Provider
TikTokSee all TikTok cookies →CSRF protection token issued by TikTok. Although strictly necessary for TikTok-side interactions, on a third-party site it appears only when a TikTok video embed loads — making it part of the social-plugin tracking stack.
Session
TikTok Information Technologies UK Ltd.
tt_csrf_token is a social media cookie. Under Art. 5(3) ePrivacy Directive and the GDPR, it must not be set before the visitor has given prior, informed, freely-given consent.
If your scanner finds tt_csrf_token on a page before the visitor interacts with your consent banner, that's a violation — the cookie loaded without a legal basis.
Fix: gate the script that sets this cookie behind your CMP, so it only fires after the relevant consent category is accepted.