diff --git a/pc/jsep_transport_controller.cc b/pc/jsep_transport_controller.cc
index bc7000f451..8d4eee0ff7 100644
--- a/pc/jsep_transport_controller.cc
+++ b/pc/jsep_transport_controller.cc
@@ -59,6 +59,13 @@ webrtc::RTCError VerifyCandidate(const cricket::Candidate& cand) {
     }
   }
 
+  // Disallow ICE-TCP with a private IP address.
+  if (cand.protocol() == cricket::TCP_PROTOCOL_NAME &&
+      cand.address().IsPrivateIP()) {
+    return webrtc::RTCError(webrtc::RTCErrorType::INVALID_PARAMETER,
+                            "candidate is TCP and has a private IP address");
+  }
+
   return webrtc::RTCError::OK();
 }