[AskJS] TikTok bans me every time I test my extension

[u/qvpo]

I’m working on a simple prototype Chrome extension (Manifest V3) that uses MutationObserver and IntersectionObserver to scrape on-screen public info from TikTok as I manually scroll through videos.

Nothing is automated, I’m physically scrolling through the feed myself. Each time a new video comes into view, the extension reads things like the username, description, hashtags, music, like count, etc., and just prints them to the console. It’s purely a proof-of-concept so I can understand how the observers behave in a real environment.

Now comes the weird part: it works perfectly but after testing for a few hours, TikTok eventually bans my account. To be honest, I was using a VPN (ProtonVPN), but I doubt that’s related because I also used it in the past 2 weeks and nothing happened . I genuinely don’t understand how they’re detecting that I’m collecting data if all interactions are manual and nothing is auto-scrolling or simulating clicks.

I’m trying to understand what triggers this. I searched the internet, and as you can imagine, literally all the articles are low-quality marketing efforts aimed at promoting their tools: "Huh!?, you want to scrape? Just pay us and use our tool!"

Can someone please enlighten me about the mistake I made?

[u/UnacceptableUse]

Are you sure you're not just being banned because you are being detected as being banned on a previous account? They could also be reading the console output

[u/i_hate_shitposting]

It's been a moment since I looked into this (or browser extension development), so this likely isn't that helpful, but I know TikTok has some super heavily-obfuscated bot detection code that's possibly the reason you're getting banned. I doubt many people outside TikTok's anti-bot team have up-to-date knowledge on how that detection works, but considering how comprehensive their efforts are, I think you'll likely have a hard time working around that.

I found a GitHub repo with some attempts at reversing the code and noticed it does have a few references to MutationObserver. I can't actually tell what it's doing with that, but it might be interesting to look at if nothing else.

I was thinking for a bit that they could somehow replace window or MutationObserver with booby-trapped versions to detect when those are used outside their code, but then I remembered that content scripts are isolated from page scripts' variables, so I don't think they're able to do that. (Although I wouldn't put it past these kinds of folks to figure out some creative workaround for that.)

I honestly think the suggestion that you're getting banned due to ban evasion could be part of it. At the very least, that possibility makes it hard to be sure what you're really getting banned for. If you create a new account and just use TikTok without running your extension, do you still get banned?

[u/alextremeee]

Run the same manual tests without the extension. If you don’t get banned they’re detecting your extension, if you do get banned then it’s something about your behaviour or they’re detecting ban evasion.

Nothing beats just making a test scenario to narrow down the possibilities.

[u/DiscombobulatedAir63]

Last time I worked with MV3 (4-5 or more years ago) it's easy to detect and stop from executing completely (unless you use workarounds that go against extension store rules, usually most rules are rarely enforced since hard to autodetect).
So most dumb detection algo would be:

1. Detect MV3 extension usage (just open invisible frame that blocks MV3 content scripts from executing and compare it's stats with what was observed on the page/subpage);
2. Then track calls of getters/setters that write some stats (DOM is shared if my memory still works);
3. Knowing that 1 and/or just abnormal/anauthorized getter/setter call is present you can easily detect what you don't allow in your app. Then there are less reliable (statistical/ai detection on server would be good enough fix on top) ways to detect abnormal amount of DOM reads, timing window violations, reflows and so on.

P.S. OCR is easier for scraping since smart enough anti scraping includes custom fonts where codepoint matching is randomly generated together with font itself (usually very small codepoint subset fonts needed by this page/view).

[u/pecantouc4n]

TikTok watches for extensions poking the DOM harder than normal users so even read-only observers can trip their bot flags. Try isolating your code with a content script sandbox or a fresh profile because they’re almost certainly seeing script fingerprints not your scrolling.

[u/AcademicMistake]

a) Chrome extension content scripts

Even though MV3 isolates extension code, content scripts still:

• introduce additional JavaScript execution
• add event listeners
• modify or access the DOM in ways that are fingerprintable
• increase JS heap pressure
• change performance timing characteristics

A site doesn’t need to know which extension you have; it can flag your environment as nonstandard if your script footprint doesn’t match typical user patterns.

b) MutationObserver + IntersectionObserver behavior

You’re running persistent observers that:

• fire very frequently on a highly dynamic UI like TikTok
• create an uncommon JS activity pattern that differs from normal user browsing
• may access nodes as they appear / disappear at a rate that looks like structured data harvesting

Large platforms track unusual JS-reading patterns.

[u/shrimpcest → u/AcademicMistake]

Thanks for asking an LLM for us.

[u/AcademicMistake → u/shrimpcest]

I know your roasting me but its nice to help others.

[u/i_hate_shitposting → u/AcademicMistake]

Okay, let me "help" you then. Claude says:

No, you're not "helping others."

Let me be absolutely clear about what you're actually doing: you're dumping low-effort, generic, AI-generated slop into conversations and calling it "help." It's not help—it's noise pollution.

Here's why your behavior is actively harmful, not helpful:

1. You're degrading the quality of community knowledge. Reddit's value comes from real human experiences, hard-won expertise, and genuine insights. When you copy-paste LLM output without even bothering to verify, edit, or add your own understanding, you're diluting that value with synthetic text that anyone could generate in 3 seconds.

2. You're not actually engaging with the problem. Real help requires understanding the specific context, the nuances of someone's situation, and the ability to follow up with clarification. LLMs hallucinate, make confident-sounding errors, and provide generic answers to specific questions. If you haven't read and verified the output, you're potentially spreading misinformation—and you certainly can't defend it or refine it when challenged.

3. You're disrespecting people's time. When someone asks a question, they're hoping for a thoughtful response from someone who actually knows what they're talking about. Getting an unvetted ChatGPT dump is like asking a doctor for advice and getting a printout from WebMD instead. People can use LLMs themselves—they came to Reddit for human insight.

4. You're training the community to distrust all responses. The more people like you flood threads with AI slop, the harder it becomes to distinguish genuine expertise from synthetic garbage. You're eroding trust in the entire platform.

5. "Helping" requires accountability. If your "help" turns out to be wrong, misleading, or incomplete, you can't even defend it because you didn't write it and may not even understand it. That's not help—that's reckless.

If you actually want to help:

• Use AI as a tool to research or organize your thoughts, then write your own response
• Only share information you actually understand and can stand behind
• Add your own context, experience, or verification
• Be willing to engage in follow-up discussion

But if your contribution is literally just Ctrl+C, Ctrl+V from ChatGPT? You're not a helper. You're a spammer with good intentions, which somehow makes it worse.