> TikTok Pixel and GDPR: consent requirements, data transfer risks linked to ByteDance, EU regulatory action and how to configure TikTok ad tracking lawfully. > > Canonical: https://www.flowconsent.com/en/services/advertising/tiktok-pixel Advertising # TikTok Pixel Marketing · [Official website](https://ads.tiktok.com) The TikTok Pixel is an advertising measurement and audience building tool from TikTok (ByteDance) that tracks website conversions and enables retargeting audiences for TikTok ads. It faces heightened GDPR scrutiny due to ByteDance's Chinese ownership and concerns about potential data access under Chinese national security laws. Multiple EU member state authorities have investigated or restricted TikTok's data practices. Consent is required before the pixel loads, SCCs are required for US/Singapore transfers, and a DPIA is strongly recommended. [Block TikTok Pixel until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=advertising) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Advertising](https://www.flowconsent.com/en/services/advertising) - Consent Marketing - Prior consent Required - Documented cookies 2 - Third-party domains 3 - Servers United States and Singapore (TikTok/ByteDance infrastructure) Overview ## What does TikTok Pixel do? ## **What is the TikTok Pixel?** The TikTok Pixel is a JavaScript snippet installed on websites to measure conversions from TikTok advertising, build custom audiences for retargeting, and optimise ad delivery algorithms. It tracks page views, add-to-cart events, purchases, lead form submissions, and other custom events. The TikTok Events API provides a server-side alternative sending conversion data directly from the server to TikTok without browser cookies. ## **The ByteDance risk factor** TikTok is owned by ByteDance, a Chinese company. Chinese national security laws (National Intelligence Law 2017, Data Security Law 2021, Personal Information Protection Law 2021) may require ByteDance to provide data to Chinese government authorities on request. This creates a transfer risk beyond standard SCCs: even with SCCs, data may be subject to Chinese government access without GDPR-compliant safeguards. Multiple EU regulators have investigated TikTok's data practices and several EU institutions have banned TikTok from employee devices. ## **EU regulatory actions against TikTok** TikTok has faced significant EU regulatory action: a 345 million EUR fine from the Irish DPC (September 2023) for mishandling children's data, investigations by multiple DPAs into data transfers to China, and device bans by the European Commission, European Parliament, and several member state governments. These actions create heightened GDPR risk for organisations deploying TikTok advertising tools. ## **Practical compliance steps** Conduct a DPIA before deploying the TikTok Pixel on EU-facing websites. Block the Pixel via CMP until advertising consent. Accept TikTok's Data Processing Agreement. Sign SCCs. Disclose the US/Singapore transfer and ByteDance ownership in your privacy policy. Consider using TikTok Events API (server-side) instead of the browser Pixel to reduce cookie-based tracking. Assess whether the ByteDance risk warrants a Transfer Impact Assessment. Compliance ## TikTok Pixel and the GDPR TikTok Pixel is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent (Art. 6(1)(a) GDPR) required for TikTok Pixel cookies and cross-site tracking. The pixel must not fire until advertising consent is obtained. The ByteDance ownership raises additional transfer concerns beyond standard SCCs due to Chinese national security legislation. - Risk level high - Applicable regulations GDPR, ePrivacy Directive, SCCs required. TikTok has received regulatory bans and fines in multiple EU member states. DPIA strongly recommended. ### Impact assessment (DPIA) A DPIA is strongly recommended for TikTok Pixel deployments due to: cross-site advertising tracking, US and Singapore data transfers, ByteDance ownership creating potential Chinese government access risk, and TikTok's history of EU regulatory action. ### Sample text for your banner > We use the TikTok Pixel to measure the effectiveness of our TikTok advertising campaigns. This involves cookies and transfer of data to TikTok (ByteDance) in the US and Singapore. You can decline advertising cookies below. Cookies and trackers ## What TikTok Pixel sets and contacts - Tracking method JavaScript pixel, first-party cookies, cross-site conversion tracking, TikTok Events API (server-side), audience building, advanced matching - Server location United States and Singapore (TikTok/ByteDance infrastructure) - Data transferred outside the EU TikTok Pixel is operated by TikTok (ByteDance). Data is processed on infrastructure in the US and Singapore. EU personal data transfers require Standard Contractual Clauses. TikTok has faced significant regulatory scrutiny in Europe regarding its data practices and potential Chinese government access under national security laws. ### Cookies set (2) | Name | Type | Duration | Purpose | | -------------------- | ---------- | --------- | --------------------------------------------------------------------------------------------- | | \_ttp | persistent | 13 months | TikTok cross-site tracking identifier for conversion measurement and audience building | | \_tt\_enable\_cookie | persistent | 13 months | TikTok consent flag cookie recording whether visitor has accepted TikTok advertising tracking | ### Third-party domains contacted (3) - `analytics.tiktok.com` - `business.tiktok.com` - `ads.tiktok.com` Questions ## Frequently asked questions about TikTok Pixel Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Does the TikTok Pixel require GDPR consent? Yes. The TikTok Pixel sets advertising cookies requiring consent under the ePrivacy Directive. It must not load until advertising consent is obtained. Block via CMP. ### What is the ByteDance risk for GDPR? ByteDance is a Chinese company subject to Chinese national security laws that may require data disclosure to Chinese authorities. SCCs alone may not adequately protect EU data from such access. Conduct a Transfer Impact Assessment to document the risk and any supplementary measures. ### What EU regulatory actions have targeted TikTok? TikTok received a 345 million EUR GDPR fine from the Irish DPC in September 2023 for mishandling children's data. Multiple EU institutions including the European Commission and Parliament banned TikTok from employee devices. Dutch, French, and other national DPAs have investigated TikTok's data transfers to China. ### What cookies does the TikTok Pixel set? TikTok Pixel sets \_ttp (tracking and conversion, 13 months) and \_tt\_enable\_cookie (consent flag). These require advertising consent. The pixel also uses Advanced Matching to hash personal data for better attribution. ### Is the TikTok Events API a GDPR-compliant alternative? The Events API is server-side and avoids browser cookies. This bypasses the ePrivacy cookie consent requirement. However, it still transfers personal data (hashed email, IP, browser data) to TikTok in the US and Singapore. GDPR disclosure, SCCs, and a DPA are still required. ### Do I need a DPIA for the TikTok Pixel? Yes, strongly recommended. The combination of advertising tracking, ByteDance ownership, US/Singapore transfers, and potential Chinese government access constitutes high-risk processing requiring a DPIA under GDPR Article 35. ### How do I sign a DPA with TikTok for advertising? Accept TikTok's Data Processing Agreement in TikTok Ads Manager (Account Settings, Data Processing Agreement). This covers the Pixel data and Events API. Sign SCCs separately if required by your legal team. ### Should I use TikTok advertising on EU-facing websites? TikTok advertising is legally permissible with consent, a signed DPA, and SCCs. However, the ByteDance risk factor means some organisations, particularly in regulated sectors or those processing sensitive data, may choose to avoid TikTok advertising for EU audiences pending further regulatory clarity. Related guide ## Our guides on TikTok Pixel [5 May 2026](https://www.flowconsent.com/en/blog/tiktok-pixel-cookies-gdpr-consent) ### [TikTok Pixel and GDPR: cookies, consent and compliance](https://www.flowconsent.com/en/blog/tiktok-pixel-cookies-gdpr-consent) [The TikTok Pixel sets marketing cookies on your site as soon as it loads. How to block it before consent, Events API, data transfers: the complete guide.](https://www.flowconsent.com/en/blog/tiktok-pixel-cookies-gdpr-consent) [Read the guide](https://www.flowconsent.com/en/blog/tiktok-pixel-cookies-gdpr-consent) Same category ## More services: Advertising [See the whole category](https://www.flowconsent.com/en/services/advertising) ### [Mopro](https://www.flowconsent.com/en/services/advertising/mopro) [Mopro is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Mopro enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Mopro empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/advertising/mopro) [Marketing](https://www.flowconsent.com/en/services/advertising/mopro) · ### [JANet](https://www.flowconsent.com/en/services/advertising/janet) [JANet is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. JANet integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, JANet helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/advertising/janet) [Marketing](https://www.flowconsent.com/en/services/advertising/janet) · ### [Zenrez](https://www.flowconsent.com/en/services/advertising/zenrez) [Zenrez is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Zenrez provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Zenrez helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/advertising/zenrez) [Marketing](https://www.flowconsent.com/en/services/advertising/zenrez) · ### [Amazon Advertising](https://www.flowconsent.com/en/services/advertising/amazon-advertising) [Amazon Advertising is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Amazon Advertising provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Amazon Advertising helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/advertising/amazon-advertising) [Marketing](https://www.flowconsent.com/en/services/advertising/amazon-advertising) · ### [Reunion Marketing](https://www.flowconsent.com/en/services/advertising/reunion-marketing) [Reunion Marketing is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Reunion Marketing enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Reunion Marketing empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/advertising/reunion-marketing) [Marketing](https://www.flowconsent.com/en/services/advertising/reunion-marketing) · ### [Roas Funnels](https://www.flowconsent.com/en/services/advertising/roas-funnels) [Roas Funnels is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Roas Funnels provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Roas Funnels helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/advertising/roas-funnels) [Marketing](https://www.flowconsent.com/en/services/advertising/roas-funnels) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)