Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Klaviyo Reviews collects and displays product and customer reviews and ties on site behaviour to Klaviyo profiles for email and SMS marketing. A JavaScript tag and tracking pixel set first party cookies such as __kla_id to identify the visitor and attribute activity to a Klaviyo profile. Data is processed in the United States and the tracking is used for marketing, so prior consent is required under the GDPR and the ePrivacy Directive.
Klaviyo Reviews is the product review feature of the Klaviyo marketing platform. It collects ratings and written reviews from customers, displays them on product pages, and feeds review activity back into Klaviyo so that it can be used for email and SMS campaigns. Because it is part of Klaviyo, review collection sits alongside the wider Klaviyo tracking that links on site behaviour to marketing profiles.
The Klaviyo tag and tracking pixel set a first party cookie called __kla_id, supported by helper cookies in the _kla family, which identify the visitor and attribute browsing, clicks, and review activity to a Klaviyo profile. Klaviyo processes identifiers, email addresses, IP addresses, device and browser information, pages viewed, and purchase and review events. This activity is linked to identifiable contacts, so it is personal data used for marketing purposes.
The Klaviyo cookies are used for marketing analytics and profiling rather than a strictly necessary function, so Article 5(3) of the ePrivacy Directive requires prior consent before they are set. The linkage of browsing and review activity to identifiable profiles makes the processing personal data under the GDPR, which requires a lawful basis, transparency about profiling, and a record of processing activities.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
The Klaviyo tag must not load and the marketing cookies must not be set before the visitor accepts the marketing category in your consent management platform. Sending marketing email and SMS also requires a valid opt in under the GDPR and the ePrivacy Directive. Consent must be freely given, specific, informed, and as easy to withdraw as to grant, and pre ticked boxes or implied consent are not sufficient.
Klaviyo, Inc. processes data in the United States, so you must document the transfer under the Standard Contractual Clauses and the EU US Data Privacy Framework and sign the Klaviyo Data Processing Agreement. In practice, gate the Klaviyo tag behind your consent management platform, capture a clear marketing opt in for email and SMS, set sensible data retention, and list the Klaviyo cookies and their durations in your cookie policy.
Websites using Klaviyo Reviews must obtain user consent under GDPR regulations.
DPIA considerations
Klaviyo Reviews sets a persistent first party cookie (__kla_id) with a lifetime of around 2 years, links browsing, purchase, and review activity to identifiable Klaviyo marketing profiles, and processes data on US infrastructure. A DPIA should assess the scale of behavioural profiling for marketing, the combination of review, purchase, and browsing data, the international transfer to the United States, and retention periods, together with mitigations such as consent gating, double opt in for messaging, and shortened data retention.
Sample consent text
We use Klaviyo Reviews to collect and display product reviews and to personalise our email and SMS marketing. Klaviyo places cookies on your device to recognise your browser and link your activity to your marketing profile. These cookies load only after you accept the marketing category, and the data may be processed in the United States. You can withdraw your consent at any time through our cookie settings.
Third-party domains contacted
static.klaviyo.coma.klaviyo.comstatic-tracking.klaviyo.comfast.a.klaviyo.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| __kla_id | marketing | 2 years | Main Klaviyo cookie. Identifies the visitor and attributes browsing, purchase, and review activity to a Klaviyo marketing profile for email and SMS personalisation. |
| _kla_uid | marketing | 2 years | Helper cookie that stores a Klaviyo user identifier used to link activity across pages and sessions to the same profile. |
| _kla_session | marketing | Session | Helper cookie that stores session level tracking information so that on site events within a single visit are grouped correctly. |
Klaviyo Reviews uses cookies for user preferences — inform visitors with a consent banner.
Klaviyo sets a persistent first party cookie called __kla_id, which lasts about 2 years and identifies the visitor so that browsing, purchase, and review activity can be attributed to a Klaviyo profile. It is supported by helper cookies in the _kla family that store related tracking and session information.
Yes. The Klaviyo cookies are used for marketing analytics and profiling, not a strictly necessary function, so Article 5(3) of the ePrivacy Directive and the GDPR require prior, opt in consent before the tag loads. Sending email and SMS marketing also requires a separate, valid marketing opt in.
The storage and reading of the Klaviyo cookies relies on consent under the ePrivacy Directive, and the subsequent profiling and marketing relies on consent under Article 6(1)(a) of the GDPR. Legitimate interest is generally not available for the cookies, because consent is already required to place non essential marketing cookies.
Yes. Klaviyo, Inc. processes data on infrastructure in the United States. Transfers are covered by Standard Contractual Clauses and the EU US Data Privacy Framework, which you should reference in your privacy notice along with Klaviyo as a recipient.
A full DPIA is not always mandatory, but it is strongly recommended because Klaviyo profiles visitors for marketing, combines browsing, purchase, and review data with identifiable contacts, and transfers data to the United States. Document the purposes, data categories, retention, and safeguards, and reassess if you enable advanced segmentation or predictive analytics.
Load the Klaviyo tag only after the visitor accepts the marketing category in your consent management platform, and keep __kla_id and related cookies blocked until then. Capture a clear, separate opt in for email and SMS marketing, sign the Data Processing Agreement, set sensible data retention, and document the cookies in your cookie policy.
EU based or privacy focused review and marketing tools such as Trustpilot, Yotpo, or EU hosted email platforms can keep more data within the European Union. They do not always offer the same tight integration between reviews, profiles, and messaging, so the right choice depends on whether you need a unified Klaviyo profile or prefer EU data residency.
List the __kla_id cookie and the _kla helper cookies, with their purpose and duration, name Klaviyo, Inc. as a recipient, and disclose the transfer to the United States. Keep the entries in sync with a regular cookie scan so that new or renamed Klaviyo cookies are reflected accurately.