Does the TikTok Events API require consent even though it's server-side?

Yes. The Events API transmits hashed personal data (email, phone, IP) to TikTok's advertising platform server-to-server. Server-side architecture does not exempt it from GDPR consent requirements. Block server-side event transmission until marketing consent is granted.

What data does the TikTok Events API send?

The server sends HTTPS POST requests to business-api.tiktok.com with event type, parameters (value, currency, product IDs), hashed email and phone (SHA-256), IP address, user agent, and the TikTok Click ID. It deduplicates events against the browser-side pixel.

How does ConsentStack handle the TikTok Events API?

ConsentStack classifies the TikTok Events API as marketing. Because it operates server-side, ConsentStack flags it for server-side consent gating — operators must check the visitor's ConsentStack consent state before triggering Events API calls.

What tracker domains does TikTok Events API use?

ConsentStack has catalogued tracker domains for TikTok Events API including business-api.tiktok.com. These are the network destinations TikTok Events API's scripts contact, which a consent platform blocks until a visitor agrees.

TikTok Events API - Server-Side Tracking Privacy

Back to Vendor Library

Overview

The TikTok Events API is a server-to-server integration that transmits conversion events from an advertiser's web server directly to TikTok's advertising platform, bypassing the browser entirely. It complements the browser-side TikTok Pixel by providing a secondary data pathway that is not affected by ad blockers, cookie restrictions, or browser privacy features. The Events API sends the same types of conversion data (purchases, sign-ups, page views) but through a server-side HTTP request rather than a client-side pixel fire.

What This Script Does

The TikTok Events API operates primarily server-side, though it often works alongside the TikTok Pixel.

Server-side operation: The advertiser's web server sends HTTPS POST requests to business-api.tiktok.com/open_api/v1.3/pixel/track/ containing event data — event name, event parameters, and user identifiers (hashed email, phone number, IP address, user agent).
No direct client-side scripts: The Events API itself does not load JavaScript in the visitor's browser. However, it is typically deployed alongside the TikTok Pixel, which does set client-side cookies.
Deduplication: When both the Pixel and Events API report the same conversion, TikTok deduplicates the events using a shared event ID to avoid double-counting.
Data transmitted server-side: Event type (PageView, AddToCart, CompletePayment, etc.), event parameters (value, currency, content IDs), hashed user identifiers (SHA-256 hashed email and phone), IP address, user agent string, and the TikTok Click ID if available.
Cookie dependency: While the Events API does not set cookies itself, it relies on the _ttp and _ttclid cookies set by the TikTok Pixel (passed server-side) for optimal attribution matching. Without these, attribution falls back to probabilistic matching using hashed PII and IP.

Consent & Compliance

The TikTok Events API falls under the marketing consent category.

Under GDPR and ePrivacy, the Events API processes personal data (hashed emails, IP addresses, behavioral events) for advertising attribution. While it does not set cookies in the browser, the server-side transmission of personal data to TikTok for advertising purposes requires a GDPR-compliant legal basis — typically consent. The hashing of PII does not anonymize the data under GDPR, as TikTok can match hashed values against its user base. If the Events API operates without the TikTok Pixel (purely server-side), the ePrivacy Directive's cookie consent requirement does not apply, but GDPR consent for advertising data processing is still required.

Under CCPA/CPRA, server-side transmission of customer identifiers and behavioral data to TikTok for ad attribution constitutes "sharing" of personal information for cross-context behavioral advertising, regardless of whether cookies are used.

Should You Block This Without Consent?

Yes. The TikTok Events API transmits personal data to TikTok's advertising platform for conversion attribution and campaign optimization. The server-side architecture does not exempt it from consent requirements — the personal data processing for advertising purposes requires consent under GDPR, and the data sharing triggers CCPA opt-out obligations. Block server-side event transmission until the user grants marketing consent, or implement a consent-gated server-side check before firing Events API calls.

Is TikTok Events API GDPR compliant?

TikTok Events API typically loads marketing trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So TikTok Events API can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads TikTok Events API, not on TikTok Events API itself.

Visit website