theory · ○ secondary theory
We credit what works.
Consent management platform
Tested for whether it actually gates trackers, not just whether a banner appears.
Do Not Sell / Share and data requests
The opt-out link and the route for access and deletion requests, each tested.
Privacy-signal handling
Global Privacy Control detected and honored.
See which families show up in your submissions.
Send five past submissions you’ve already bound, conditioned or declined. We score them blind, then put our disposition next to the call you made.
Severity and placement shown are CyRisk defaults and can be tuned per account. A detected exposure indicates a fact pattern common to privacy litigation, not a confirmed violation. Litigation theories explain why a finding is tracked; they are not legal advice.