TikTok Pixel: What Data It Collects and the Privacy Risk
At a glance
TikTok Pixel
Privacy riskWhy High?
High- Category
- Advertising / conversion tracking
- Sends data to
- TikTok
- Still in use?
- Yes
- Collects hashed PII?
- Yes, with advanced matching
- DataTrue detects it as
TikTok
Summary
The TikTok Pixel is TikTok’s advertising tag. It sends a visitor’s IP address, device and browser, timestamps, and on-site activity to TikTok, and it turns third-party cookies on by default. With advanced matching enabled, it also sends hashed email and phone. Its cross-border data path and default cookie behavior make the privacy risk high.
What is the TikTok Pixel?
Advertisers use the pixel to measure what visitors do on your site after seeing or clicking a TikTok ad, and to build audiences for targeting.
What does the TikTok Pixel collect?
Per TikTok, the pixel gathers the IP address (“used to determine the geographic location of an event”), the user agent (“device make, model, operating system, and browser information”), timestamps, ad and event information, and descriptive page metadata, structured microdata, page performance data, and button clicks. First-party cookies are optional, but third-party cookies are on by default. With advanced matching, it also sends hashed email and phone to improve match rates.
Where does the data go?
To TikTok, where it is used to attribute conversions, build audiences, and target ads. Since January 2026 a US joint venture (ByteDance holds 19.9%) runs TikTok’s US user data, app and algorithm, but TikTok’s advertising business, which the TikTok Pixel feeds, stayed with TikTok’s global entities. In May 2025 Ireland’s Data Protection Commission fined TikTok EUR 530 million, finding it had not shown that EEA users’ data accessed by staff in China was adequately protected.
With and without consent
The pixel can fire on page load, before a visitor consents, unless it is gated. Its third-party cookies being on by default means consent handling matters more here than for tags that default to first-party only. With advanced matching turned on, the pixel sends email and phone hashed with SHA-256, and the automatic option reads form fields on your pages.
Privacy risk:High
The TikTok Pixel rates high because it collects a broad set of data including IP and device details, defaults third-party cookies on, can send hashed personal data through advanced matching, and sends data to a platform whose handling of EEA users’ data accessed from China drew a EUR 530 million fine from Ireland’s regulator in 2025. Whether a specific use is compliant depends on your setup and the applicable law. See the Privacy & Compliance resources for the legal question and Enforcement Watch for any related actions.
Privacy risk is rated on four factors: breadth and sensitivity of data collected, hashed PII, third-party sharing and reach, and documented enforcement or litigation exposure. It is a data-and-exposure read to help prioritize what to check, not a legal determination.
Is the TikTok Pixel still in use?
Yes. It is actively used by advertisers running TikTok campaigns, and TikTok also offers the Events API for server-side sharing alongside the browser pixel.
How DataTrue detects the TikTok Pixel
DataTrue recognizes it as the TikTok tag type. Coverage tests find it across your site, and Simulation tests read what it sends at each step and in each consent state, including whether third-party cookies and any hashed personal data are being sent. For how this works in the product, see the Web Analytics Testing page.
Questions
What data does the TikTok Pixel collect?
The visitor’s IP address, device and browser, timestamps, on-site activity and button clicks, and, with advanced matching, hashed email and phone. Third-party cookies are on by default.
Does the TikTok Pixel use third-party cookies?
Yes. Per TikTok, first-party cookies are optional but third-party cookies are on by default, which makes consent handling for this tag especially important.
Where does TikTok Pixel data go?
To TikTok. Since January 2026 a US joint venture (ByteDance holds 19.9%) runs TikTok’s US user data, app and algorithm, but TikTok’s advertising business, which the TikTok Pixel feeds, stayed with TikTok’s global entities. In 2025 Ireland’s regulator fined TikTok EUR 530 million over EEA users’ data accessed from China.
Is the TikTok Pixel a privacy risk?
It carries a high privacy risk due to the breadth of data, default third-party cookies, hashed personal data via advanced matching, and the cross-border path. Whether a given setup is compliant is a separate legal question.
Sources: About TikTok Pixel, ads.tiktok.com/help/article/tiktok-pixel. Best practices for Advanced Matching for Web, ads.tiktok.com.
Know what your tags send, page by page
DataTrue runs real journeys on your site and checks each tag’s data against what you expect, field by field. A missing event or a wrong value shows up in a test before it reaches a report.
- Every page, with coverage scans
- Scheduled runs, with alerts when a result changes
- Full journeys, like checkout and signup, in each consent state
- What each tag sent, field by field
- PII detection with test personas
- iOS and Android app testing
- Pre-publish testing for GTM and Adobe Tags
- REST API, plus Slack and Jira alerts
The full platform, every feature, free for 30 days.
