FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Consent management

KIProtect (Klaro and Kodex)

EssentialOfficial website

KIProtect is a German privacy engineering company that publishes the open source Klaro consent management platform and the Kodex data anonymisation toolkit. Klaro stores user consent locally in a single first party cookie, Kodex applies pseudonymisation, tokenisation and differential privacy on structured data inside the customer infrastructure.

Block KIProtect (Klaro and Kodex) until consentScan my site
Overview

What does KIProtect (Klaro and Kodex) do?

What KIProtect Klaro and Kodex are

KIProtect GmbH is a Berlin based privacy engineering company. Its two flagship products are Klaro, an open source consent management platform distributed under a BSD licence, and Kodex, a pseudonymisation and anonymisation toolkit for structured data. Klaro is embedded into the customer website as a small JavaScript bundle, Kodex is integrated as a library or service inside data pipelines.

Cookies and data collected

Klaro stores the consent decision in a single first party cookie or localStorage item called klaro, containing a JSON object that lists the services the user has accepted or declined. No tracking identifier, no fingerprint and no behavioural data are collected by the CMP itself. Kodex never touches the browser, it processes records server side and outputs pseudonymised or anonymised values.

GDPR and ePrivacy implications

Klaro is the mechanism used to comply with Art. 7 GDPR and Art. 5(3) of the ePrivacy Directive, it does not itself require consent. Kodex helps fulfil the data minimisation principle in Art. 5(1)(c) GDPR and the data protection by design obligation in Art. 25 GDPR. Properly applied, Kodex can move a dataset out of scope of the GDPR by producing fully anonymous output.

Consent requirements

The Klaro cookie qualifies as strictly necessary under section 25(2) TTDSG and the corresponding national transpositions of the ePrivacy Directive, so it can be set before consent. Every service that Klaro gates, such as analytics, advertising or social plugins, must remain blocked until the user clicks accept in the consent banner.

Data transfers

By default no personal data leaves the customer infrastructure. Klaro is hosted on the customer domain or on a CDN under the customer control, Kodex runs on premise or in the cloud region chosen by the customer. KIProtect GmbH is established in Germany and any limited support flows stay inside the EEA.

Practical compliance steps

Configure Klaro to block every non essential service before consent, declare each service in the privacy policy, log consent server side if your jurisdiction requires demonstrable proof, and document the Kodex anonymisation parameters in the record of processing activities. Review the configuration every time a new third party tag is added to the site.

Compliance

KIProtect (Klaro and Kodex) and the GDPR

Legal basis
The Klaro consent cookie itself is strictly necessary under Art. 6(1)(f) GDPR and section 25(2) TTDSG because it stores the user choice required to comply with the cookie law. The Kodex anonymisation pipeline typically relies on Art. 6(1)(c) GDPR (legal obligation to apply data minimisation) or Art. 6(1)(f) GDPR (legitimate interest in protecting personal data).
Risk level
low
Applicable regulations
GDPR, ePrivacy Directive (Cookie Law), TTDSG, ISO 27001

Impact assessment (DPIA)

A formal DPIA is rarely required for Klaro because it acts as a privacy control rather than a data collection tool, the only personal data processed is the consent decision itself. A DPIA is recommended when Kodex is used on special category data under Art. 9 GDPR, on large scale behavioural datasets, or as part of an automated decision pipeline under Art. 22 GDPR. Document the purposes, the anonymisation parameters, and the residual reidentification risk.

Sample text for your banner

We use the Klaro consent manager to record your cookie preferences. The klaro cookie is strictly necessary and is set without consent under section 25(2) TTDSG and Art. 6(1)(f) GDPR. You can review or withdraw your choices at any time from the privacy settings link in the footer.
Cookies and trackers

What KIProtect (Klaro and Kodex) sets and contacts

Tracking method
Client side JavaScript consent management platform (Klaro CMP) plus optional Kodex data anonymisation toolchain. Klaro stores consent decisions in a first party cookie or localStorage item named klaro, no analytics identifiers are set by the CMP itself. The Kodex SDK runs server side for pseudonymisation, tokenisation and differential privacy of structured data.
Server location
Germany (KIProtect GmbH, Berlin). Klaro is open source and runs entirely on the customer infrastructure, no calls to KIProtect servers are made at runtime. Kodex can be self hosted on premise or in any cloud region the customer chooses, KIProtect SaaS offerings are hosted in Frankfurt on European providers.
Cookieless mode available
Yes

Cookies set (2)

NameTypeDurationPurpose
klarofirst party120 days (configurable)Stores the user consent decision as a JSON object listing each service that has been accepted or declined.
klaro-anonymousfirst partysessionOptional anonymous identifier used when the customer enables server side consent logging without cookies.

Third-party domains contacted (3)

  • kiprotect.com
  • klaro.kiprotect.com
  • heyklaro.com
Questions

Frequently asked questions about KIProtect (Klaro and Kodex)

Can't find your question? Write to us, we answer fast.

What cookies does Klaro set?

Klaro sets a single first party cookie or localStorage item called klaro that stores the consent decision as a JSON object listing each service the user has accepted or declined. No tracking identifier and no behavioural data are collected by the CMP itself.

Does the Klaro cookie itself require consent?

No. The klaro cookie is strictly necessary because it stores the user choice required to comply with the cookie law, so it is exempt from consent under section 25(2) TTDSG and equivalent provisions of the ePrivacy Directive.

What legal basis applies to Klaro and Kodex?

The Klaro cookie relies on Art. 6(1)(f) GDPR (legitimate interest in complying with the cookie law). Kodex anonymisation typically relies on Art. 6(1)(c) GDPR (legal obligation to apply data minimisation) or Art. 6(1)(f) GDPR when used to protect personal data in analytics.

Are data transferred outside the EU?

No. Klaro is a static JavaScript bundle hosted on the customer domain and Kodex runs inside the customer infrastructure, so no personal data reach KIProtect by default. KIProtect GmbH is established in Germany and any limited support data stays inside the EEA.

Is a DPIA required?

Generally no for Klaro alone, since it processes only the consent decision. A DPIA is recommended when Kodex is used on special category data, on large scale behavioural datasets, or as part of an automated decision under Art. 22 GDPR. Document purposes, anonymisation parameters and residual reidentification risk.

How do I implement Klaro correctly?

Declare every third party service in the Klaro configuration, set required to true only for genuinely strictly necessary tags, block all other scripts before consent, log consent server side if proof is required, and refresh the configuration whenever a new tracker is added to the site.

What are the alternatives to Klaro?

Other open source or commercial CMPs include Orejime, Cookiebot, Didomi, OneTrust, Usercentrics, Axeptio and Tarte au Citron. Klaro stands out because it is self hosted, has no telemetry, ships under a permissive licence and is published by a German privacy engineering company.

Do I need to mention Klaro in my cookie policy?

Yes. List the klaro cookie under strictly necessary cookies, explain that it stores the consent decision, document its duration (default 120 days) and refer to it as the mechanism used to comply with Art. 7 GDPR and the ePrivacy Directive.

Same category

More services: Consent management

See the whole category

Ultimate GDPR & CCPA

Ultimate GDPR & CCPA is a consent management platform (CMP) that helps websites comply with GDPR, CCPA, and global privacy regulations. It provides customizable cookie consent banners, preference centers, and automated compliance scanning. Ultimate GDPR & CCPA manages user consent across tracking technologies, generates compliance reports, and integrates with tag management systems. With geo-targeted policies and TCF 2.0 support, Ultimate GDPR & CCPA ensures worldwide privacy compliance.

Essential

Gravito

Gravito is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Gravito supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Gravito enables informed decisions that improve experience and drive results.

Analytics

iubenda

iubenda is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. iubenda supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, iubenda ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Essential

CookieFirst

CookieFirst is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. CookieFirst supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, CookieFirst ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Essential

Efilli

Efilli is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Efilli integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Efilli helps organizations maintain robust websites that meet user expectations and technical requirements.

Essential

Consent Manager

Consent Manager is a consent management platform (CMP) that helps websites comply with GDPR, CCPA, and global privacy regulations. It provides customizable cookie consent banners, preference centers, and automated compliance scanning. Consent Manager manages user consent across tracking technologies, generates compliance reports, and integrates with tag management systems. With geo-targeted policies and TCF 2.0 support, Consent Manager ensures worldwide privacy compliance.

Essential

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site