Privacy / Wrongful-Collection Exclusion Lab
The fastest-growing privacy liability isn’t a breach at all — it’s wrongful collection: tracking pixels, session replay and biometric (BIPA-style) class actions over data you gathered without the right consent. Carriers have responded by adding wrongful-collection exclusions to cyber policies, so these claims often fall outside cover. Check your exposure and the coverage trap. Educational, not legal or insurance advice.
- Inventory third-party tags/pixels on pages touching personal or health data; remove what you don’t need.
- Get specific, informed consent before collecting — the claims turn on consent, not collection.
- Minimise and avoid capturing keystrokes/biometrics unless there is a clear, lawful basis.
- Confirm whether your cyber policy excludes wrongful collection, and whether a buy-back exists.
What this lab does
- The fastest-growing privacy liability is not a breach — it is wrongful collection: tracking pixels, session replay and biometric (BIPA-style) class actions over data gathered without proper consent.
- Carriers have added wrongful-collection / BIPA exclusions to cyber policies, so these claims often fall outside cover entirely.
- Tick what your org does and see your exposure plus the coverage trap, with how to reduce both.
- Educational, not legal or insurance advice. Everything runs in your browser.
Why this matters
A company can have flawless breach security and still face a seven-figure privacy class action — because the claim is about what it collected and shared, not about being hacked. Pixel-tracking and biometric litigation have become one of the biggest privacy exposures going, and the cyber policy most teams assume would respond has quietly been amended to exclude exactly these claims.
This lab shows where your own practices create that exposure and why the coverage may not be there, so you can reduce the legal risk and check the policy gap before a demand letter arrives. Educational, not legal or insurance advice.
Frequently asked questions
Does cyber insurance cover tracking-pixel or BIPA class actions?
Increasingly, no. These are wrongful-collection claims — allegations that you gathered data (web activity via pixels, keystrokes via session replay, biometrics like faceprints or voiceprints) without the consent the law requires. They are privacy-litigation losses, not security-breach losses, so the first-party breach-response parts of a cyber policy generally do not apply. More importantly, after a wave of pixel and Illinois-BIPA litigation, many insurers added explicit wrongful-collection / BIPA exclusions that bar these claims from the liability coverage too. The result is a real and widening gap: a seven-figure class action your cyber policy may not touch. Read your exclusions and ask your broker whether a buy-back or separate cover exists.
What is BIPA and why does it drive big claims?
Illinois' Biometric Information Privacy Act (BIPA) regulates collecting biometric identifiers — fingerprints, faceprints, voiceprints — and requires informed written consent and a retention schedule. What makes it potent is statutory damages per violation (and courts have allowed per-scan counting), which can aggregate into enormous exposure across many users, without anyone proving actual harm. Similar biometric and wiretap-style laws exist or are emerging in other states. Because the damages are statutory and the claims are consent-based, they do not look like a traditional data breach, and traditional breach cover does not fit them.
How do I reduce wrongful-collection exposure?
The claims turn on consent, not on the mere fact of collection, so the fixes are about consent and minimisation: inventory every third-party tag and pixel on pages that handle personal or health data and remove what you do not need; obtain specific, informed consent before collecting tracking, replay or biometric data; avoid capturing keystrokes or biometrics unless there is a clear lawful basis and a retention/deletion schedule; and align disclosures with what you actually do. These reduce the underlying legal risk regardless of what any policy says — which matters, because the policy may not respond.
Is this legal or insurance advice?
No. It is an educational tool to help you see where common web and data practices create wrongful-collection exposure and why your cyber policy may not cover the resulting claims. The law here is fast-moving and varies by state and country, and policy exclusions vary by carrier. Confirm your specific exposure with privacy counsel and your coverage position with your broker.
This tool is free and always will be. Would a Pro workspace — saved designs, team sharing and exports — be worth paying for?
Show me Pro →No account needed to use this tool — this just tells us whether Pro is worth building out.