Continuous TikTok Surveillance: Inside the TikTrack User Monitoring Module
September 18, 2026
When you follow someone on TikTok, you see their public uploads, their occasional reposts, and whatever updates show up on your feed. What you don’t see is the continuous stream of raw event data running behind the scenes. That is where the User Monitoring module on TikTrack comes in.
User Monitoring Module Overview
- Automated Surveillance: Polls TikTok's API at fixed intervals to transform static profiles into real-time activity feeds without requiring follow requests or active accounts.
- Persistent Tracking: Uses the user's permanent, unique User ID (UID), ensuring tracking continues uninterrupted even if the account owner changes their
@username.
The TikTrack User Monitoring module showcasing the live tracking section
What Can Be Fetched
- Liking & Unliking Activity: Tracks real-time changes in total liked content and captures exact timestamps whenever a user likes or unlikes a video.
- Story Posting & Deletion: Instantly detects ephemeral story uploads, fetches direct CDN media links, and logs when stories are deleted before their standard 24-hour expiration.
- Video Privacy Settings: Detects state changes when a user changes a video's visibility settings (e.g., toggling a video from "Everyone" to "Friends Only" or "Private").
- Video Postings & Deletions: Monitors new public video uploads down to the second and logs video removals, archiving post metadata before the content disappears from the profile.
TikTok site settings and privacy configurations that users rely on for protection
What Cannot Be Fetched
- In-App Behavior: Screen time, watch history, or "For You" page feed interactions.
- Unpublished Content: Local drafts or unsaved media stored exclusively on the user's mobile device.
- Direct Messaging: Private DM text content, chat history, or real-time typing indicators.
- Device Telemetry: Local keystrokes or external app usage.
Privacy Impacts & Vulnerabilities
- Behavioral Profiling: Maps exact active hours, sleep schedules, and time zones based on time-stamped actions like likes, story posts, and video uploads.
- Bypassing Erasure: Permanently logs deleted videos, stories, and privacy state shifts before the user can pull them down completely.
- Inherent Privacy Limitations: In-app privacy toggles only restrict human app UI access; public API endpoints continue broadcasting numerical metric shifts and interaction metadata to automated scrapers.