How to Hold the TikTok Pixel Until Consent

The TikTok Pixel reports a visitor's page views, clicks, IP address and browser details to TikTok as soon as a page opens, unless the site holds it back. Website tracking complaints under the California Invasion of Privacy Act, CIPA, name it in 116 verified complaints in the 12 months to September 26, 2026. TikTok documents a hold, and loading the pixel only after consent goes further.

What the TikTok Pixel sends before a visitor chooses

The TikTok Pixel is a script from TikTok that shares website events so an owner can measure and target TikTok ads. TikTok's help center lists what it collects from the browser:

• Ad and event information: the ad a person clicked on TikTok, or the event that was started on the site.
• Timestamp, to tell when a page was viewed or a product bought.
• IP address, which TikTok says it uses to determine the geographic location of an event.
• User agent: device make, model, operating system and browser.
• Cookies, where TikTok says first-party cookies are optional and third-party cookies are on by default.
• Metadata and button clicks: page metadata, structured microdata, page performance data and button clicks.

Advanced matching carries identity. TikTok's help center says Automatic Advanced Matching "identifies form fields on pages where the Pixel is installed, and hashes and collects the customer information entered on those pages", such as name, zip code, email and phone, with SHA-256. It suggests that businesses in "a more regulated or sensitive industry such as financial services or healthcare" consider Manual Advanced Matching instead, which is worth reading twice for a dental or medical practice running TikTok ads.

TikTok's cookie table names the _ttp cookie on the site's own domain and another _ttp on .tiktok.com, each lasting 13 months from its last use. None of this is unusual for an ad pixel. What a complaint describes is the order: a request to analytics.tiktok.com leaving the browser before the visitor answered the banner. Suitcast's free scan records that sequence, with the second each request fired.

Why website tracking complaints name the TikTok Pixel

Website tracking complaints rest on two sections of the California Penal Code. Section 631(a) reaches anyone who, "willfully and without the consent of all parties to the communication", reads or attempts to learn the contents of a communication in transit. Section 638.51 bars installing or using a pen register without a court order, and section 638.50 defines one as a device or process that records routing and addressing information, "but not the contents of a communication". Section 637.2 allows the greater of five thousand dollars per violation or three times actual damages, and says a plaintiff need not have suffered actual damages. All four were read on leginfo.legislature.ca.gov on September 26, 2026.

On Suitcast's tracker catalog, in the 12 months to September 26, 2026, the TikTok Pixel is named in 116 verified complaints, behind Google Analytics 4 with 163, the Google Ads tag with 159 and the Meta Pixel with 138. The catalog rates it critical, the highest of its three risk levels. On the TikTok Pixel page, entertainment and media companies and medical and health providers account for 7 complaints each, more than any other industry.

Senate Bill 690, as enrolled, would let only the Attorney General sue over section 638.51 claims arising from a website or app, applying to pending claims in actions filed within two years before it takes effect, and leaves section 631 claims as they are. It was presented to the Governor on September 4, 2026, and leginfo showed no later action on September 26. Check its status again before relying on it, and if a letter has already arrived, the CIPA demand letter guide covers the first week.

TikTok's consent mode, and what it still loads

TikTok's developer documentation, Pixel Cookie consent mode, offers two setups. The default opt-in "will allow pixels to share data with TikTok until user consent is explicitly revoked", so it holds nothing on a first visit. The default opt-out "will prevent pixels from sharing data with TikTok until user consent is explicitly granted". In the base code it works in four steps:

1. Add holdConsent, revokeConsent and grantConsent to the ttq.methods list in the base code.
2. Call ttq.holdConsent() before ttq.load(), which TikTok says queues events without sharing them.
3. Call ttq.grantConsent() when the visitor accepts, which sends the queued events, or ttq.revokeConsent() when the visitor rejects, which drops them.
4. Do it on every page where the pixel is installed, as TikTok's note says.

TikTok adds that calling ttq.revokeConsent() "does not affect data shared with the TikTok server", so a rejection only stops what comes next.

The hold is not silence. In Suitcast's test on September 26, 2026, on a local test page in Chrome with a placeholder pixel ID, the default opt-out page still downloaded three script files from analytics.tiktok.com before any choice, while the page view itself, a request to the /api/v2/pixel path, went out only after ttq.grantConsent() ran. Without the hold, the page view went out straight away. A browser's network panel shows those downloads, and so does Suitcast's scan, which lists any request to analytics.tiktok.com before a choice as the TikTok Pixel.

The stricter route loads the base code itself only after accept, so nothing reaches TikTok until the visitor agrees. TikTok's own help center names that route: control "the firing of your pixel base code" with a tag manager or a consent management platform.

Where your pixel lives decides how to hold it

Most small business sites add the pixel through a platform, and each route has its own switch. The table follows each vendor's documentation as read on September 26, 2026.

Read the table by the first column. On Shopify, the app pixels help page says an app pixel's customer privacy settings "are determined by the third-party app partner, and can't be changed", and shows them under Settings, Customer events, View customer privacy. Shopify's Customer Privacy API allows all processing purposes by default outside the regions configured to require consent, so the Shopify banner guide comes first for a US store. In Google Tag Manager, the Tag Manager consent guide covers the default, the requirement and the trigger in order.

The last row matters because it looks like a privacy switch. TikTok's cookie instructions say that if a site must obtain consent for cookies, it should disable them when a person declines "by using a tag manager or a third-party consent management platform", or TikTok's pixel consent mode.

How to check whether your pixel waits

Test the page a customer lands on, in this order, which is the same five-minute test the cookie banner guide walks through for every script:

1. Open the page in a private window with the network panel recording, and type tiktok into the filter box.
2. Do not touch the banner. A request to the /api/v2/pixel path on that host is a page view already sent. Script files from analytics.tiktok.com alone mean the pixel loaded and is held, not that nothing reached TikTok.
3. Click reject, reload, and look again. A page view request that still appears ignores the choice.
4. Fix it where the pixel lives, using the table above, and repeat steps 1 to 3.

A scan does the same across several pages. The card below comes from a Suitcast report on a reserved example address: a clothing store where the pixel, pasted into the theme, fired on three pages before any choice and kept firing after reject on a product page.

The scan logs every request from the moment a page starts loading until the network goes quiet or 8 seconds pass, without clicking anything, and matches each one against the 43 scripts in its catalog. It then presses reject when a banner offers it, never accept, and watches 3 more seconds. The methodology page sets out the rules.

Keeping the pixel held after the next campaign

A TikTok Pixel rarely stays the way it was fixed. A new campaign adds events, an agency pastes a fresh base code without the hold, or the TikTok app is reinstalled on a store with a new theme. Each of those puts a request to TikTok back in front of the banner, and nobody opens the network panel afterwards.

A free scan is one dated snapshot of 5 pages. Suitcast's Monitor plan scans up to 100 pages every week, keeps every report with its PDF, and sends a weekly email naming the scripts that are new, the fixes that did not hold, and the new filings that match the site by state, industry or script. It costs $39 a month or $390 a year, less than one hour of a privacy lawyer's time. A Shopify store running TikTok and Meta ads, or a dental practice promoting whitening offers on TikTok, gets the same check every week without asking anyone. An agency covers five client sites on Pro for $79 a month or $790 a year, with its own name on each PDF. The pricing page compares the plans.

Limitations

This guide quotes California Penal Code sections 631, 637.2, 638.50 and 638.51 and the enrolled text of Senate Bill 690 as published on leginfo.legislature.ca.gov, and TikTok, Shopify and Google documentation, all read on September 26, 2026. The test of TikTok's hold used a placeholder pixel ID on a local page; a live pixel may make other requests. Vendors change their code and documentation without notice, and whether a given pixel setup breaks CIPA is a question for a lawyer and a court, not a scan. Nothing here is legal advice; the not legal advice page says what a score and a count mean.

A scan sees only what leaves a visitor's browser. Events sent through TikTok's Events API go from the site's server to TikTok and are invisible to it. The complaint counts are verified federal filings plus state filings with a public source, and state-court coverage is partial, so 116 is a floor; the dataset explains how cases are counted.