TikTok Ads GDPR Compliance: A Practical Guide for EU Businesses

TikTok Ads GDPR compliance for an EU business rests on four things you control: when the TikTok Pixel is allowed to fire, what you send through the Events API, how you build audiences from customer data, and who you target. TikTok's own contract already fixes the legal roles, and the Digital Services Act (DSA) adds rules on minors, sensitive data and ad transparency. This guide walks through each part with the settings to check, as of October 2026.

For the cross-channel basics, see our complete guide to GDPR-compliant marketing for European SMEs.

1. Start with TikTok's contract: who is responsible for what

The Pixel, Custom Audiences, Lead Generation and TikTok's APIs are governed by the TikTok Business Products (Data) Terms (effective 22 January 2026) and the Jurisdiction-Specific Terms (effective 5 February 2026). Part B of the latter sets the GDPR roles for people in the EEA, Switzerland and the UK, with TikTok Technology Limited (Dublin) and TikTok Information Technologies UK Limited as your counterparties. Our summary of the role table in the Jurisdiction-Specific Terms:

Processing purpose	Data	Your role	TikTok's role
Collecting and sending data (Pixel, Events API, SDK)	Event and developer data	Joint controller	Joint controller (Article 26 GDPR)
Measurement and insight reporting	Event data	Joint controller	Joint controller
Audience creation and ad targeting	Event data	Independent controller	Independent controller
Improving, optimising and personalising ads	Event data	Independent controller	Independent controller
Contact details matching	Contact details	Controller	Processor
Custom Audiences (Customer File)	Contact details	Controller	Processor

Three consequences follow. As joint controller for collection, you are responsible for the consent needed for cookies and device access, and your privacy notice must name TikTok as joint controller, explain why you use its tools and link to TikTok's privacy notice. TikTok handles access, erasure and portability requests for the data it holds after collection, while you answer for your own processing and a correct technical setup. And for customer files TikTok is your processor, so the upload belongs in your record of processing activities. Our guide to data processing agreements for marketers explains what to file.

2. The TikTok Pixel under ePrivacy: consent comes first

Article 5(3) of the ePrivacy Directive requires consent before information is stored on or read from a user's device unless strictly necessary for a service the user asked for. Ad measurement is not. The EDPB's Guidelines 2/2023 (version 2.0, adopted 7 October 2024) state that tracking pixels fall under Article 5(3) even when no cookie is written. So the question is not only which cookies the Pixel sets, but whether it runs at all.

TikTok lists these Pixel cookies, all classed as advertising cookies lasting 13 months from when they were set or last used:

Cookie	Type	Domain
_ttp	First party	Your website
_ttp	Third party	tiktok.com
ttcsid, ttcsid_[pixel code]	First party	Your website
ttclid	First party	Your website
_pangle	Third party	analytics.pangle-ads.com (read, not set, by the Pixel where the Pangle network is used)

First- and third-party cookies are both on by default; first-party cookies can be switched off in the pixel settings in Events Manager. That lowers matching quality but does not change the consent analysis, because the Pixel still sends events. TikTok's data terms are explicit: where law requires consent for device access, as in the EEA and the UK, you need "verifiable prior" consent before TikTok collects anything.

TikTok names three ways to stop cookies when a visitor declines: a tag manager, a consent management platform (CMP), or TikTok's pixel consent mode. For most EU sites the cleanest route is letting the CMP decide whether the base code fires at all. Two contract details are easy to miss: you may not place a pixel tied to your ad account on a site you do not own without TikTok's written permission, and every page running the Pixel needs a prominent notice explaining that third parties including TikTok collect data for measurement and ad targeting, and how to opt out. For the banner itself, see our consent management implementation guide.

3. Events API and Advanced Matching do not replace consent

The Events API sends conversion events from your server instead of the browser. TikTok lets you pass its third-party cookie value as the external_id parameter, supports a combined Pixel plus Events API setup for first-party cookie values, and recommends Advanced Matching. Each ties an event more closely to a person. Contact details are hashed before they are sent, but a hashed email is still personal data for an advertiser who holds the original.

The rule that works: store the consent state with the session or order, and send identifiers server-side only when that record says yes. A server-side purchase event with a hashed email for someone who declined the banner is the same tracking by another route. Our article on server-side tracking and what consent still covers goes deeper.

4. Customer lists and audiences built from your data

Custom Audiences built from a customer file fall under TikTok's Custom Audiences (Customer File) Terms, in which TikTok processes the contact details only as your processor. That keeps the upload simple on paper, but it does not give you a legal basis. The original collection has to cover advertising on a social platform.

A French case shows how this goes wrong. On 30 December 2025 the CNIL fined a company €3.5 million for sending loyalty-programme members' email addresses and phone numbers to a social network for ad targeting. Members had agreed to SMS and email marketing, but the sign-up form never mentioned sharing data with a social network for targeted ads, so the CNIL held the consent invalid. It also faulted the missing data protection impact assessment (DPIA). The network was not named; the lesson applies to every customer-list feature.

Before any customer file goes to TikTok:

• Check that the wording people saw at collection mentions advertising on social platforms. A separate, unticked checkbox is the safest form.
• Remove anyone who withdrew consent or objected, and build a fresh export instead of reusing an old file.
• Never upload data about children or anyone below the local age of digital consent, or lists that reveal health, financial or other sensitive information. TikTok's terms prohibit both.
• Run a DPIA when the volume is large or lists are combined with other data.

Audiences built from Pixel events, such as website visitors, fall under "audience creation and ad targeting", where you and TikTok are independent controllers. A retargeting pool is only as lawful as the consent behind its events. Our retargeting checklist covers the rest.

5. Minors: what the DSA and TikTok's own rules block

Article 28(2) of the DSA bars online platforms from showing ads based on profiling to a user they know with reasonable certainty is a minor. TikTok's response shows up directly in Ads Manager. According to its help centre (page updated September 2026):

• Users aged 13 to 17 in the EEA, the UK, Switzerland and Brazil do not get personalised ads based on their activity on or off TikTok.
• When an audience in the EEA, Switzerland or the UK includes under-18s, the Lead Generation and TikTok Shop sales objectives are not available.
• Detailed targeting is removed for those audiences: gender, spending power, household income, audience lists, interests and behaviours, and postcode. Age, language, country or city, and device (except device price) remain.
• In a campaign that covers both under- and over-18s, TikTok applies your detailed targeting only to the 18+ part and delivers generic ads to the rest.

Category rules come on top: alcohol and gambling ads only above the legal age, credit, buy-now-pay-later and healthcare ads only for adults, and no weight-loss product ads at all. For adult products, set the age range to 18+ yourself instead of relying on back-end filtering.

6. Sensitive data, political ads and labelling

Article 26(3) DSA forbids platforms to show ads based on profiling that uses special categories of data under Article 9 GDPR, such as health, religion, sexual orientation or political opinions. Advertisers can undermine this from their side: a seed list of a pharmacy's customers, or a retargeting pool built only from visitors to a page about a medical condition, turns sensitive data into targeting. TikTok's data terms forbid sharing such data, so these setups break the contract as well as the law.

TikTok does not permit political, religious or other sensitive-issue ads, apart from narrow exceptions for approved public-service campaigns. Under Article 26(1), every ad must be recognisable as an ad and show on whose behalf it runs, who paid if that is someone else, and the main targeting parameters, so agencies should check the right client name appears. Article 26(2) requires platforms to offer a way to declare commercial content; make sure every paid creator post uses it.

7. Your ads are public: the Commercial Content Library

As a very large online platform, TikTok must keep a public ad repository under Article 39 DSA for as long as an ad runs and for one year after it was last shown. It must include the ad's content, the advertiser, the payer if different, the run dates, the main targeting parameters including exclusions, and reach, broken down by Member State where groups were targeted. TikTok's version is the Commercial Content Library at library.tiktok.com, searchable by target country, last shown date and advertiser name or keyword, with an API for bulk queries.

After preliminary findings in May 2025 that the earlier repository fell short, the European Commission on 5 December 2025 accepted binding commitments from TikTok: the full ad as shown in feeds including landing-page URLs, updates within 24 hours, the targeting criteria advertisers selected, aggregated reach by gender, age group and Member State, and better search filters. Competitors, journalists and regulators can therefore see your creative, landing page and targeting. Write ad text you would defend in public, and avoid targeting combinations that look like proxies for sensitive traits.

8. Data transfers: what the DPC fine means for advertisers

On 2 May 2025 the Irish Data Protection Commission fined TikTok €530 million because it had not shown that EEA user data, accessed remotely by staff in China, was protected to a level essentially equivalent to the EU's, and for transparency failures. TikTok was ordered to comply within six months or have transfers to China suspended. The case concerned users' data, not advertiser uploads, but it is a reason to document your own position.

Under the Jurisdiction-Specific Terms, data you send goes to TikTok's Irish and UK entities and is not treated as a restricted transfer. Where TikTok is your processor, it takes responsibility for safeguards such as Standard Contractual Clauses on onward transfers and gives at least seven days' notice of subprocessor changes. Record this, describe it in your privacy notice, and review it when the terms change.

TikTok Ads settings for EU campaigns

Setting	Where	Recommended for EU traffic
Pixel base code	Tag manager or CMP	Fires only after marketing consent
First-party cookies	Events Manager, pixel settings	On or off is a performance choice; consent is needed either way
Pixel consent mode	Pixel implementation	Use only if the base code must load before the visitor chooses
Advanced Matching	Pixel setup	Consented visitors only, and named in your privacy notice
Events API	Your server or a partner integration	Send identifiers only when the stored consent record says yes
Customer file audiences	Audiences in Ads Manager	Only lists collected with ad-specific consent, refreshed before upload
Age range	Ad group targeting	18+ for adult products and whenever you depend on detailed targeting
Privacy notice	Your website	Names TikTok as joint controller, links TikTok's notice, explains opt-out

Common mistakes

• Firing the Pixel from a tag manager trigger set to "all pages" while the banner is still open.
• Assuming that switching off first-party cookies makes the Pixel consent-free.
• Sending Events API purchases with hashed emails for visitors who rejected tracking.
• Uploading a newsletter list whose sign-up text only promised emails.
• Choosing "All" ages with interest targeting for an adult-only product and trusting TikTok's filters to sort it out.
• A privacy notice that mentions "social media pixels" but never names TikTok or its joint controller role.

Checklist: what to do this week

1. Open your site in a private window, decline the banner, and confirm in the browser's network tab that no requests go to TikTok domains.
2. Accept the banner and check that the _ttp cookie appears only then.
3. Confirm your server integration drops identifiers for declined sessions.
4. Add TikTok's joint controller role and a link to TikTok's privacy policy to your privacy notice.
5. List every customer file you have uploaded and check the collection wording behind each one.
6. Review age ranges in live ad groups that target the EEA.
7. Search your brand in the Commercial Content Library and read your ads as an outsider would.

Where Adverizeo fits

Most of this work happens in your tag setup and Ads Manager. For the ad text, Adverizeo writes copy for 24 channels within each channel's format limits, and every text ad gets a compliance score from 0 to 100 with suggestions, including country rules for EU locales. It is a risk check, not a legal guarantee. You can test a draft with the free GDPR ad checker, read how the checks work on our GDPR page, or start on the free plan. For a platform with a different contract model, compare our Pinterest Ads GDPR guide.

This article is general information, not legal advice.