analytics.tiktok.com shows up in the network tab on page load — often installed by an app or channel integration nobody gated. Here's the diagnosis and the fix.
Fresh incognito window, DevTools → Network, filter on tiktok, banner untouched. An ungated install loads analytics.tiktok.com/i18n/pixel/events.js with the page and immediately sends pixel events back to analytics.tiktok.com — before any consent interaction. Application → Cookies shows _ttp set on first paint, and TikTok Events Manager reports page views roughly equal to total traffic rather than consented traffic.
In our 2026 scan of 3,891 small-business sites, the TikTok Pixel was firing before consent on 129 sites.
Free real-browser scan
Not sure what's firing on your site? See every pre-consent tracker — free, 30 seconds.
Real browser scan, no signup to run it. You see a summary of the findings; the full report with every tracker unlocks with your email.
The ttq base snippet was added straight to the site's <head> per TikTok's install instructions, so it loads and fires with the page — no consent tool ever gets a say.
The TikTok Pixel tag in Google Tag Manager fires on All Pages and its Consent settings were never configured.
On Shopify and similar platforms, the TikTok sales-channel app injects the pixel automatically, outside your theme and outside your CMP. This copy keeps firing even after you gate the one you know about.
The consent platform's auto-block list doesn't match analytics.tiktok.com, or the pixel sits uncategorized — so the default is to let it through.
California's Invasion of Privacy Act (CIPA), Penal Code § 631, prohibits intercepting a communication without the consent of all parties. Since 2022, plaintiff firms have applied that decades-old wiretapping statute to websites — arguing that transmitting a visitor's page views and events to TikTok for ad targeting before the visitor consents is an intercepted communication. Statutory damages under § 637.2 run up to $5,000 per violation, and plaintiffs argue each affected visitor session is a separate count, which is why even small sites receive demand letters. Similar all-party-consent statutes in Pennsylvania (WESCA), Florida (FSCA), and Massachusetts have produced parallel filings.
To be precise about what a network log can tell you: a tracker firing before consent is a technical finding — it establishes when a script transmitted data, not whether any law was broken. But timing is exactly what these claims are built on, which is why fixing the timing is the practical response.
<!-- Place BEFORE the GTM/gtag snippet. Defaults all storage to "denied"
so no tags fire until your CMP updates consent after the user opts in. -->
<script>
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
gtag('consent', 'default', {
ad_storage: 'denied',
analytics_storage: 'denied',
functionality_storage: 'denied',
personalization_storage: 'denied',
security_storage: 'granted',
wait_for_update: 500
});
</script>Your CMP (Cookiebot, OneTrust, Termly, etc.) calls gtag('consent','update',{...:'granted'}) only after the visitor accepts. Until then, tags stay blocked.
Free real-browser scan
Verify the fix in 30 seconds — free re-scan, no signup.
Real browser scan, no signup to run it. You see a summary of the findings; the full report with every tracker unlocks with your email.