TikTok Pixel

Two separate mechanisms cover TikTok. They answer to different laws, and turning on one doesn't give you the other. The consent bridge follows the marketing category, as GDPR expects. Limited Data Use follows the US opt-out record.

Consent bridge

What it does. Holds the TikTok Pixel until the visitor makes a choice, then tells it what they chose. It uses TikTok's documented cookie consent mode API.

Consent category. marketing. The bridge reads the Consent Mode ad keys when a consent event carries them, and otherwise reads the stored category.

How it works. The bridge sends one of three calls:

ttq.holdConsent();   // at load, when the visitor hasn't decided yet
ttq.grantConsent();  // marketing granted
ttq.revokeConsent(); // marketing declined or withdrawn

The calls happen at three points:

• At load. The bridge reads the stored consent record. A visitor who has already chosen gets grantConsent or revokeConsent straight away. Anyone else gets holdConsent. A pending opt-in record is treated as undecided, not as a refusal.
• On a choice. It sends a call on every cookiebeam:consentUpdate and cookiebeam:consentRestored, and on withdrawal. It never sends the same call twice in a row. Once a decision has been sent, it never goes back to holding.
• Opt-out regimes. In the US, the runtime writes a default grant after the page loads and doesn't announce it with an event. The bridge re-reads the stored record for a few seconds after load, so these visitors' hold is released without them touching the banner.

If window.ttq doesn't exist yet, the bridge creates the same queue array that TikTok's base code creates. Calls go in using the base code's own [method] format. When your snippet runs, it reuses the array (w[t] = w[t] || []) and loads the library as usual. That puts holdConsent ahead of the snippet's ttq.page().

An explicit US opt-out of sale/sharing or of targeted advertising always sends revokeConsent. A US visitor who hasn't made any opt-out choice isn't treated as refusing.

Setup. Off by default. Two steps:

1. In TikTok Events Manager, turn on Cookie Consent Mode for the pixel. TikTok only acts on these calls when it's on.
2. On the banner's App Integrations page, go to Vendor Consent Signals → Ad pixels and turn on TikTok Pixel. Then publish.

The toggle is stored as customFeatures.adPixelConsentBridges.tiktok: true on the banner theme.

Turn this on only if TikTok is installed on the site. If it's on and the site never produces a consent decision for us to act on, the hold is never released.

If auto-blocking already keeps the TikTok script off the page until consent, the bridge does no harm. It just means the pixel starts in the right state when it does load.

Limited Data Use

What it does. Puts the TikTok Pixel into limited data use mode for US visitors covered by an opt-out.

Consent category. None. Like the Meta and Google equivalents, it reads the durable US opt-out record rather than a consent category. Opt-out rights and opt-in consent are different legal instruments.

How it works

TikTok's documented entry point is ttq.load(PIXEL_ID, { limited_data_use: true }). That only helps if you control the load call. Most sites don't, because the pixel comes from a tag manager or a theme. So the bridge uses the post-load form instead:

ttq.instance(PIXEL_ID).setLimitedDataUse(true);

That call needs the pixel ID, which is why this integration asks for one when the others don't. Without an ID there's no instance to reach, so the snippet isn't generated at all. That's better than shipping something that can't work.

The signal is sent at load from the stored opt-out record, then again on each consent update.

Setup

Off by default. Both the flag and the ID live in the banner theme's customFeatures:

{
  "usLimitedDataUse": {
    "tiktok": true,
    "tiktokPixelId": "CABCDEFGHIJKLMNOP"
  }
}

The ID is checked against ^[A-Za-z0-9_-]{1,64}$ before it's written into the script. An ID that doesn't match is dropped, and dropping the ID disables TikTok. A typo turns the integration off rather than generating a broken call.

There's no dashboard control for this yet, so it needs a theme update through the API.

Testing

For the consent bridge, load the site in a clean profile. Before you choose anything, check the queue:

window.ttq

Before the library loads, the array should contain ['holdConsent']. After it loads, choose in the banner and check that the _ttp cookie appears only after you accept marketing.

For Limited Data Use, first confirm the instance exists:

window.ttq && window.ttq.instance('YOUR_PIXEL_ID')

If that's undefined, the pixel hasn't loaded and the bridge has nothing to talk to. Once it exists, look at the requests a US visitor makes to TikTok's collection endpoint and confirm they carry the limited data use flag.