TikTok Embed

When the embed loads, www.tiktok.com sets ByteDance tracking cookies including tt_webid and tt_webid_v2 (device identifiers, 12 months), tt_csrf_token (CSRF protection), msToken (anti scraping and session, around 30 minutes), ttwid (TikTok web identifier, 12 months), and _ttp when the operator also runs a TikTok Pixel. Logged in visitors trigger additional passport cookies tying the embed view to a TikTok account.

Yes. The embed loads scripts and writes tracking cookies and is not strictly necessary to the service. Article 5(3) of the ePrivacy Directive requires prior opt in consent, and the EDPB clarifies that consent must be specific, informed and granular. The standard implementation is a two click placeholder served from your own domain that only loads the iframe after the visitor accepts.

The only realistic legal basis is consent under Article 6(1)(a) GDPR. Legitimate interest is not available because the embed enables large scale profiling by ByteDance and exposes the visitor to potential transfers to China. TikTok itself relies on additional bases for its own processing, but the website embedding the iframe is responsible for collecting consent before any data leaves the visitor browser.

Yes. Even with Project Clover migrating EEA user data to Oracle data centres in Europe, ByteDance personnel in China retain controlled access. The Irish DPC fined TikTok 345 million euros in 2023 and 530 million euros in 2025 specifically over transfers and child data. The embed must be treated as a high risk transfer to non adequate third countries and disclosed accordingly in the privacy policy.

Yes in most cases. The combination of large scale processing by ByteDance, possible inference of special category data through the consumed videos, and historic China transfers exceeds the threshold of Article 35 GDPR. The DPIA must document the necessity of the embed, the lawful basis, the consent mechanism, the residual risk under Project Clover, and the safer alternatives evaluated. Operators in regulated sectors should generally avoid the embed.

Block the embed by default and replace it with a click to load placeholder served from your own domain that explains the data flow to TikTok. Expose TikTok in the consent banner as a social media or advertising vendor and only inject the iframe after granular consent. Document the processing in your privacy policy with the cookie list, the link to TikTok privacy terms and the China transfer disclosure. Avoid the embed entirely on pages with minor audiences.

Common alternatives include downloading the MP4 of the video with the creator authorisation and hosting it on your own CDN, displaying a static thumbnail that links to the TikTok URL, or using a server side proxy that fetches the video without exposing the visitor browser to TikTok endpoints. For curation use cases, an EU based video host (PeerTube, Vimeo with EU residency, Bunny Stream) can replace TikTok integration entirely.

Add TikTok and ByteDance Ltd as data recipients, list the cookies set by www.tiktok.com (tt_webid, tt_webid_v2, tt_csrf_token, msToken, ttwid, _ttp, passport variants) with their duration and purpose, disclose the transfer outside the EEA and to China, mention Project Clover and reference the Irish DPC decisions. Refresh the entry whenever TikTok updates its disclosures.