TikTok Accused of "Invisible" Tracking via SDK

TikTok's "Invisible" Tracking of Grindr and Shopping Habits Sparks Massive GDPR Complaint

Open Grindr to check a message or buy a pair of sneakers on a niche e-commerce site, and TikTok might be watching—even if you don’t have the TikTok app installed on your phone.

That is the premise of a scathing legal complaint filed yesterday, December 17, by European privacy group noyb (None of Your Business). The filing, lodged with the Austrian data protection authority, accuses ByteDance’s social media juggernaut of using pervasive "cross-app" tracking to harvest highly sensitive data without user consent. The stakes are astronomical: a potential fine of up to 4% of global revenue, which could top $4.8 billion.

The "Trojan Horse" in Your Apps

The mechanism at the center of the dispute is TikTok’s Software Development Kit (SDK). Developers of thousands of popular apps insert this code to track ad performance or enable content sharing. But according to noyb, the SDK functions more like a generic surveillance tool.

The complaint alleges that this code syphons data back to TikTok regardless of whether a user has consented to tracking. Most damning is the granularity of the data. The filing outlines how the SDK reportedly tracks login patterns on Grindr, allowing TikTok to infer a user’s sexual orientation—classified as "special category data" under GDPR, which requires explicit, watertight consent. Similarly, the complaint details how the code logs purchase history and session times on shopping apps to build granular consumer profiles.

This isn’t just about serving better ads; it’s about penetrating the private spheres of user life. While users might accept that TikTok knows which dance challenges they watch, few realize the company may know exactly when they are looking for a date or what they just bought on a completely different platform.

An Existential Threat to the Ad Model

For ByteDance, this is more than just another legal headache on top of recent €345 million fines for child safety lapses. This complaint targets the plumbing of the app economy. TikTok’s advertising engine relies heavily on "attribution"—proving to advertisers that an ad shown on TikTok led to a purchase or download elsewhere.

If Austrian regulators side with noyb, it could force a systemic redesign of how these SDKs function in Europe. The industry already saw the financial crater left when Apple introduced App Tracking Transparency; a regulatory enforcement of similar standards would be even more severe. It would effectively blind TikTok to what its 150 million European users do outside the app, threatening to turn off the lights on the cross-referencing machinery that powers their revenue.

Denials and The Road Ahead

Both companies have moved quickly to contain the fallout. In a statement released yesterday, a TikTok spokesperson flatly rejected the allegations, asserting that their SDKs are designed for "legitimate business purposes" like ad measurement and operate with "clear consent mechanisms." The company insists it does not use the data to make sensitive inferences about sexual orientation.

Grindr, reporting 13 million monthly users, offered a similar defense, stating they do not share data without consent and rely on heavy encryption.

However, the legal test here won't be about corporate assurances, but about the technical reality of how data flows between apps. Noyb, led by Max Schrems, has a track record of toppling major trans-Atlantic data frameworks. If they succeed here, the era of silent, cross-app surveillance may be coming to an abrupt, expensive end.

Good Morning,
Guest

Quick Access

Good Morning,
Guest

Quick Access

TikTok Accused of "Invisible" Tracking via SDK

Key Takeaways

Key Takeaways

TikTok's "Invisible" Tracking of Grindr and Shopping Habits Sparks Massive GDPR Complaint

The "Trojan Horse" in Your Apps

An Existential Threat to the Ad Model

Denials and The Road Ahead

Similar Posts

Key Takeaways

TikTok's "Invisible" Tracking of Grindr and Shopping Habits Sparks Massive GDPR Complaint

The "Trojan Horse" in Your Apps

An Existential Threat to the Ad Model

Denials and The Road Ahead

Similar Posts

HM Journal - Loading...

HM Journal - Loading...

TikTok's "Invisible" Tracking of Grindr and Shopping Habits Sparks Massive GDPR Complaint

The "Trojan Horse" in Your Apps

An Existential Threat to the Ad Model

Denials and The Road Ahead

TikTok's "Invisible" Tracking of Grindr and Shopping Habits Sparks Massive GDPR Complaint

The "Trojan Horse" in Your Apps

An Existential Threat to the Ad Model

Denials and The Road Ahead