In the early days of social advertising, you could target almost anyone based on third-party data.
In 2026, privacy regulations and operating system updates have built walls around user data. The most valuable asset an advertiser owns today is their First-Party Data.
TikTok Custom Audiences allow you to bridge the gap between your own customer records (CRM) and TikTok’s user base.
Get Up to $6,000 in Free TikTok Ad Credits
TikTok offers ad credit incentives for new advertisers, helping you test campaigns with a lower upfront cost.
By uploading a list of emails or phone numbers, you can find your existing customers on the app to retarget them or, more importantly, find people who look exactly like them.
However, TikTok is extremely strict about what you upload. Uploading the wrong type of data can lead to immediate ad account suspension.
This guide clarifies the legal and technical boundaries of Custom Audiences, ensuring you stay compliant while maximizing your match rates.
Table of Contents
Quick Summary
- The Golden Rule: You must own the data. You cannot upload lists purchased from data brokers or scraped from LinkedIn. You need explicit consent from the user.
- Mandatory Hashing: TikTok does not want raw data. All files must be hashed using SHA-256 encryption before or during the upload process to protect user privacy.
- The Match Rate Reality: Expect a match rate of 40% to 60%. People often use different emails for TikTok than they do for business transactions.
- Native is Safer: Engagement Audiences (people who watched your video) are 100% privacy-compliant because the data never leaves TikTok’s ecosystem.
- Exclusions are Key: The most profitable use of a Custom Audience is often excluding past purchasers to prevent wasted ad spend.
1. Data You CAN Use (The Green List)
To build a valid Custom Audience, the data must originate from a direct relationship between the user and your business.
Customer Files (CRM Data)
This is the most potent form of targeting. You can upload a CSV or TXT file containing:
Email Addresses: The most common identifier.
Phone Numbers: Often yields a higher match rate on TikTok than email, as accounts are mobile-linked.
Mobile Advertising IDs (MAIDs): IDFA (iOS) or GAID (Android).
Benefits: This allows you to create High-Value Lookalikes (LAL) based on your top 10% of spenders.
Website Traffic (Pixel & Events API)
You can target users based on actions taken on your site.
Page Views: Visited specific URLs.
Events: Added to Cart, Initiated Checkout, Completed Payment.
Time Spent: (If custom events are set up) Users who spent 3+ minutes on site.
Requirement: You must have the TikTok Pixel or Events API installed. In 2026, the Events API is necessary to capture data lost by browser blockers.
App Activity
If you have a mobile app, you can share data via specific Mobile Measurement Partners (MMPs) like AppsFlyer or Adjust.
Actions: App Install, Tutorial Completion, In-App Purchase.
Use Case: Re-engaging dormant users who installed the app but haven’t opened it in 30 days.
TikTok Native Engagement
This data lives inside TikTok, making it immune to iOS privacy blocks.
Video Viewers: Watched 25%, 50%, or 100% of your ads.
Lead Form Interactions: Opened a form or submitted a form.
Profile Visitors: Users who clicked on your brand profile.
2. Data You CAN’T Use (The Red List)
Attempting to upload these data types violates TikTok’s Terms of Service and can trigger permanent bans.
Purchased or Scraped Lists
You cannot buy a list of 10,000 Leads from a third-party vendor and upload it.
The Reason: You do not have the user’s consent to use their data for advertising. TikTok requires you to certify that you have the right to use the data.
Detection: TikTok’s systems analyze list quality. If a list has zero correlation to your brand or contains spam traps, it gets flagged.
Sensitive Category Data (Health & Finance)
While you can target broad interests, you cannot create Custom Audiences based on highly sensitive personal attributes without strict safeguards.
Health: You cannot upload a list named Diabetes Patients.
Finance: You cannot upload a list of Users in Bankruptcy.
Why: This violates discrimination policies and privacy ethics.
Data from Minors
You cannot target Custom Audiences towards users under the age of 18 (or 13, depending on the region).
The Filter: Even if your list contains data for a 16-year-old, TikTok will automatically filter them out of the ad delivery if your campaign settings are age-restricted correctly. However, knowingly uploading data of minors is a policy violation.
Unhashed PII (Personally Identifiable Information)
You generally cannot upload raw names or physical addresses without TikTok automatically hashing them. The system is designed to reject plain-text PII to prevent data leaks.
3. Technical Requirements: Hashing & Matching
When you upload a list, TikTok does not actually see the emails. It sees a cryptographic code.
The SHA-256 Standard
Before the data leaves your computer, it is transformed into a string of random characters using SHA-256 encryption.
Input: [email protected]
Output: a5d3… (long string)
The Process: TikTok takes its own user database, hashes it, and compares your string to their string. If they match, the user is added to the audience. If not, the data is discarded.
Improving Your Match Rate
A Match Rate is the percentage of your uploaded contacts that TikTok can find on its platform.
Average Rate: 40% – 60%.
How to Improve:
- Multiple Identifiers: Upload Email AND Phone Number in the same row. If the email doesn’t match, the phone number might.
- Clean Your Data: Remove spaces, standardize formats (e.g., add country codes to phone numbers like +1), and ensure all emails are lowercase before hashing.
- Recency: A list of customers from 2020 will have a low match rate. Use data from the last 180 days.
4. Strategic Use Cases for 2026
Once you have a compliant Custom Audience, how do you use it?
The Exclusion Strategy (Money Saver)
The most effective way to use a Customer List is to exclude it.
Scenario: You are selling a subscription.
Action: Create a Custom Audience of Active Subscribers. Exclude this audience from your New Sign Up campaigns.
Benefit: You stop wasting money showing ads to people who already pay you.
High-Value Lookalikes (LAL)
Don’t create a Lookalike of All Site Visitors. That includes accidental clicks.
Action: Filter your CRM for customers who have spent >$100 (or your high-ticket threshold).
Upload: Create a High LTV Custom Audience.
Create: Build a 1% Lookalike from this specific seed audience. This tells TikTok to find the top 1% of users who share traits with your whales.
The Win-Back Campaign
Target: Customers who bought 6+ months ago but haven’t returned.
Creative: We miss you. Here is 20% off your return order.
Logic: It is 5x cheaper to reactivate an old customer than to acquire a new one.
Explore these helpful articles next:
👉 TikTok Ads for B2B Brands: Does It Work?
👉 TikTok Dynamic Showcase Ads: eCommerce Personalization
👉 Targeting TikTok Users by Interest: Full List & Tips
👉 TikTok Ads Strategy for High-Ticket Products in New Year Sale
FAQ: TikTok Custom Audiences
What is the minimum list size for a Custom Audience?
You need at least 1,000 matched users to run an ad against a Custom Audience. Because match rates are 50%, you typically need to upload a raw list of 2,000+ contacts to hit this minimum threshold.
Can I use B2B emails for TikTok Custom Audiences?
Yes, but the match rate will be very low (often <20%). Most people sign up for TikTok with their personal Gmail/Yahoo/iCloud, not their corporate Outlook address. For B2B, phone numbers often work better if you have mobile data.
How often does the Custom Audience update?
It does not update automatically unless you use an API integration (like Zapier or a TikTok Marketing Partner). If you upload a CSV manually, it is static. You must re-upload a new CSV every week or month to keep the audience fresh.
Does TikTok share my customer list with other advertisers?
No. The data is hashed and siloed. It is used solely to match users for your ad account. TikTok does not add your customers to a general pool for competitors to target.
Why is my Lookalike Audience not populating?
If your seed Custom Audience is too small (under 1,000 matched users), the Lookalike cannot be generated. You must increase the size of the source list first.
Conclusion
Custom Audiences are the bridge between renting an audience and owning your growth.
In 2026, the brands that win are not the ones with the biggest budgets, but the ones with the cleanest data.
By strictly adhering to the First-Party Consent rule and utilizing multiple identifiers (Email + Phone) to boost match rates, you can leverage TikTok’s algorithm to find your next best customer based on the data of your current best customer.
Next Step: Export your Top 20% Customers by Spend list from your CRM today. Clean the data (format phone numbers), upload it to TikTok Audiences, and create a 1% Lookalike to test against your current broad targeting.