Privacy LitigationWeb Tracking
TikTok Pixel Lawsuits Keep Coming. How Are Courts Ruling on Them?
The TikTok pixel appears in dozens of website tracking lawsuits each year. People without TikTok accounts sued TikTok itself over the data that the pixel collects about them, and lost in federal court in 2024. Most other claims target the businesses that install the pixel and treat it as a pen register, a theory on which courts have split. SB 690 ends most of those claims in California on January 1, 2027, but wiretapping claims will continue.
By Alex Proctor
Published October 27, 2026
Summary
The TikTok pixel sends TikTok the pages that visitors view, along with their IP addresses, device details, and cookies, whether or not the visitors have TikTok accounts. Courts have dismissed pen register claims over the pixel in Los Angeles and San Jose, while a federal court in San Diego let one proceed. Complaints filed in 2026 outside California, including in Florida and New York, cite the federal Wiretap Act, which SB 690 does not affect. I recommend that businesses confirm where the pixel runs and which matching features are active, and keep it off pages that collect sensitive information, as TikTok itself advises.
What Does the TikTok Pixel Collect?
The TikTok pixel is code that businesses add to their websites to measure and target their TikTok advertising. In a 2024 order, a federal judge described the pixel as collecting seven categories of data when visitors take actions on a page. They are the time, the IP address, browser and device details, cookies, the page address, the action taken, and information about the content involved.
TikTok's help center lists the pixel's cookies. They include _ttp, which is set on both the website's own domain and tiktok.com, along with ttclid and ttcsid_ on the website's domain. TikTok says that the cookies on its own domain are "used to recognize and match events across different websites." Each cookie lasts 13 months from its last use.
TikTok also offers Automatic Advanced Matching, which businesses can enable "with a few clicks." TikTok says it works best on pages that collect customer information, such as login, registration, and checkout pages. A separate tool, the Events API, sends similar information from businesses' own servers rather than from visitors' browsers.
Why Did People Without TikTok Accounts Sue TikTok?
The pixel collects information from every visitor, not only from people with TikTok accounts. The same 2024 order describes the pixel and the Events API as sending information "without distinguishing between TikTok users and non-users." TikTok then tries to match the data to its users through IP addresses and browser details. It discards data that it cannot match after 14 days.
That practice was the basis of a class action against TikTok by people who had never used the app. In December 2024, a federal judge in the Central District of California granted summary judgment to TikTok, a ruling that the plaintiffs have appealed. He found no evidence that TikTok collected sensitive information from the three plaintiffs, whose only potentially sensitive example was a page confirming a purchase of two pillowcases. Their claims had survived earlier challenges, but he wrote that "plausible allegations are not enough at the summary judgment stage."
How Have Courts Ruled on Claims Against Websites?
Many claims against businesses allege that the pixel is a pen register or trap and trace device under the California Invasion of Privacy Act (CIPA). Those terms describe tools that record who is communicating, rather than what is said. Plaintiffs argue that the pixel's collection of IP addresses and device details fits that description. Courts have reached different conclusions, as these examples show:
| Example | Ruling | Main Reason |
|---|---|---|
| State court, Los Angeles | Dismissed, April 2025 | Covers who, not what |
| Federal court, San Jose | Dismissed, June 2025 | No personal data identified |
| Federal court, San Diego | Proceeded, November 2025 | IP addresses can be enough |
A sampling of rulings as of October 2026, from the San Jose and San Diego orders.
In the San Jose case, against a cruise line, Judge Noël Wise also reasoned that if the pixel collected the personal details that the complaint described, those details would be the contents of a communication, which a trap and trace device by definition does not capture. She noted that the plaintiff's lawyers had filed "myriad identical cases" in federal and state courts. That dismissal is also on appeal.
In the San Diego case, against a sportswear company, Judge Gonzalo Curiel found it plausible that the TikTok pixel and Microsoft's advertising tag act as pen registers. He joined other federal judges who have held that collecting IP addresses can be enough for that claim.
What Will SB 690 Change for TikTok Pixel Claims?
SB 690 will end many of these claims in California. Starting January 1, 2027, only the California Attorney General may bring pen register claims over website tracking, including pending claims in lawsuits filed since January 1, 2025. Some plaintiffs have already dropped pending claims because of it.
However, plaintiffs also bring claims under CIPA's wiretapping provision, the federal Wiretap Act, and other states' laws. In 2026, complaints naming the TikTok pixel have been filed in federal courts in Florida, Pennsylvania, New York, and Iowa, as well as California, against retailers, restaurants, a real estate website, a ticket marketplace, and a college, among others.
What Does This Mean for Businesses?
The TikTok pixel is a lawful tool for measuring TikTok advertising. The legal theories against it are still unsettled. TikTok itself recommends reviewing each page before installing the pixel, to make sure the data collected there does not include "prohibited health or financial information" or other sensitive data.
I recommend that businesses confirm where the pixel runs on their websites and whether Automatic Advanced Matching is on. Pages with forms, account areas, and health or financial content deserve the closest review. Retargeting with the pixel likely counts as sharing for targeted advertising under state privacy laws, so privacy notices and opt-out tools need to account for it as well.
Consent banners help only if they block the pixel itself when visitors decline. TikTok's first-party cookies can be turned off in the pixel settings, but turning off cookies does not by itself stop the pixel from sending page addresses and IP addresses. That requires the consent platform to signal each visitor's decision to the tool that loads the pixel, which is often a tag manager or the website's e-commerce platform. At Captain Compliance, where I am Chief Trust & Privacy Officer, we build our consent platform to send that signal, so the pixel does not load for visitors who decline.
Questions
Does the TikTok pixel collect data from people without TikTok accounts?+
Yes. A federal court's 2024 order describes the pixel as sending information about all website visitors, whether or not they use TikTok. TikTok then tries to match the data to its users and discards what it cannot match after 14 days. People without TikTok accounts sued over this practice and lost in 2024 for lack of evidence, although they have appealed.
Does SB 690 end TikTok pixel lawsuits?+
Not entirely. Starting January 1, 2027, only the California Attorney General may bring pen register claims over website tracking. Pending private claims in lawsuits filed since January 1, 2025 end on that date. Wiretapping claims under CIPA, the federal Wiretap Act, and other states' laws are not affected.
Is the TikTok pixel a pen register under CIPA?+
Courts disagree. A state court in Los Angeles and a federal court in San Jose rejected the theory in 2025, while a federal court in San Diego let a claim proceed that November. The Ninth Circuit may address the question in the appeal of the San Jose dismissal. After January 1, 2027, SB 690 leaves those claims over website tracking to the California Attorney General.
Briefings are informational and do not constitute legal advice.
Running analytics or marketing tools?
I'll trace what leaves the browser, and when.
Website Privacy Audits include a detailed video review of your live site, a written report for your team or counsel, and a remediation review call. Priority audits add 72-hour delivery and testing of demand letter claims.
Standard $449. Priority $649.
My audits are most useful when you have a consent management setup to validate, a demand letter with specific claims to assess, or a team or client that needs an external web privacy expert. If you already know you have major gaps, your budget may be better spent addressing them directly. I recommend Captain Compliance, the platform I help build, for privacy technology needs.