All Vendors
advertising

TikTokPixel

Social media ad pixel with extreme demand leakage and extensive behavioral fingerprinting capabilities.

39 IOCs30 detections20 sites
56
Vendor Risk Score

How This Briefing Works

This report opens with key findings, then maps the gaps between what TikTokPixel discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.

Key Findings

Key Findings

30 detections across 20 sites
Disclosure Gaps

Claims vs. Observed Behavior

1 gaps

pending

UNKNOWN
They Claim

“Requires claims extraction via CDT”

Observed Behavior

Live website analysis pending

Customer Impact

What This Means For You

Sites deploying TikTok Pixel feed complete customer journey data to a competitor ad network while accepting measurement controlled by the platform. Creates structural CAC inflation as visitor intelligence subsidizes TikTok's ability to target your prospects across their network. Regulatory risk escalates with ongoing government scrutiny of ByteDance data practices.
Recommended Actions

What To Do About It

Role-specific actions based on observed behavior

If You Use TikTokPixel

  • →Conversion API integration to control data shared with TikTok
  • →Server-side event forwarding to minimize client-side tracking footprint
  • →Audience exclusion lists to prevent competitive targeting of your visitors

If You're Evaluating TikTokPixel

  • →TikTok Shops integration expanding first-party data capture scope
  • →Enhanced matching capabilities increasing cross-device tracking accuracy
  • →Privacy Sandbox compatibility signals future tracking evolution

Negotiation Leverage

  • →Demand conversation API implementation to reduce pixel footprint and data leakage to TikTok ad network
  • →Request data residency commitments and explicit controls over downstream data usage by ByteDance entities
  • →Negotiate contractual limits on audience targeting using your first-party visitor data for competitive campaigns
Runtime Detections

Runtime Detections

4 BTI-C CODES

BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.

BTI-C06Behavioral Biometrics

Keystroke/mouse tracking

Impact: Captures interaction patterns, scroll depth, and engagement signals to fingerprint users across sessions and devices

BTI-C07Session Recording

Full session replay

Impact: Records user sessions including form interactions and navigation paths to build detailed behavioral profiles

BTI-C08Cross-Domain Sync

Identity stitching

Impact: Synchronizes user identity across domains via ByteDance infrastructure to enable cross-site tracking

BTI-C13Persistence Mechanisms

Long-lived identifiers

Impact: Deploys aggressive cookie and storage persistence to maintain tracking across user privacy actions

IOC Manifest

IOC Manifest

35 INDICATORS

Indicators of compromise across 6 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.

TRACK
analytics.tiktok.com/i18n/pixel/sdk.js
Tracking script
Ecosystem

Ecosystem & Supply Chain

Dominant social commerce pixel deployed by e-commerce brands targeting younger demographics. Part of ByteDance's rapidly expanding advertising infrastructure competing directly with Meta and Google measurement ecosystems.
Loaded By (2)
SegmentTealiumiq
Evidence

Evidence Artifacts

Artifacts collected during analysis, available with evidence-tier access.

HAR Capture

Complete network capture with all requests and responses

IOC Manifest

39 detection signatures across scripts, domains, cookies, and network endpoints

Vendor Details