TikTok for Developers: the Privacy Policy URL and the ownership verification that comes with it
By Paul Cranmer, Founder · Last verified October 2026 · TikTok for Developers · Manage apps → URL properties
TikTok's app setup asks for a Terms of Service URL, a Privacy Policy URL and a Web or Desktop URL, and its documentation adds a step most stores do not have: before submitting your app for review, you must verify URL properties for all URLs in your app configuration. Apps created after September 9, 2024 must verify the Terms of Service URL, the Privacy Policy URL and the Web or Desktop URL; apps using the Content Posting API or Link Sharing must verify regardless of age. Verification is by domain or by URL prefix with a signature file you upload to that URL, which decides where the policy can live. This page gives the field path and the honest answer on hosting.
Who this is for
- Developers registering a TikTok app (Login Kit, Content Posting API, Display API) after September 2024
- Teams whose review is blocked on unverified URL properties
- Agencies building TikTok integrations for clients
Not for
- TikTok Ads lead generation forms (an Ads Manager field with no ownership check; see the lander)
- TikTok Minis and mini games, which have their own listing rules
What the platform requires
- App configuration fields: Terms of Service URL, Privacy Policy URL, Web or Desktop URL.
- Apps created after September 9, 2024 must verify the Terms of Service URL, Privacy Policy URL and Web or Desktop URL; apps using the Content Posting API upload URL or Link Sharing URL must verify them regardless of when the app was created.
- Verification happens on the app page: URL properties → Production mode → Verify properties, by domain (domain and subdomain) or by URL prefix (download a signature file and upload it to your URL).
- Verification must be completed before submitting the app for review; TikTok's guidelines also say to disclose your app's Terms of Service and Privacy Policy and to verify ownership of all configurations with a URL.
Get a live URL first
Honest answer first: because TikTok verifies that you own the policy's domain or URL prefix, a page hosted on privacypolicyurl.com cannot pass that check for your app. Use the wizard to generate the policy text (API/SDK, free), publish it on your own domain, and verify that domain. Our hosted URL still works everywhere that does not verify ownership, such as TikTok's ads lead forms.
Generate the policy text for your TikTok app (free)Step-by-step: paste your privacy policy URL
- Generate the policy and publish it on your domain. Run the wizard as API/SDK with the TikTok data your app reads (profile, videos, posting). Copy the policy text onto a page on your own domain, for example /privacy, served over HTTPS.
- Enter the three URLs in the app configuration. developers.tiktok.com → Manage apps → your app → Terms of Service URL, Privacy Policy URL, Web or Desktop URL. Save.
- Verify URL properties. On the app page click URL properties, confirm Production mode, then Verify properties. Choose domain verification (enter domain and subdomain) or URL prefix verification (download the signature file and upload it at that prefix).
- Submit for review. Only after every URL property shows verified. Unverified configurations block submission; fake or incomplete data can get the app rejected.
Field labels to look for
- Manage apps → app page
- URL fields plus the URL properties button for verification.
- Verify properties
- Domain or URL prefix; the prefix method needs a signature file at that URL.
- Sandbox
- Verification there is required only for the Content Posting API.
Common reasons the form fails
- Pointing the Privacy Policy URL at a domain you cannot place a signature file on
- Verifying a subdomain that differs from the URL entered
- Submitting for review before every URL property is verified
Where the policy must live
This is the one platform in our how-tos where the hosted URL alone is not enough. Generate the text here, host it on your domain, verify the domain. Keep our hosted URL for stores and ad platforms that do not check ownership.
FAQ
Does TikTok require a Privacy Policy URL for a developer app?
Yes, with a Terms of Service URL and a Web or Desktop URL, and for apps created after September 9, 2024 all three must pass URL ownership verification before review.
Can I use a hosted privacy policy URL on another domain?
Not for the verified field: TikTok checks that you own the domain or URL prefix. Host the policy on your own domain and verify it. Hosted URLs still work for TikTok ads lead forms.
How does URL prefix verification work?
You download a signature file from the Verify properties dialog and upload it at that URL prefix; TikTok fetches it to confirm ownership.