We all know that the apps we use can track our behavior on the web. But until now, we assumed that only apps we signed up for, or apps we used regularly, would follow our online breadcrumbs.
But a new Consumer Reports survey found that TikTok tracks people who don’t use their app. It’s true: even if you’ve never created a TikTok account or used the TikTok app, the social media giant could still track you and your clicks.
Consumer Reports’ investigation with security firm Disconnect found that TikTok had partnered with other companies to implant “pixels” into a wide range of popular websites. These pixels track users and collect user data, then TikTok can use this extracted data for advertising purposes.
Some websites might surprise you. It’s not just social media sites where you might expect TikTok to be a silent partner tracking your clicks — and some are places where consumers might have a reasonable expectation of data privacy. Consumer Reports found TikTok pixels on sites as large as Weight Watchers, Girl Scouts, WebMD, Planned Parenthood and United Methodist Church.
TikTok even has pixels on government sites. For example, CR found TikTok pixels on the Arizona Department of Economic Security website, which offers resources on topics ranging from food aid to domestic violence.
TikTok’s terms of service say its advertising clients aren’t supposed to send users potentially sensitive information, but CR noted that similar policies at Google and Meta have also failed to prevent such information from leaking.
“We are continuously working with our partners to prevent the inadvertent transmission of such data,” TikTok spokeswoman Melanie Bosselait told CR.
In their investigation, CR found that TikTok pixels reported data on medical conditions they had researched on WebMD, and RiteAid’s site reported that they had added emergency contraceptives to their shopping cart. Pixels on the Recovery Centers of America site reported that they had reviewed treatment facility locations and read information about insurance coverage. And CR discovered that the Girl Scouts site had a TikTok pixel on every page that would report data on children using the site.
“The only reason it works is because it’s a covert operation,” says Patrick Jackson, chief technology officer at Disconnect, the security company that led CR’s research. “Some people might not care, but people should have a choice. It shouldn’t happen in the shadows.
If you’re looking for more privacy on the web, online experts advise you to use privacy-protecting browser extensions like Privacy Badger or Express VPN. And, when searching online, you might want to use Firefox or Tor for more anonymous browsing instead of relying on Google Chrome. But the bottom line is that no matter what you use, chances are someone, somewhere is watching.