Load the TikTok Pixel only after consent (cross-border to China)

The TikTok Pixel tracks visitors for advertising, conversion measurement and audience building. Firing it on page load shares behaviour with TikTok before consent — and the data can flow cross-border, including to China.

Why it matters

Advertising pixels are the clearest case of non-essential tracking that needs prior consent (KVKK Art. 5 / GDPR Art. 6). TikTok’s data flows raise cross-border transfer questions (KVKK Art. 9 / GDPR Chapter V) to a jurisdiction without an EU adequacy decision. A pixel that fires on load exposes both the identifiers it drops and the absence of a valid basis when it fired.

How to fix it

Never call ttq.load() or ttq.track() on page load. Initialise the pixel inside your consent accept callback, and if the visitor rejects advertising, do not load analytics.tiktok.com at all.

<!-- Do NOT load on page load. Only inside the Accept handler: -->
function onConsentAccepted() {
  !function(w,d,t){w.TiktokAnalyticsObject=t;var ttq=w[t]=w[t]||[];
    /* standard TikTok pixel bootstrap */
    ttq.load('YOUR_PIXEL_ID');
    ttq.page();
  }(window,document,'ttq');
}

Official sources

• KVKK — Law No. 6698 (official full text, mevzuat.gov.tr)
• KVKK — Kişisel Verileri Koruma Kurumu (Turkish DPA)
• GDPR — full regulation, article by article
• ePrivacy Directive 2002/58/EC — cookies, Art. 5(3)
• EDPB — guidelines on consent & cookies

Links to primary legislation for reference. PrivaScan is not affiliated with these bodies; this is information, not legal advice.

Related guides

• Stop Google Analytics from loading before consent (KVKK/GDPR) KVKK m.5 · GDPR Art. 6 · ePrivacy Art. 5(3)
• Gate Google Tag Manager behind consent KVKK m.5 · GDPR Art. 6 · ePrivacy Art. 5(3)
• Load the Meta (Facebook) Pixel only after consent KVKK m.5 · GDPR Art. 6 · Art. 26 (joint controller)
• Session recording (Hotjar, Clarity, Yandex) needs explicit consent KVKK m.5 · GDPR Art. 6 · Art. 9 risk

These guides cover automated checks for trackers, cookies and data flows. A full privacy review also needs legal input.