The TikTok pixel is coming under increased scrutiny amid privacy concerns. Photo / 123rf
New Zealand’s biggest bank is reviewing the use of an invisible piece of TikTok code on its website, amid concerns in Australia over how the Chinese-owned social media giant is collecting customers’ data from major retail websites - and fears about where it might end up.
ANZ says it is confident it is acting in accordance with customers’ expectations and that it does not collect or share personal data but it is also seeking reassurances from TikTok over its pixel - a small piece of code used on the ANZ website and many other top New Zealand retail and service websites.
The move follows scrutiny in Australia, where the privacy commissioner there has launched an initial inquiry into the use of the pixel to determine whether a full investigation is required.
Another top New Zealand bank, Westpac, and several major retailers who use the pixel say they are actively monitoring developments in Australia, while Consumer said it had immediately removed the pixel from its website this week after it had used it for a marketing campaign in 2022 but not since.
Telco One NZ has also removed the pixel from its eshop site this week.
New Zealand privacy officials say they are aware of the Australian inquiry and following it with interest.
“We are increasingly concerned about the practices of online tracking and data scraping. We are aware that TikTok is under increasing scrutiny for its privacy practices by other privacy regulators,” said a spokeswoman for the Office of the Privacy Commissioner.
TikTok insists the pixel, which is used to help retailers and clients deliver more effective advertising campaigns, complies with all New Zealand privacy laws - and operates no differently from the likes of Facebook and Google pixels and tags used by many major websites including news sites.
TikTok - one of the most popular social media platforms in the world, with more than one billion active monthly users - is owned by Chinese company ByteDance but has said it would “never share user data with the Chinese Government, nor would we if asked”.
The Sydney Morning Herald reported, in an investigation last month, that TikTok was harvesting Australians’ data “including email addresses, mobile phone numbers and browsing histories without their knowledge or consent, in a potential breach of the nation’s privacy laws”.
“TikTok’s tracking tool, known as a pixel, is an invisible piece of code that tracks a user’s web history and personal information, even if the user doesn’t have a TikTok account,” reported the SMH.
“The pixel can then track a user across the internet and piece together their identity including their email, phone number and buying habits – even if they don’t have TikTok on their phone.”
Inquiries by the NZ Herald show the pixel has been installed by retailers and services in New Zealand including the ANZ and Westpac banks, One NZ, The Warehouse, Warehouse Stationery, Noel Leeming, Hallensteins, Glassons, and Flight Centre.
In an initial statement to the Herald on Wednesday, ANZ said it took customers’ privacy “very seriously”.
“We are aware of the current concerns around its use in Australia. We can confirm we aren’t currently using the pixel to track campaigns from TikTok.”
Asked why the pixel was no longer being used, the spokeswoman sent a follow-up statement: “...following scrutiny in Australia, we have sought assurances from TikTok. We are reviewing the use of the pixel in the future”.
When the Herald reviewed the ANZ site again on Thursday, using a special Chrome extension, the pixel was still active.
ANZ apologised “if the information we provided yesterday wasn’t as clear as we intended it to be”.
“In order to optimise our advertising spend, ANZ regularly collects anonymised data from activity on our own website,” the spokeswoman said.
“We use the pixel to send data to TikTok in an anonymised aggregated form to enable them to optimise the placement of the advertisement on their app to their users. This means that our advertising is being served to people who will find it most relevant. We do not collect or share personalised customer data.
“That is why the pixel will still be visible on our ANZ site.”
The spokeswoman said that following the scrutiny in Australia, ANZ had sought assurances from TikTok that its methodology was privacy compliant.
“We take the privacy of our customers very seriously and we are aware of the current concerns around the use of the TikTok pixel in Australia. However, we are confident that we are acting in a way that meets customer expectations.”
Consumer - which prides itself on fighting for the rights of Kiwi consumers - also had the pixel installed on its website up until this week but said it had been removed “immediately” because of the concerns.
“We have used a TikTok website pixel in a limited sense in relation to a single campaign we ran in 2022,” said chief executive Jon Duffy.
“The pixel allowed us to track the effectiveness of that campaign for TikTok users. The pixel has not been actively used since that time, but was not removed.”
He said Consumer was aware of general concerns about social media companies tracking customers.
It was concerned to hear of the specific TikTok developments in Australia and would be closely following the privacy commissioner’s inquiry.
“Given the concerns, we’ve immediately removed the pixel. We will follow up with the Office of the Privacy Commissioner here in New Zealand and we will actively monitor the outcome of the investigation in Australia.”
The NZ Herald website does not use the pixel, but NZME’s Viva Premium website did use it for a time. The pixel had not been used for some time and was removed this week.
It is common for major consumer websites - including all major news websites such as the Herald and others - to have tags or pixels from companies such as Google, Facebook and/or others to measure analytics and for marketing.
But TikTok is coming under specific scrutiny in Australia following the SMH investigation and because of its Chinese links.
Many Western governments, including New Zealand, Australia and Britain, banned the TikTok app from government devices last year because of data security concerns.
“TikTok has been under increased scrutiny across the globe due to its parent company ByteDance’s ties to the Chinese Communist Party and China’s National Intelligence Law of 2017 that requires organisations and citizens to ‘support, assist and co-operate with the state intelligence work’,” reported the SMH.
“It would be concerning from any company but is particularly alarming given TikTok is beholden to the Chinese Communist Party and has admitted its China-based employees frequently access Australian user data,” Senator James Paterson told the SMH.
“There’s nothing to stop this industrial-scale unauthorised data collection being simply handed over to Chinese intelligence and security agencies, as TikTok and its employees are obliged to do under Article 7 of China’s National Intelligence Law.”
A pixel is a tiny piece of code that allows website owners to understand the behaviour of their customers.
Duffy said a pixel allowed its owner to understand and segment its website or email audience by tracking events (or actions) that people took on its websites.
“It’s a very useful tool for businesses, organisations and marketers.
“Based on the setup we used, TikTok creates a session ID rather than collecting an email address or phone number. The pixel was deliberately set up with ‘automatic advanced matching’ switched off, it’s this component that would allow the capturing of data of users’ information in a hashed format.
“Our understanding is this means that no first-party data was collected by TikTok in connection with the use of our website. We would be concerned if this was not the case.”
Aside from ANZ and Consumer, many other New Zealand retailers and service industry websites have had the TikTok pixel installed on their websites.
A Westpac spokeswoman said the pixel was installed “after a thorough review” in August 2023 “to serve more relevant ads to the public and improve advertising effectiveness”.
“We only allow anonymised page view numbers to be shared with TikTok. We are confident that no user information is shared, and we are actively monitoring discussions around privacy concerns in Australia, as well as the pixel’s effectiveness and suitability.”
She said protecting customer data and privacy was “always a top priority”.
One NZ spokeswoman Tegan Crawford said the company was aware of the privacy debate in Australia and was “keeping a close eye on the evolving investigation”.
“As an organisation, we take customer privacy seriously. One NZ utilises a range of audience assessment tools including TikTok’s pixel to measure the performance of our social media advertising. Pixel tells us when customers come to our website direct from TikTok, which allows us to assess the effectiveness of campaigns on that platform.
“We do not and have not used Pixel to track or collect any personal information from customers or visitors to our website. We will continue to use audience assessment tools where appropriate while regularly assessing use of these tools to align to best practice.”
One NZ head of corporate affairs Conor Roberts also told the Herald: “We continue to use TikTok pixel on a few key pages of the site to measure the effectiveness of marketing campaigns on that platform. It does not appear on the My One NZ customer log in page and was removed from the eshop page [this week].”
“We don’t use it to track or collect any personal information from customers or visitors to our website and the TikTok inbound marketing arrivals don’t land there so it was redundant.”
A spokeswoman for The Warehouse Group - which looks after The Warehouse, Torpedo7, Warehouse Stationery and Noel Leeming - said: “Our customers’ privacy is very important to us and we will be following this [Australian] inquiry closely.”
Hallenstein Glassons did not respond to requests for comment.
TikTok believes it is being singled out unfairly and Australian media reports have been “based on a fundamental misunderstanding of the data collected via the Pixel, and the privacy compliance measures used by TikTok and our clients”.
“The implication that the Pixel is designed to secretly collect data from unsuspecting individuals without notification is false,” said a spokeswoman.
“Pixel usage, which is voluntary for our advertising clients to adopt, is an industry-wide tool used to improve the effectiveness of advertising services.
“Our use of this tool is compliant with all current New Zealand privacy laws and regulations and we dismiss any suggestion otherwise.
“We also rely on our advertising clients to only share data with us through the Pixel, if they have in turn provided their customers with the necessary information and obtained the necessary permissions.
“As we have said publicly on many occasions, New Zealand user data is encrypted and stored in world-class data centres in the US and Singapore.”
The spokeswoman would not comment on individual cases - such as those of ANZ and Consumer.
The company has been particularly incensed that Paterson has written to Australian companies about its pixel.
TikTok told him in a letter: “As we have previously stated, user data is stored in the US and Singapore, and [consistent with best practice] access to that data is subject to a series of robust controls. We have never shared user data with the Chinese government, nor would we if asked.
“As a global company, we are not unique in how we operate. Some of the best-known and trusted Australian and New Zealand companies openly state in their privacy policies that they share Australian user information with employees and third parties around the world.
“These organisations often collect sensitive data like financial information, medical records, legal information and more.”
A spokeswoman for the Office of the NZ Privacy Commissioner said the office was aware of the Australian initial inquiry and would follow its progress “with interest”.
“We are increasingly concerned about the practices of online tracking and data scraping. We are aware that TikTok is under increasing scrutiny for its privacy practices by other privacy regulators.
“We have not launched an inquiry at this stage but will be closely monitoring.
“All agencies, whether they’re New Zealand organisations or an overseas-based organisation carrying out business in New Zealand, need to act in such a way that they comply with the NZ Privacy Act.”
In August, New Zealand Privacy Commissioner Michael Webster said social media platforms and commercial websites “must protect consumers from data scraping”.
He said data scraping was a process where an entity “hoovers up” data and “uses it for their own purposes”.
It had become a key source of training data for generative AI (Artificial Intelligence) technologies, which in turn allowed data scraping to happen at a faster rate, sometimes with malicious intent.
Social media companies and website hosts had obligations under the law to protect the personal information on their platforms from data scraping, he said.
Mass data scraping incidents that took personal information could constitute reportable data breaches in many jurisdictions.
“From a consumer perspective, people use online services as part of everyday life, and don’t expect their personal information to be hoovered up by other agencies, private or public, when they go online.
“From a privacy point of view, agencies collecting publicly available data need to understand that just because people are putting things out on the internet doesn’t mean that the Privacy Act’s safeguards don’t apply.
“Any platforms hosting or collecting data need to ask themselves what individuals would have expected in terms of the use of their data when they originally shared it.
“I would also urge the public to consider that every time they use the internet, they are leaving digital footprints. If money can be made from those footprints, there’s every chance someone is going to take that opportunity.”
Is TradeMe about to be traded?; Top ad execs' new outdoor business; Big Stuff changes.