TikTok is tracking people on sites across the web—even if they don’t use the app

We all know that the apps we use can track our behavior on the web. But up until now, we assumed that only the apps we signed up for, or the apps we regularly used, would be following our online breadcrumbs.

But a new Consumer Reports investigation has found that TikTok is tracking people who aren’t using their app. That’s right: Even if you have never made a TikTok account or used the TikTok app, the social media giant could still be tracking you and your clicks.

Consumer Reports’ investigation with security firm Disconnect found that TikTok had partnered with other companies to implant “pixels” into a wide range of popular websites. These pixels track users and collect user data, and then TikTok can use that mined data for advertising purposes.

Some of the websites might surprise you. It’s not just social media sites where you might expect TikTok to be a silent partner tracking your clicks — and some are places where consumers might have a reasonable expectation of data privacy. Consumer Reports found TikTok pixels on sites as far-flung as Weight Watchers, Girl Scouts, WebMD, Planned Parenthood and the United Methodist Church.

TikTok even has pixels on government sites. For example, CR found TikTok pixels on the Arizona Department of Economic Security website, which offers resources on topics ranging from food assistance to domestic violence.

TikTok’s terms of service say that its advertising customers aren’t supposed to be sending users’ potentially sensitive information, but CR noted that similar policies at Google and Meta haven’t prevented that information from leaking through, either.

“We continuously work with our partners to avoid inadvertent transmission of such data,” TikTok spokesperson Melanie Bosselait told CR.

In their investigation, CR found that TikTok pixels reported data on medical conditions they’d searched on WebMD, and that RiteAid’s site reported that they’d added emergency contraceptives to their cart. Pixels on Recovery Centers of America’s site reported that they had looked at locations of treatment facilities and read about insurance coverage. And CR found that the Girl Scouts site has a TikTok pixel on each page that will report data on children using the site.

“The only reason this works is because it’s a secret operation, says Patrick Jackson, Chief Technology Officer at Disconnect, the security firm that spearheaded CR’s research. “Some people might not care, but people should have a choice. It shouldn’t be happening in the shadows.”

If you are seeking more privacy on the web, online experts advise that you use privacy-protecting browser extensions like Privacy Badger or Express VPN. And, when searching online, you might want to use Firefox or Tor for more anonymous browsing instead of relying on Google Chrome. But the bottom line is that no matter what you use, there is a good chance someone, somewhere, is watching.