Skip to main content
BAA Directory

Does TikTok sign a BAA?

The answer

Does not sign a BAA

No. TikTok says it does not allow advertisers to share health information.

Ad platforms. Checked on the vendor's own pages on .

On this page

What TikTok says

“At TikTok, we don't allow advertisers to share information about children, health or financial information, or other categories of prohibited data.”

Source: TikTok Ads Help, About notifications of potentially prohibited data sharing, checked .

“Make sure you don't use your TikTok Pixel on web pages where you may share personal health or financial information.”

Source: TikTok Ads Help, About notifications of potentially prohibited data sharing, checked .

What this means for ad tracking

TikTok is where your conversion data ends up, so the question is not whether TikTok will protect PHI but what you send it. A browser pixel sends the page address, the event name and identifiers with every conversion, and on a healthcare site those can describe a condition or a treatment.

TikTok's own terms rule out health information, so the workable route is to send TikTok conversions that carry none: a neutral event name, hashed identifiers and no page details that reveal care.

Curve Compliance sends TikTok conversions that way: server-side in place of the pixel, with neutral event names, PHI-like pattern detection and SHA-256 hashed identifiers, under a BAA it signs on every plan. Book a call to see it on your own funnel.

How Curve helps

  • Curve sends your TikTok conversions server-side, in place of the TikTok pixel, with neutral event names and SHA-256 hashed identifiers.
  • PHI-like pattern detection checks every event before it goes out, and neutral event names keep conditions and treatments out of what the platforms see.
  • Attribution is kept through booking tools, so a booked appointment is credited to the ad that brought the patient in.
  • Consent management for your site, alongside the tracking.
  • A HIPAA-compliant setup done by Curve's team, in about a week, with a BAA signed on every plan.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Does TikTok sign a BAA?

No. TikTok says it does not allow advertisers to share health information. In TikTok's words: “Make sure you don't use your TikTok Pixel on web pages where you may share personal health or financial information.” We checked TikTok's own pages on September 29, 2026.

Can I send TikTok data about patients?

Not health information. TikTok's own terms rule it out, as quoted on this page. Send TikTok conversions with neutral event names and hashed identifiers, and nothing that reveals a condition or a treatment.

Can a healthcare business still track TikTok ad conversions?

Yes, when the conversion carries no health information. Curve sends TikTok conversions server-side, in place of the pixel, with neutral event names and identifiers hashed with SHA-256 to TikTok's requirements.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with TikTok before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call