Tracking & Advertising
The baseline of behavioral ad tech: pixels, beacons, cookies, real-time bidding and identity-match transmissions that share a visitor’s activity with advertising vendors.
The most-litigated privacy technology.
Advertising pixels are common on their own. Exposure rises with what they send, when they fire and where they sit. When a pixel transmits identifiers, fires before consent or runs on sensitive pages, it anchors wiretap and consumer-privacy claims.
Hashed email addresses and phone numbers let ad platforms link a visitor’s browsing to their real-world identity, often without the visitor knowing.
Pixel transmission of hashed identifiers
Example finding. Vendor names are withheld.
What CyRisk tracks.
Severity and placement are CyRisk defaults. Your team can elevate, downgrade or drop any risk to context-only, per account.
| RISK | DEFAULT SEVERITY | DEFAULT PLACEMENT |
|---|---|---|
| Pixel transmission of hashed identifiers | Critical | Critical to Bind |
| Advertising tracking and behavioral ad tech deployment | High | May Affect Coverage |
| Advertising match identifier transmission | High | May Affect Coverage |
| Real-time bidding signal transmission | High | May Affect Coverage |
| Meta Advanced Matching transmission enabled | High | May Affect Coverage |
| Tracking pixels and beacon technologies | High | May Affect Coverage |
| Third-party pixel deployment | High | May Affect Coverage |
| Pixel transmission of event-level data | High | May Affect Coverage |
| Cross-site tracking enabled by pixel | High | May Affect Coverage |
| Third-party cookie storage and cross-site tracking | High | May Affect Coverage |
| Cross-device identity matching for advertising | Medium | May Affect Coverage |
| Extended-lifespan third-party cookie | Medium | May Affect Coverage |
An advertising pixel, beacon, cookie or ad-exchange call is matched in the page’s scripts and network traffic, along with what it transmits.
Disclose every advertising tracker by vendor category and purpose, govern each one with a working consent manager, and provide a Do Not Sell/Share opt-out that covers each advertising use.
Verified by rescan. The fix shows on the next scan.
Ready-to-use language.
“Which advertising vendors receive visitor data, and is advanced matching or hashed-identifier sharing turned on?”
“Prior to bind, disable hashed-identifier transmission in advertising pixels or confirm opt-in consent, verified by CyRisk rescan.”
Wrongful-collection sublimit. Where pixels run on pages with video, consider a VPPA sublimit or endorsement.
Keep exploring.
Laws this exposure can trigger
Related exposure families
Is having a Meta or Google pixel a problem on its own?
Not usually. Mainstream pixels are common. CyRisk separates simple presence from the factors that raise exposure: what the pixel sends, when it fires and which pages it runs on.
What are hashed identifiers?
Scrambled versions of email addresses or phone numbers. Ad platforms match them back to real people, which ties browsing activity to identity.
Why does VPPA come up here?
When a pixel runs on pages with video, viewing history can reach an ad platform. That is the fact pattern behind VPPA claims.
Find the pixels in your pipeline.
Send five past submissions you’ve already bound, conditioned or declined. We score them blind, then put our disposition next to the call you made.
Severity and placement shown are CyRisk defaults and can be tuned per account. A detected exposure indicates a fact pattern common to privacy litigation, not a confirmed violation. Litigation theories explain why a finding is tracked; they are not legal advice.