--- a/media/webrtc/signaling/src/mediapipeline/MediaPipeline.cpp
+++ b/media/webrtc/signaling/src/mediapipeline/MediaPipeline.cpp
@@ -17,16 +17,17 @@
 #include "srtp.h"
 
 #if !defined(MOZILLA_EXTERNAL_LINKAGE)
 #include "VideoSegment.h"
 #include "Layers.h"
 #include "LayersLogging.h"
 #include "ImageTypes.h"
 #include "ImageContainer.h"
+#include "MediaStreamTrack.h"
 #include "VideoUtils.h"
 #ifdef WEBRTC_GONK
 #include "GrallocImages.h"
 #include "mozilla/layers/GrallocTextureClient.h"
 #endif
 #endif
 
 #include "nsError.h"
@@ -53,16 +54,17 @@
 #include "webrtc/video_engine/include/vie_errors.h"
 
 #include "logging.h"
 
 // Should come from MediaEngineWebRTC.h, but that's a pain to include here
 #define DEFAULT_SAMPLE_RATE 32000
 
 using namespace mozilla;
+using namespace mozilla::dom;
 using namespace mozilla::gfx;
 using namespace mozilla::layers;
 
 // Logging context
 MOZ_MTLOG_MODULE("mediapipeline")
 
 namespace mozilla {
 
@@ -682,28 +684,33 @@ void MediaPipelineTransmit::AttachToTrac
   listener_->SetEnabled(true);
 #endif
 }
 
 #if !defined(MOZILLA_EXTERNAL_LINKAGE)
 void MediaPipelineTransmit::UpdateSinkIdentity_m(nsIPrincipal* principal,
                                                  const PeerIdentity* sinkIdentity) {
   ASSERT_ON_THREAD(main_thread_);
-  bool enableStream = principal->Subsumes(domstream_->GetPrincipal());
-  if (!enableStream) {
+
+  MediaStreamTrack* track =
+    domstream_->GetOwnedTrackById(NS_ConvertUTF8toUTF16(trackid().c_str()));
+  MOZ_RELEASE_ASSERT(track);
+
+  bool enableTrack = principal->Subsumes(track->GetPrincipal());
+  if (!enableTrack) {
     // first try didn't work, but there's a chance that this is still available
-    // if our stream is bound to a peerIdentity, and the peer connection (our
-    // sink) is bound to the same identity, then we can enable the stream
-    PeerIdentity* streamIdentity = domstream_->GetPeerIdentity();
-    if (sinkIdentity && streamIdentity) {
-      enableStream = (*sinkIdentity == *streamIdentity);
+    // if our track is bound to a peerIdentity, and the peer connection (our
+    // sink) is bound to the same identity, then we can enable the track.
+    const PeerIdentity* trackIdentity = track->GetPeerIdentity();
+    if (sinkIdentity && trackIdentity) {
+      enableTrack = (*sinkIdentity == *trackIdentity);
     }
   }
 
-  listener_->SetEnabled(enableStream);
+  listener_->SetEnabled(enableTrack);
 }
 #endif
 
 nsresult MediaPipelineTransmit::TransportReady_s(TransportInfo &info) {
   ASSERT_ON_THREAD(sts_thread_);
   // Call base ready function.
   MediaPipeline::TransportReady_s(info);
 

--- a/media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.cpp
+++ b/media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.cpp
@@ -1200,20 +1200,23 @@ LocalSourceStreamInfo::TakePipelineFrom(
  * @returns true if any stream has a peerIdentity set on it
  */
 bool
 PeerConnectionMedia::AnyLocalStreamHasPeerIdentity() const
 {
   ASSERT_ON_THREAD(mMainThread);
 
   for (uint32_t u = 0; u < mLocalSourceStreams.Length(); u++) {
-    // check if we should be asking for a private call for this stream
     DOMMediaStream* stream = mLocalSourceStreams[u]->GetMediaStream();
-    if (stream->GetPeerIdentity()) {
-      return true;
+    nsTArray<RefPtr<MediaStreamTrack>> tracks;
+    stream->GetTracks(tracks);
+    for (const RefPtr<MediaStreamTrack>& track : tracks) {
+      if (track->GetPeerIdentity() != nullptr) {
+        return true;
+      }
     }
   }
   return false;
 }
 
 void
 PeerConnectionMedia::UpdateRemoteStreamPrincipals_m(nsIPrincipal* aPrincipal)
 {