What Is ttclid? How the TikTok Click ID and the _ttp Cookie Work

ttclid is the TikTok click ID: a parameter TikTok adds to your landing page URL when someone clicks a TikTok ad. The TikTok Pixel saves it in a first-party cookie named ttclid, and the Events API sends it back to TikTok as user.ttclid, so a later purchase can be tied to that click.

This is the TikTok entry in our click ID series, which starts with fbclid and Meta's _fbc cookie. It covers where ttclid comes from, the ttclid and _ttp cookies TikTok documents, how to send both with the Events API, how long a click ID stays useful, and why Shopify stores lose it. We checked every TikTok detail against TikTok's Business Help Center and its API for Business docs on October 24, 2026.

What is ttclid?

ttclid is TikTok's click ID. TikTok's help center describes it as a tracking parameter appended to a landing page URL when someone clicks an ad on TikTok. When the events you send through the Pixel or the Events API contain click IDs, TikTok matches them to the ad click and uses the result for attribution, audience building, ad delivery optimization and measurement.

TikTok's developer docs give this example of a landing URL:

https://www.example.com/landing?ttclid=E.C.P.v3fQ2RHacdksKfofPmlyuStIIHJ4Af1tKYxF9zz2c2PLx1Oaw15oHpcfl5AH

A few properties matter when you handle it:

• One per click. TikTok says each click ID is unique, and a person who clicks your ads again later gets a new one.
• Long. The Send TikTok Click ID guide says a ttclid can be up to 1,000 characters, so a database column or log field that truncates it breaks the match.
• Alongside your UTMs. TikTok says click ID auto-attachment doesn't affect your other tracking parameters, so utm_source=tiktok and ttclid arrive together.

Where does ttclid appear?

In the landing page URL, your server and CDN logs, analytics reports that keep full URLs, and the ttclid cookie once the Pixel has read it. TikTok only appends it to the landing page of the ad. The next page a shopper opens won't have it unless your site carries it forward or stores it.

---

What are the ttclid and _ttp cookies?

TikTok's Pixel sets two first-party cookies that matter for matching. ttclid holds the click ID: TikTok's guide says the Pixel parses it from the landing URL and stores it as a first-party cookie on your domain under the same name. _ttp identifies the browser rather than a click: when first-party cookies are on in your Pixel settings, TikTok stores a unique identifier in a cookie named _ttp on your domain. In Meta's terms, ttclid plays the part of _fbc and _ttp the part of _fbp.

Source: TikTok's cookie specifications and Send TikTok Cookie guide, checked October 24, 2026.

TikTok lists every one of these with a lifetime of 13 months from the last date it was used. First-party cookies are on by default and can be turned off in the Pixel settings; if you turn them off, no new ones are set and existing ones run until they expire. Shopify is on TikTok's list of platforms eligible for both first- and third-party cookies.

Unlike Meta's _fbc, TikTok documents no prefix or timestamp format for these values. Send them as stored.

---

How do you send ttclid with the Events API?

You add it to the user object of each web event you send to POST https://business-api.tiktok.com/open_api/v1.3/event/track/. TikTok's guide says it is "strongly recommended" to send ttclid back through the Events API for all events from your website, page views and add-to-carts as well as purchases.

"user": {
  "ttclid": "E.C.P.v3fQ2RHacdksKfofPmlyuStIIHJ4Af1tKYxF9zz2c2PLx1Oaw15oHpcfl5AH",
  "ttp": "UqBuLHl7TuWsDXUu-ViOGOLA5YP",
  "email": "<SHA-256 of the trimmed, lowercased email>",
  "phone": "<SHA-256 of the E.164 phone number>",
  "external_id": "<SHA-256 of your customer ID>",
  "ip": "203.0.113.7",
  "user_agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) ..."
}

TikTok's web setup guide requires SHA-256 hashing for email, phone and external_id. It lists no hashing for ttclid or ttp, and says to send ip and user_agent unhashed. Our guide to hashed emails covers the normalization step most often done wrong.

Where does your server get the ttclid?

TikTok's guide gives three options and says to use at least one:

1. Keep it in the URL. If ttclid stays on the URL as the shopper moves through the site, send the full URL in page.url and the API parses the click ID from it.
2. Read the Pixel's cookie. With the TikTok Pixel installed, read the ttclid cookie from the HTTP cookie header on your server, or read it in the browser and pass it to your server.
3. Store it yourself. Parse ttclid from the landing URL and keep it in a cookie or local storage. TikTok recommends a lifetime of 28 days or more, and replacing the stored value whenever a newer ttclid arrives.

TikTok also describes an optional fourth step for cross-device journeys: keep a table that maps ttclid to an email or external ID, so a shopper who clicks on one device and buys on another still carries the click.

How do the Pixel and the Events API avoid counting twice?

With a shared event_id. TikTok's deduplication guide says it deduplicates on the Pixel ID, the event name and event_id: it keeps the first event and discards copies received within 48 hours, and merges data from a copy that arrives within 5 minutes. If you send no event_id, it falls back to matching on _ttp within a 5-minute window, and that fallback only ever drops the server copy. Meta's rules are similar; see our guide to Meta event ID deduplication.

---

How long is a ttclid useful?

As long as the click-through window on the ad group. The web setup guide says the ttclid valid period is the same as the click-through window you set in Attribution Manager, and TikTok handles expiry on its side. Several clocks run at once, and the shortest one wins:

Sources: TikTok's attribution windows and how to set them, the cookie specifications and Send TikTok Click ID guide above, and WebKit's ITP 2.1 and ITP 2.2 posts, checked October 24, 2026.

TikTok says allowing cookies doesn't change your conversion windows, so the 13-month lifetime doesn't stretch the click's validity. Safari shortens things the other way: a cookie written by a browser script is capped at seven days. A Safari shopper who clicks today and comes back to buy on day ten under a 14-day window can arrive with no ttclid cookie at all, unless your server stored the click.

Why does ttclid go missing on Shopify?

The click ID exists in one place, the landing URL, and is needed in another, the purchase event, sometimes days later. These are the gaps we can trace to TikTok's, Shopify's and Apple's own documentation.

The in-app browser

TikTok says ad clicks often open the page inside TikTok's in-app browser. Apple's developer documentation notes that on iOS each app has its own cookie store, so a ttclid cookie set inside TikTok isn't there when the same person opens your store in Safari later. Unless the click was tied to an email or customer ID before they left the app, the purchase in Safari arrives without it.

Redirects between the ad and the page

TikTok appends ttclid to the ad's landing URL only, so every hop before your page has to keep the query string. Link shorteners, geo or language redirects and old product URLs that 301 to new ones can each drop it. Upstack's TikTok setup docs give the same advice for a low match rate: link ads straight to your storefront so the click ID lands in the URL. The redirect test in our fbclid guide works the same way for ttclid.

Consent

TikTok requires advertisers to give notice and get consent where the law requires it, and to make the site stop setting and using cookies when a person declines. Shopify says that when its cookie banner is active in a region, data from visitors there is collected only after they consent. A shopper who declines or ignores the banner leaves no ttclid cookie behind. That's the setup working as intended. What you may store and send without consent depends on where your shoppers are, and this isn't legal advice.

Cleaning the URL too early

TikTok's guide includes a script that deletes ttclid from the address bar, with a comment to add it before the Pixel tag. If it runs before the Pixel and your own capture have read the URL, the click is gone for good. Clean the URL only after both have stored it.

First-party cookies turned off

If someone switches off first-party cookies in the Pixel settings, the ttclid and _ttp cookies stop being set. TikTok's cookie guide notes that this option won't give the Pixel its full matching and attribution capabilities.

---

How do you keep ttclid for server events?

1. Capture it on landing. Read ttclid from the URL on your server or with a first-party script on the first page view, and keep it for the whole session, as TikTok recommends.
2. Store it with the session and the customer. Once the shopper gives an email, signs in or checks out, attach the ttclid to that record, and replace it when a newer click arrives.
3. Send ttclid and ttp with every web event, exactly as received, not only with the purchase.
4. Add hashed email, phone and external ID, plus IP and user agent, so TikTok can still match the event when the click ID is missing.
5. Share one event_id between the Pixel and the Events API for each event.
6. Never make one up. Only send a ttclid for a shopper who arrived with one. A copied or placeholder value tells TikTok an ad drove a sale it didn't.

The rest of the TikTok setup, from Pixel install to attribution settings and scaling, is in our TikTok ads tracking guide for Shopify.

Upstack Signal handles the capture and the sending for Shopify stores. Its TikTok Events API docs say TikTok click IDs captured by the Upstack Pixel are included on the events it forwards, along with email, phone and external ID hashed with SHA-256 and a shared event_id. The same docs say to turn off Shopify's own TikTok data sharing first, because Shopify's events don't carry a matching event_id and TikTok can't deduplicate them.

---

How do ttclid, fbclid and gclid compare?

The Meta column is from the fbclid guide linked above, and the Google column from our guide to gclid, gbraid and wbraid.

---

Frequently asked questions

Is it safe to remove ttclid from a URL?

For a link you're sharing, yes. TikTok says you can remove it in code the way you manage other query parameters. On your own store, remove it only after the Pixel and your server have stored it, because once it's gone that click can't be recovered.

How long does the ttclid cookie last?

TikTok lists ttclid with a lifetime of 13 months from last use, but the click only counts inside your ad group's click-through window of 1, 7, 14 or 28 days. In Safari, a cookie written by script is capped at seven days, so store the value on your server too.

Should I hash ttclid before sending it to the Events API?

No. TikTok's field list requires SHA-256 hashing for email, phone and external ID, and lists none for ttclid or ttp. Send the click ID exactly as it arrived and don't truncate it.

What's the difference between ttclid and _ttp?

ttclid identifies one ad click and only exists after a visit from a TikTok ad. _ttp is a unique identifier the Pixel stores for the browser when first-party cookies are on. Send both, as user.ttclid and user.ttp.

---

Key takeaways

• ttclid is TikTok's click ID, added to your landing URL when someone clicks a TikTok ad.
• The Pixel stores it in a first-party ttclid cookie; _ttp identifies the browser. Send them as user.ttclid and user.ttp, unhashed.
• A click only counts inside the ad group's click-through window of 1 to 28 days, whatever the cookie lifetime says.
• In-app browsers, redirects, consent, early URL cleaning and Safari's cookie cap all separate the click from the order.
• Capture it on landing, store it with the customer, send it with every event and never invent one.

See how Upstack Signal captures ttclid and sends it with your Shopify events to the TikTok Events API.