On this page
The TikTok Pixel is a piece of code you place on your website that shares website events with TikTok so it can measure and optimize your ads. On a healthcare site it runs in the visitor's browser and can send page details, the IP address, cookies and button clicks, and TikTok says it does not allow advertisers to share health information, so what the pixel sends from condition, booking and form pages matters. Curve Compliance sends TikTok conversions server-side through TikTok's Events API instead, with PHI stripped, under a BAA it signs on every plan.
Book a call. Running TikTok ads for a clinic or telehealth brand? Curve Compliance replaces the TikTok Pixel and other browser pixels with one script, sends conversions server-side through TikTok's Events API, and strips PHI before data reaches an ad platform. Curve's team does the setup, typically live in about a week. Book a call with Curve.
What the TikTok Pixel is
In TikTok's words: “TikTok Pixel is a piece of code that you can place on your website that allows you to share website events with TikTok.” TikTok says advertisers use it to “Measure traffic on your website,” “Measure ad campaign performance” and “Optimize your campaigns and find new customers” (TikTok).
You create a pixel in TikTok Events Manager: in TikTok Ads Manager go to Tools, then Events Manager, then Connect Data Source, choose Web and enter your URL. TikTok then offers a partner integration, such as Shopify or Google Tag Manager, or a manual setup where you install the base code on your site. TikTok adds: “We recommend setting up both the TikTok Pixel and Events API together to maximize measurement and performance of your campaigns” (TikTok).
What it collects
TikTok says the pixel “collects information available via standard web browsers, like Chrome” (TikTok). Two optional features add more. Here is the list in TikTok's own words:
| Data | What TikTok says | Source |
|---|---|---|
| Ad and event information | “Information about the ad a person on TikTok has clicked on or an event that was initiated.” | About TikTok Pixel |
| Timestamp | “Used to determine when website actions took place, like when a page was viewed or when a product was purchased.” | About TikTok Pixel |
| IP address | “Used to determine the geographic location of an event.” | About TikTok Pixel |
| User agent | “Used to determine the device make, model, operating system, and browser information.” | About TikTok Pixel |
| Cookies | “First-party cookies are optional, but third-party cookies are on by default with the TikTok Pixel.” | About TikTok Pixel |
| Metadata and button clicks | “Includes descriptive page metadata, structured microdata, page performance data, and button clicks.” | About TikTok Pixel |
| Enhanced Data Postback (if on) | “Enhanced Data Postback collects landing page and visitor interaction information such as page content, button clicks, and website performance.” | Enhanced Data Postback |
| Automatic Advanced Matching (if on) | “Automatically identifies form fields on pages where the Pixel is installed, and hashes and collects the customer information entered on those pages” | Advanced Matching for Web |
On a health site, that list can describe care. A page title can name a condition, a button can name a treatment, and a form field can hold what a patient typed. For how the cookie part works, see third-party cookies on health websites, and to see which cookies your pages set, see the cookie checker guide.
Checking it with TikTok Pixel Helper
TikTok describes its tool this way: “TikTok Pixel Helper is a Chrome extension that can help you verify and troubleshoot pixel installation by checking for errors and providing implementation recommendations for your website” (TikTok). TikTok lists three ways to verify a setup: Pixel Helper, the Test Events feature in Events Manager, and the Diagnostics tab (TikTok). It also says: “We recommend utilizing Pixel Helper to view the data being sent to TikTok to ensure it aligns with data-sharing policies and does not include data that may be deemed sensitive” (TikTok).
- Install Pixel Helper in Chrome and open the pages that matter most: condition and service pages, booking pages and form thank-you pages.
- Read each event. Look at the event name, its parameters and the page URL. Health terms in any of them are a problem.
- Check the URL and UTM parameters. Query strings can carry form answers or campaign names that describe care.
- Open the Diagnostics tab in Events Manager, which TikTok says “helps you identify and resolve issues with your data connection setup” (TikTok).
The same check works for other platforms. See how to check which trackers your website loads and, for Google's tags, the Google Tag Assistant guide.
Pixel vs Events API
| TikTok Pixel | Events API | |
|---|---|---|
| Where it runs | In the visitor's browser | On a server; TikTok says it connects “across web, app, and offline (eg. Store, CRM) channels” (TikTok) |
| Who decides what is sent | The base code, your event setup and any automatic features that are on | You do: “With Events API, you only have to share the data required to meet your marketing objectives” (TikTok) |
| TikTok's health data rule | Applies | Applies the same way |
Moving to the Events API changes where data is sent from. It does not change what TikTok allows. TikTok's prohibited-data page says: “If you measure events on your website or app with tools like Events API or TikTok Pixel, it's your responsibility to review the information you share to make sure you aren't sending TikTok any prohibited data” (TikTok). See the TikTok S2S pixel in the FTC's Hims and Hers complaint and why server-side tracking alone is not HIPAA compliance.
Health data risks
TikTok's rule is plain: “At TikTok, we don't allow advertisers to share information about children, health or financial information, or other categories of prohibited data.” It adds: “Make sure you don't use your TikTok Pixel on web pages where you may share personal health or financial information.” Its examples of prohibited health data include “Ecommerce urls that contain protected health information” and “Information from apps that may be used to schedule medical appointments,” and it warns that “URLs and UTM parameters may contain potentially prohibited data” (TikTok). Its Business Products (Data) Terms say you will not share data that “includes health or financial information” (TikTok terms).
HIPAA adds its own layer. HHS lists “cookies, web beacons or tracking pixels” among the tracking technologies websites use, and says regulated entities “must ensure that all tracking technology vendors have signed a BAA and that there is an applicable permission prior to a disclosure of PHI” (HHS). TikTok does not sign a BAA (BAA Directory). If TikTok flags your data, start with the prohibited data sharing notice guide; for campaign rules, see what TikTok's health rules allow. How these rules apply to your pages depends on your setup, so talk to your counsel.
Removing or replacing it
- Find every install. Check the site header, your tag manager and any partner integration, such as a Shopify or WordPress plugin.
- Switch off the automatic extras first. TikTok says you can opt out of Enhanced Data Postback “by toggling Enhanced Data Postback off in your Events Manager settings” (TikTok). Check that Automatic Advanced Matching is off as well.
- Remove the base code and tags, then reload your key pages with Pixel Helper open to confirm nothing fires.
- Send conversions server-side, with neutral event names and only the fields TikTok needs.
- Keep watching Diagnostics in Events Manager for data warnings.
If you would rather not build the server-side part yourself, book a call with Curve. For the campaign side, see running TikTok healthcare ads.
How Curve Compliance helps
Curve Compliance replaces the TikTok Pixel and other browser ad pixels with one script. Curve's TikTok integration sends conversion data through TikTok's Events API with no browser pixel, supports TikTok's standard events plus custom events, and strips PHI before data reaches an ad platform. Each platform receives only a fixed list of fields, events can use neutral names, and contact identifiers are off by default on Meta, Google Ads and TikTok. Curve checks every event for PHI-like patterns, and Event Logs show what Curve sent to each platform and what the platform accepted.
The same setup sends conversions to Meta, Google Ads, Microsoft Advertising and LinkedIn, and keeps ad attribution when a patient leaves to book in IntakeQ, Calendly, Acuity, Jane App and other schedulers. Curve is SOC 2 Type II and signs a BAA on every plan (Directory entry). Curve's team does the setup, typically live in about a week, and Curve's free website scan shows whether the TikTok Pixel is on any public page you enter.
Sources, checked November 2, 2026: TikTok, How to Set Up and Verify TikTok Web Data Connection; TikTok, About TikTok Pixel; TikTok, About using cookies with TikTok Pixel; TikTok, Troubleshoot with Pixel Helper; TikTok, About Events API; TikTok, Enhanced Data Postback; TikTok, About Advanced Matching for Web; TikTok, About notifications of potentially prohibited data sharing; TikTok, Web Diagnostics; TikTok Business Products (Data) Terms; HHS, Use of Online Tracking Technologies.
Frequently Asked Questions
What is the TikTok Pixel?
The TikTok Pixel is a piece of code you place on your website that shares website events with TikTok so it can measure and optimize ads (TikTok). It runs in the visitor's browser.
What does TikTok Pixel Helper do?
It is a Chrome extension that checks a page's pixel setup for errors and shows the events and parameters being sent (TikTok). TikTok recommends using it to make sure the data does not include anything that may be deemed sensitive.
How do I find my TikTok Pixel ID?
Log in to TikTok Ads Manager, go to Tools, then Events Manager, and open the pixel from the Datasets Overview section (TikTok). Pixel Helper also flags an invalid ID and tells you to “Go to Events Manager and find the correct pixel ID” (TikTok).
Is the TikTok Pixel HIPAA compliant?
Not on pages that involve PHI. TikTok does not sign a BAA and says not to use its pixel “on web pages where you may share personal health or financial information” (TikTok; BAA Directory).
Does TikTok sign a BAA?
No. TikTok says it does not allow advertisers to share health information (BAA Directory).
What is the TikTok Events API?
It is TikTok's server connection for web, app and offline events, “with the ability to customize the information they share with TikTok” (TikTok). TikTok's health data rule applies to it just as it does to the pixel.
Does the TikTok Pixel use cookies?
Yes. TikTok says third-party cookies are on by default with the pixel and first-party cookies can be turned off in pixel settings, and that its cookies “expire after 13 months from being set onto a browser, or last used” (TikTok).
Does Curve Compliance sign a BAA?
Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the setup, typically live in about a week (Directory entry).
Talk to Curve Compliance
Book a call. Want TikTok conversions without the TikTok Pixel on your patient pages? Curve Compliance sends them server-side through TikTok's Events API, strips PHI before data reaches an ad platform and signs a BAA on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.