TikTok Pixel GDPR: What EU Websites Must Do After the €530M Fine

What the €530M fine was actually about

On 2 May 2025, Ireland's Data Protection Commission (DPC) — TikTok's lead supervisory authority in the EU — issued one of the largest GDPR penalties on record. It's tempting to file it under "big tech gets fined again" and move on. For EU site owners running the TikTok Pixel, that would be a mistake, because the reasoning points straight at your own setup.

The €530 million total broke into two distinct infringements, and the split is the whole story:

• €485 million under Article 46(1) — for transferring the personal data of European users to China without being able to guarantee it received protection "essentially equivalent" to EU standards. TikTok couldn't demonstrate that its Standard Contractual Clauses and supplementary measures were actually effective against access under Chinese law.
• €45 million under Article 13(1)(f) — for a transparency failure: its privacy policy did not adequately tell users their data was being transferred to China.

The DPC also ordered TikTok to bring its processing into compliance within six months and to suspend transfers to China if it didn't. Notably, during the inquiry TikTok told the regulator it did not store EEA user data on servers in China — then, in April 2025, disclosed it had in fact done so to a limited extent. This followed an earlier €345 million DPC fine in 2023 over children's data. The pattern is clear: TikTok's data flows are under sustained, aggressive scrutiny in Europe.

Why the fine matters to your website

Here's the connection most coverage skips. The €530M decision was about TikTok moving data to China — but the TikTok Pixel is the mechanism by which your visitors' data enters TikTok's systems in the first place. Every PageView, every event, every identifier the pixel collects on your site is personal data you have chosen to route to ByteDance — whose infrastructure spans the United States, Singapore, and, as the DPC established, has included remote access from China.

That makes you more than a bystander. Under GDPR you are a data controller for the processing you initiate on your own site, and — as we'll see — very likely a joint controller with TikTok for the pixel's data collection. The regulator's finding doesn't stay contained to TikTok — it raises the obvious question for your site: on what basis are you sending EU personal data into a pipeline a supervisory authority has already ruled deficient? For the broader framework these obligations sit within, see our GDPR compliance guide.

The two GDPR risks in one pixel

Most tracking pixels carry a single, well-understood GDPR problem: they fire before consent. The TikTok Pixel carries that one and a second, compounding one that puts it near the top of DPA enforcement priorities. Understanding both is the key to configuring it lawfully — or deciding whether to run it at all.

Risk 1: the pixel tracks before consent

The standard TikTok installation guide tells you to paste the pixel snippet into your page header. Follow it, and the pixel fires the instant the page loads — running a PageView event and writing its cookies before the visitor has clicked anything. That is a textbook violation of EU law.

Article 5(3) of the ePrivacy Directive is unambiguous: storing or accessing information on a user's device requires prior consent, unless it is strictly necessary for a service the user explicitly requested. Conversion tracking for your ad campaigns is not strictly necessary to deliver your website. The GDPR then reinforces this by requiring a valid legal basis for the personal data the pixel processes. The two work together: ePrivacy governs the act of dropping the cookie; GDPR governs what happens to the data after. (For the consent standard itself, see our cookie consent guide.)

When the TikTok Pixel loads, it sets two cookies that matter here:

Both are marketing cookies feeding TikTok's advertising algorithms. Crucially, the _ttp cookie alone is enough to constitute a tracking cookie under EU ePrivacy guidance — so even a stripped-down pixel with advanced matching disabled still requires consent before it loads. Dropping it silently, with no visible UI, is one of the most common failures DPAs flag in cookie audits precisely because site owners assume "no visible tracker" means "no problem."

Risk 2: the data goes to China

This is the layer that makes the TikTok Pixel different from a Meta or Google pixel, and it's the layer the €530M fine was about. The data your pixel collects doesn't stay in Europe. It flows to TikTok's parent, ByteDance, across infrastructure in the United States and Singapore — and, as the DPC established, has been remotely accessible from China.

Transferring EU personal data outside the EEA is only lawful under Chapter V of the GDPR if you have a valid transfer mechanism — typically Standard Contractual Clauses (SCCs) — and can demonstrate the destination actually protects the data to an essentially equivalent standard. The DPC found this bar was not met for China: ByteDance is subject to national security laws that can compel data disclosure, and SCCs on paper don't neutralise that. This is why a Transfer Impact Assessment (TIA) and a Data Protection Impact Assessment (DPIA) are strongly recommended before deploying the pixel at all — the ByteDance ownership structure creates a documented, foreseeable government-access risk you're expected to have assessed.

The practical consequence: even if you fix the consent problem perfectly, you still have to confront the transfer question every time a consenting EU visitor's data leaves for ByteDance infrastructure. Consent makes the collection lawful; it does not by itself make the international transfer lawful.

The joint-controller trap most site owners miss

When you embed the TikTok Pixel, you and TikTok jointly determine why and how your visitors' data is collected — you place the pixel to measure conversions and build audiences; TikTok uses the same data for its own ad products. Under GDPR Article 26, that shared determination generally makes you joint controllers, not a controller and a mere processor.

That distinction carries real obligations: you must inform visitors that data is shared with TikTok, specify the purposes, provide a way to withdraw consent as easily as it was given, and reflect all of this in your privacy policy. Many EU site owners run the pixel believing TikTok "handles the compliance side." It doesn't work that way — the controller who placed the pixel is on the hook for the collection that happens on their own domain.

Why "legitimate interest" won't save you

A common temptation is to claim legitimate interest (GDPR Article 6(1)(f)) as the legal basis, avoiding a consent banner altogether. For an advertising pixel, this is a bet most privacy professionals would refuse to make, for two reasons.

First, ePrivacy Article 5(3) requires consent to set the cookie in the first place — legitimate interest is a GDPR lawful basis and cannot override the ePrivacy consent requirement for device storage. Second, even on the GDPR side, retargeting and cross-site profiling are intrusive by nature, involve tracking people across the web, and are difficult to justify against a visitor's reasonable expectations. European guidance and enforcement have landed consistently on consent — an opt-in, not opt-out — as the appropriate basis for advertising cookies and pixels. In practice, consent under Article 6(1)(a) is the only defensible route for the TikTok Pixel — which brings us back to blocking it until that consent exists.

What a compliant TikTok Pixel setup looks like

Compliance here is binary in its first requirement — the pixel is blocked before consent, or it isn't — and layered after that. Here's the contrast that matters.

The agency exposure — priced in or not?

If you're an agency running TikTok campaigns on client sites, this is exposure you may not have on the books. Installing the pixel without addressing both risks means you've built the on-ramp — the consent violation fires on the client's domain and the transfer question attaches to their data, but you configured it. When a DPA or a client audit surfaces the problem, "the agency set it up" is not a comfortable place to be.

There's a better framing than risk, though. Handling this properly is a service you can sell. "We deploy your TikTok Pixel so it blocks before consent, passes Limited Data Mode signals correctly, and comes with the transfer documentation your DPO expects" is a concrete, defensible deliverable — and it differentiates you from every agency that just pastes the snippet in the header. Getting the consent layer right across a whole client portfolio, from one dashboard, turns a latent liability into a retainer line. Our agency plans are built for exactly that multi-site shape.

How to make the TikTok Pixel GDPR compliant

Six steps, in order of impact. The first is non-negotiable; the rest make the setup defensible and complete.

TikTok Pixel GDPR — frequently asked questions