- start on device boot

- list of contacts / address book

- GPS location (browser can access location too if given permission ofc)

- list of devices accessible on local network (if tiktok really is a malware vector this would be a great way to scan users' homes for vulnerable IoT devices)

- list of other apps installed on device

Advertisers aren't just interested in bucketing you based off headline demographics like what videos you watch, they bucket you with people who have similar behaviors and extrapolate that you will like what they like, so they'll take as many dimensions as they can get to find similarities in behavior.

The user fingerprinting is also used to identify you on devices you're not logging in on.