Don’t use TikTok? Chances are they’re still tracking you

A BBC and Disconnect analysis found TikTok’s updated advertising pixel can transmit data from third‑party websites — including email addresses and form selections on sensitive sites — allowing tracking of visitors who do not have TikTok accounts. The changes follow a January 2026 update to TikTok’s US terms and the rollout of a new off‑platform advertising network, raising privacy and regulatory risk for TikTok and potentially increasing advertiser exposure; this could prompt greater adoption of tracker blockers, regulatory scrutiny, and reputational pressure on ad revenue streams.

Analysis

Market structure: TikTok/ByteDance (private) is the direct beneficiary of broader pixel adoption—advertisers reallocating just 1–5% of digital budgets to TikTok over 12 months would meaningfully pressure CPMs at Google/META. Winners also include cybersecurity and privacy vendors (Palo Alto Networks, CrowdStrike) and tracker-blocking solutions as enterprises and publishers invest in compliance; publishers and ad-dependent platforms face higher compliance costs and potential margin compression. Cross-asset: expect a 5–15% rise in implied volatility for major ad names on headline risk, modest safe-haven flows into US Treasuries (5–15bp tail move), and USD tail-churn on regulatory uncertainty.

Risk assessment: Tail risks include a regulatory crackdown (GDPR/FTC fines equal to 1–5% of annual revenue or $1–10bn) or advertiser boycotts that could remove 2–8% of ad spend from incumbent platforms in 3–12 months. Immediate risk (days): headline-driven share moves; short-term (weeks–months): advertiser reallocation and vendor contract reviews; long-term (12–36 months): structural share shifts if TikTok’s ad network scales. Hidden dependencies: publishers’ indiscriminate pixel installs and third-party cookie phase-out amplify second-order tracking and compliance exposure.

Trade implications: Tactical long positions in cyber/priv tech (CRWD, PANW, ZS) vs small tactical shorts or put spreads on META and GOOGL express secular privacy spend vs ad-revenue risk. Use 3–6 month 10–15% OTM put spreads to limit cost; size initial exposure small (1–3% portfolio) and scale into confirmed advertiser reallocation or regulatory filings. Rotate 2–5% away from pure-play adtech (TTD) into enterprise security over 30–90 days.

Contrarian angle: Consensus underestimates the probability regulators will target TikTok separately, which could re-centralize ad budgets back to Google/META and cause a mean-reversion rally in 6–12 months—this makes aggressive multi-month shorts on incumbents risky. Historical parallel: Cambridge Analytica produced a ~20% drawdown then recovery as businesses continued to depend on Facebook’s targeting; an overdone selloff in GOOGL/META could be a buying opportunity if regulatory outcomes are limited. Monitor advertiser spend data and formal regulator actions as binary catalysts.

Key Decisions for Investors

• Establish a 2–3% portfolio long position split 60/40 between CRWD (CrowdStrike) and PANW (Palo Alto Networks) within 7 trading days; target 20–30% upside over 6–12 months, stop-loss 10%.
• Initiate a 1–2% tactical short exposure to META and GOOGL/GOOG combined (allocate 60% size to META, 40% to GOOGL) via cash equity shorts or buy 3–6 month put spreads 10–15% OTM sized to 1% notional to cap premium; if either stock falls >12% in 30 days, add up to half the initial short.
• Implement a pair trade: long CRWD (1.5%) and short META (1.5%) equal-dollar to express cyber upside vs ad-revenue risk; rebalance or close after 3 months or if relative returns diverge >10%.
• Reduce exposure to pure-play adtech (e.g., TTD) by 50% vs benchmark over next 30 days and redeploy proceeds into cybersecurity/enterprise SaaS; reassess after quarterly ad-spend reports.
• Set market alerts for FTC/DOJ/EU formal investigations, major advertiser boycotts, or ByteDance ad-network launch milestones; if a formal regulator filing appears, increase short exposure to META/GOOG by another 1% within 14 days.