The EU’s New Inquiry into TikTok: Child Safety, Privacy, and Advertising Under Scrut

Introduction

The EU’s new inquiry into TikTok child safety, privacy, and advertising under scrutiny is a wake‑up call for every website owner who relies on third‑party tags, pixels, or embedded content. While the investigation targets TikTok directly, the regulatory expectations it surfaces – transparent consent, rigorous age‑appropriate design, and verifiable control over data flows – apply to any site that integrates external services. This guide translates the inquiry’s implications into concrete, verifiable steps you can take today. We focus on what you can scan, fix, and prove using GDPRChecker, without venturing into legal advice.

What is The EU’s New Inquiry into TikTok: Child Safety, Privacy, and Advertising Under Scrutiny – A Practical Guide for Website Owners?

The EU’s New Inquiry into TikTok: Child Safety, Privacy, and Advertising Under Scrutiny – A Practical Guide for Website Owners is the practical process a website owner uses to document, check, and improve the relevant consent or privacy controls. In this guide, it means keeping evidence that can show what visitors were told, which choices they made, and how tracking behavior matched those choices at the time of a review.

Regulators are no longer satisfied with a passive cookie banner. They want evidence that consent choices are respected before any network request fires, that advertising trackers are correctly categorised, and that disclosures are easy to find. Whether you embed a TikTok pixel, use a tag manager, or simply want to future‑proof your compliance posture, the principles below will help you close the gaps that the EU’s new inquiry into TikTok child safety, privacy, and advertising under scrutiny has brought into sharp focus.

What the EU’s New Inquiry into TikTok Child Safety, Privacy, and Advertising Under Scrutiny Means for Website Owners

The European Commission’s formal investigation into TikTok examines three areas: protection of minors, advertising transparency, and data access for researchers. For website owners, the practical takeaway is that **any** service processing personal data of EU residents – especially children – must demonstrate compliance by design. If your site uses TikTok’s advertising pixel, embedded videos, or login kits, you are part of that data supply chain.

From a compliance standpoint, the inquiry reinforces several expectations that already exist under the GDPR and ePrivacy Directive: - **Age‑appropriate design**: If your audience includes users under 16 (or a lower national age of consent), you must implement measures to verify age or obtain parental consent. - **Transparent advertising**: Users must understand when content is promotional, who is behind it, and how their data fuels targeting. - **Data minimisation**: Only collect what is strictly necessary, and do not repurpose data for unrelated advertising without fresh consent. - **Demonstrable accountability**: You must be able to show – through logs, screenshots, or scanner reports – that your consent mechanism works and that tags fire only after valid consent.

Even if you do not directly target children, the inquiry signals that regulators will scrutinise the entire ad‑tech ecosystem. A website that blindly loads a TikTok pixel on page load, before any consent interaction, is likely non‑compliant. The same logic extends to any third‑party tag that sets cookies or accesses device storage. The EU’s new inquiry into TikTok child safety, privacy, and advertising under scrutiny is therefore a prompt to audit every external dependency on your site.

Requirements and Compliance Expectations

While the TikTok inquiry is case‑specific, the underlying requirements are drawn from the GDPR, the ePrivacy Directive, and guidance from the European Data Protection Board (EDPB). Website owners should treat the following as minimum expectations:

**Prior consent for non‑essential processing**: Marketing pixels, analytics that are not strictly necessary, and social media embeds that set tracking cookies all require affirmative consent before they load. Implied consent, pre‑ticked boxes, or “by continuing to browse” language are insufficient.
**Granular choice**: Users must be able to accept or reject cookies by category (e.g., functional, analytics, marketing). A single “Accept All” button without an equally prominent “Reject All” option is a common violation.
**No cookie walls**: Access to content cannot be conditional on accepting non‑essential cookies, unless a genuine equivalent paid alternative is offered.
**Transparent information**: Your privacy policy and cookie notice must name specific third parties (e.g., TikTok, Google), explain what data they collect, and link to their own privacy policies.
**Age verification**: If your service is likely to be accessed by children, you must conduct a Data Protection Impact Assessment (DPIA) and implement age‑appropriate measures. The EDPB’s guidelines on children’s data (available at [EDPB](https://www.edpb.europa.eu/)) stress that default settings should be privacy‑friendly.
**Consent Mode integration**: For Google services, Consent Mode v2 (see [Google Consent Mode](https://developers.google.com/tag-platform/security/guides/consent)) allows tags to adjust behaviour based on consent state. While GDPRChecker does not offer a Google Certified CMP, it can verify that your consent banner correctly signals consent to Google tags, closing the Consent Mode gap.

These requirements are not new, but the TikTok inquiry shows that enforcement is intensifying. A scanner‑based audit is the quickest way to check whether your site meets them in practice.

How to Implement Step by Step

1. Map Your Tag and Tracker Inventory Start by listing every third‑party service that loads on your domain. Include: - Advertising pixels (TikTok, Meta, LinkedIn, etc.) - Analytics scripts (Google Analytics, Hotjar, etc.) - Social media embeds (YouTube, TikTok, Twitter) - Tag managers (Google Tag Manager, Tealium) - CDN or font services that set cookies

Use GDPRChecker’s scanner to crawl your site and generate a complete inventory. Pay special attention to tags that fire before any consent interaction – these are your highest‑risk items.

2. Configure Your Consent Banner Correctly If you use a consent management platform (CMP), ensure: - The banner appears on the first page load and blocks all non‑essential tags until the user makes a choice. - “Reject All” is as easy to click as “Accept All.” - Categories are clearly labelled, and the default is “off” for marketing and analytics. - The banner is responsive and accessible on mobile devices.

If you manage consent manually, you must write JavaScript that prevents tags from firing until consent is obtained. This is error‑prone; a managed consent banner (available on GDPRChecker paid plans) reduces the risk of misconfiguration.

3. Integrate with Google Consent Mode v2 Even if you are not a Google Certified CMP, you can still implement Consent Mode v2 to send consent signals to Google tags. The key steps: - Update your gtag.js or Google Tag Manager container to support Consent Mode. - Set default consent states (e.g., `analytics_storage: 'denied'`) before any tags fire. - Update consent states when the user interacts with your banner. - Verify the integration using Google’s Tag Assistant or GDPRChecker’s consent diagnostics.

Refer to Consent Mode and Analytics for technical details. GDPRChecker can then scan your site to confirm that `gtag('consent', 'update', ...)` calls happen only after user consent, closing the Google CMP gap.

4. Update Your Privacy Policy and Cookie Notice Your privacy policy must disclose: - The identity of all third‑party data controllers (e.g., TikTok, Google). - The purposes of processing (advertising, analytics, content personalisation). - The legal basis for each purpose (consent for non‑essential). - How users can withdraw consent.

Your cookie notice should list every cookie and tracker by name, provider, purpose, and duration. GDPRChecker’s scanner can compare the declared cookies in your policy against what is actually found on your site, highlighting discrepancies.

5. Test the Reject Flow Many sites break when a user rejects cookies. Common failures: - Essential functionality (e.g., navigation, forms) stops working. - The cookie banner reappears on every page. - Tags still fire despite rejection.

Manually test your site with browser developer tools open. Clear all cookies, load the site, reject all non‑essential cookies, and check the Network tab for unexpected requests. GDPRChecker automates this test and flags pre‑consent requests.

6. Implement Age‑Appropriate Measures (If Applicable) If your site is likely to attract children, consider: - An age gate that asks for date of birth before any data collection. - Default privacy settings that are maximally protective. - Clear, child‑friendly explanations of data use. - A DPIA that documents risks and mitigations.

Even if you do not target children, the TikTok inquiry suggests that regulators will look at the “likely” audience. If your content or marketing could appeal to minors, err on the side of caution.

Common Mistakes and How to Avoid Them

Mistake 1: Firing Tags Before Consent This is the most common and most serious error. A TikTok pixel that loads on page load, before the user sees a banner, violates the requirement for prior consent. **Fix**: Configure your tag manager to fire marketing tags only on a consent‑granted event, or use a CMP that blocks tags by default.

Mistake 2: Missing “Reject All” Button A banner that offers “Accept All” and “Manage Settings” but no “Reject All” forces users to take extra steps to refuse consent. The EDPB has made clear that refusing must be as easy as accepting. **Fix**: Add a prominent “Reject All” button at the same level as “Accept All.”

Mistake 3: Incomplete Cookie Disclosures Your cookie notice lists 10 cookies, but a scanner finds 30. This mismatch erodes trust and can lead to fines. **Fix**: Run a GDPRChecker scan monthly and update your cookie notice whenever new trackers appear.

Mistake 4: Ignoring Consent Mode Gaps If you use Google services, failing to implement Consent Mode v2 means you lose modelled conversion data and risk non‑compliance. **Fix**: Follow the implementation guide above and verify with both Google’s tools and GDPRChecker.

Mistake 5: Assuming Embedded Content Is Safe Embedding a TikTok video may set third‑party cookies without your knowledge. **Fix**: Use a two‑click solution (placeholder that loads the embed only after consent) or a privacy‑enhanced embed option if available.

Mistake 6: Overlooking Mobile and Single‑Page Apps Consent mechanisms that work on desktop often fail on mobile or in single‑page applications (SPAs). **Fix**: Test on real devices and ensure your CMP supports the SPA’s routing.

How to Validate with GDPRChecker

GDPRChecker is built to turn the TikTok inquiry’s expectations into a repeatable audit workflow. Here is how to use it for each gap:

**Close the Cookie Banner gap**: Scan your site to verify that a banner appears, that it blocks tags before consent, and that both “Accept All” and “Reject All” work correctly. The scanner checks for pre‑consent network requests to known marketing domains (including TikTok).
**Close the Cookie Scanner gap**: Run a full cookie and tracker scan. The report lists every detected cookie, its domain, duration, and category. Compare this against your cookie notice to find undeclared trackers.
**Close the Privacy Policy gap**: Use the policy‑link checker to ensure your privacy policy is linked from every page (often required in the footer). The scanner can also detect whether key disclosures (e.g., third‑party data sharing) are present.
**Close the Consent Mode gap**: GDPRChecker’s advanced diagnostics (available on Growth plans) verify that Google Consent Mode signals are sent correctly and that default states are set to denied.
**Close the Google CMP gap**: While GDPRChecker is not a Google Certified CMP, it can confirm that your existing CMP integrates properly with Google’s consent API and that no Google tags fire before consent.

After any change – a new pixel, a banner update, a policy revision – run a fresh scan. The before‑and‑after reports serve as evidence of your compliance efforts.

Implementation Checklist

Run a full GDPRChecker scan to inventory all cookies, trackers, and pre‑consent requests.
Identify any tags that fire before consent (especially TikTok, Meta, Google) and block them.
Ensure your consent banner offers “Reject All” as prominently as “Accept All.”
Verify that rejecting all non‑essential cookies does not break site functionality.
Implement Google Consent Mode v2 if you use Google Analytics or Google Ads.
Update your privacy policy to name all third‑party data controllers and link to their policies.
Update your cookie notice to match the scanner’s inventory exactly.
Add an age gate or child‑friendly privacy settings if your audience may include minors.
Test the consent flow on mobile, tablet, and desktop browsers.
Schedule monthly GDPRChecker scans and keep dated reports as evidence.
Document your legal basis for each cookie and tracker in a data inventory.
Review third‑party contracts to ensure they commit to GDPR‑compliant processing.

FAQ

What is the EU’s new inquiry into TikTok child safety, privacy, and advertising under scrutiny? It is a formal investigation by the European Commission into TikTok’s compliance with the Digital Services Act, focusing on protection of minors, advertising transparency, and data access. For website owners, it highlights the need to audit any TikTok integrations and broader consent practices.

Do I need to worry about the EU’s new inquiry into TikTok child safety, privacy, and advertising under scrutiny for GDPR? Yes, if your website uses TikTok pixels, embeds, or any third‑party trackers. The inquiry reinforces GDPR principles like prior consent, transparency, and data minimisation. Non‑compliance can lead to enforcement actions, even if you are not the direct target of the investigation.

How do I implement compliance measures related to the EU’s new inquiry into TikTok child safety, privacy, and advertising under scrutiny? Start with a scanner audit to identify all trackers. Block non‑essential tags before consent, configure your banner with a clear “Reject All,” implement Google Consent Mode v2 if applicable, and update your privacy and cookie notices. Test thoroughly and document everything.

How can I verify my compliance with a scanner? Use GDPRChecker to crawl your site. It detects pre‑consent network requests, checks banner behaviour, compares declared vs. actual cookies, and verifies Consent Mode signals. The report gives you a clear list of gaps to fix.

What are common mistakes when addressing the EU’s new inquiry into TikTok child safety, privacy, and advertising under scrutiny? The most frequent errors are firing marketing tags before consent, missing a “Reject All” button, incomplete cookie disclosures, ignoring Consent Mode, and assuming embedded content is safe. Regular scanning and testing prevent these.

Which cookies and trackers should I check for? Focus on advertising pixels (TikTok, Meta, LinkedIn), analytics scripts (Google Analytics, Hotjar), social media embeds, and any tag that sets a third‑party cookie. GDPRChecker’s inventory will flag all of them.

How often should I review my compliance posture? At least monthly, and whenever you add a new third‑party service, update your tag manager, or change your consent banner. Continuous monitoring (available on paid plans) provides real‑time alerts for new trackers.

What evidence should I keep to demonstrate compliance? Keep dated scanner reports, screenshots of your consent banner, records of consent (if your CMP provides them), your cookie inventory, and a log of any changes made. This documentation shows regulators that you are actively managing compliance.

---

*This guide provides technical implementation steps, not legal advice. For legal questions, consult a qualified privacy professional.*

Comparison: common implementation approaches

| Approach | Best for | Evidence to retain | Trade-off | | --- | --- | --- | --- | | A shared consent record | Smaller sites with one banner and a limited set of tags | Consent choice, timestamp, policy version, and affected pages | Requires a reliable process when the banner changes | | A tag-manager based record | Teams that control analytics and advertising tags centrally | Consent defaults, trigger conditions, publish history, and test results | Can miss scripts added outside the tag manager | | A CMP or external consent platform export | Sites with multiple domains, vendors, or regional workflows | Vendor configuration, consent events, retention settings, and audit exports | Adds provider configuration and recurring review work |

Choose the approach that matches the site's tracking complexity, then verify that the stored evidence can explain what a visitor saw and what tags were allowed at that time.

Practical examples

Example 1: A small ecommerce site

A shop changes its cookie banner wording before a seasonal campaign. The operator records the previous and new banner version, tests Reject all and Accept all, and stores screenshots plus the resulting network checks. That creates a clear before-and-after record without relying on memory.

Example 2: A B2B lead-generation site

A marketing team adds a form analytics tag through its tag manager. Before publishing, it documents the consent category, the tag trigger, the privacy notice update, and a test showing that the request does not fire after a visitor rejects optional cookies.

Example 3: A multi-page content site

An editor notices that a new embedded video adds a third-party request. The team scans the affected pages, compares the result with the last scan, updates the cookie disclosure if necessary, and keeps the scan report with the deployment reference.

Article schema

```json { "@context": "https://schema.org", "@type": "Article", "headline": "The EU’s New Inquiry into TikTok: Child Safety, Privacy, and Advertising Under Scrutiny – A Practical Guide for Website Owners", "description": "Learn what the EU’s new inquiry into TikTok child safety, privacy, and advertising means for your website. Practical steps to audit consent, tags, and disclosures with GDPRChecker.", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://www.gdprchecker.online/guides/the-eus-new-inquiry-into-tiktok-child-safety-privacy-and-advertising-under-scrut" }, "publisher": { "@type": "Organization", "name": "GDPRChecker", "url": "https://www.gdprchecker.online" } } ```

Copyright and editorial notice

This original AI-assisted editorial draft was selected, reviewed, and published by GDPRChecker. All rights are reserved where protected by applicable law. Do not reproduce the article without permission.