> GDPR compliance for ConvertKit and Kit: form embed cookies, US data transfers, CMP integration, double opt in and consent management for European creators. > > Canonical: https://www.flowconsent.com/en/services/marketing/convertkit Marketing # ConvertKit (now Kit) Marketing · [Official website](https://convertkit.com) ConvertKit, rebranded Kit in 2024, is the email marketing and creator monetisation platform built for newsletters, online courses, paid subscriptions and digital product sales. [Block ConvertKit (now Kit) until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=marketing) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Marketing](https://www.flowconsent.com/en/services/marketing) - Consent Marketing - Prior consent Required - Documented cookies 4 - Third-party domains 5 - Servers United States (ConvertKit LLC, Boise Idaho, AWS and Heroku) Overview ## What does ConvertKit (now Kit) do? ## **What is ConvertKit (now Kit)?** ConvertKit, rebranded Kit in 2024, is the email marketing and creator economy platform launched by Nathan Barry in 2013. It targets bloggers, podcasters, YouTubers and other creators with broadcast newsletters, automation sequences, landing pages, signup forms, paid subscriptions and a Commerce module for selling digital products. ConvertKit LLC is based in Boise, Idaho and runs on Heroku and Cloudflare infrastructure in the United States. ## **What data and cookies does ConvertKit collect?** ConvertKit drops first party cookies on the publisher domain when forms are embedded (ck\_subscriber\_id, \_ckid\_\*, \_convertkit\_subscribed), plus third party cookies on convertkitcdn.com and kit.com when assets are loaded from the CDN. The tracker captures form submissions, the subscriber email, the form ID, the referring URL and the user agent. Email open tracking uses a 1x1 pixel served by ConvertKit servers, while click tracking redirects through ck.click endpoints. ## **GDPR and ePrivacy implications** ConvertKit form cookies are not strictly necessary for the website to function. Article 5(3) of the ePrivacy Directive requires prior consent before they are stored. Newsletter sign ups require an article 6(1)(a) consent under the GDPR. Article 13 of the ePrivacy Directive imposes prior opt in consent for marketing emails to prospects. Soft opt in for existing customers is allowed for similar products with an easy opt out. ConvertKit and the creator are independent controllers for the subscriber relationship. ## **Consent management with ConvertKit** Block the ConvertKit form embed inside your CMP until consent is granted for the Marketing purpose. Use the GDPR setting in the ConvertKit form builder to require double opt in, capture consent proof (timestamp, IP, form version) and display an explicit consent checkbox separated from the submit button. Provide a one click unsubscribe and honour Subject Access and Erasure requests through the ConvertKit API. ## **Data transfers and US safeguards** ConvertKit (Kit) processes data in the United States on Heroku (Salesforce) and Cloudflare. EU subscriber data is therefore transferred outside the EEA. Transfers rely on the ConvertKit DPA, EU SCCs and the EU US Data Privacy Framework when ConvertKit LLC is certified. Document the transfer mechanism in your records of processing activities and inform subscribers in your privacy notice. ## **Practical compliance checklist** Sign the ConvertKit DPA with EU SCCs. Block the form embed behind your CMP. Use double opt in. Categorise ck\_subscriber\_id and \_ckid as Marketing. Provide explicit consent text in your form. Maintain a clear unsubscribe link in every email. Honour Subject Access and Erasure via the ConvertKit API. Update your cookie policy and privacy notice to identify ConvertKit LLC as processor with the US transfer disclosure. Compliance ## ConvertKit (now Kit) and the GDPR ConvertKit (now Kit) is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent (article 6(1)(a) GDPR) for newsletter subscribers and behavioural tracking, combined with article 5(3) ePrivacy for the tracker cookie. Performance of a contract for transactional emails strictly necessary to the service. - Risk level medium - Applicable regulations GDPR, ePrivacy Directive, TTDSG, LOPDGDD, French Data Protection Act, UK GDPR and PECR, CAN-SPAM and CASL ### Impact assessment (DPIA) A DPIA is recommended when ConvertKit is used for large scale behavioural automation, when subscriber lists exceed 50,000 contacts in Europe, when tagging enriches profiles with web tracking data, or when paid newsletters process credit card data via the Commerce feature. ### Sample text for your banner > We use ConvertKit (Kit) to send our newsletter and creator emails. ConvertKit identifies you across sessions, tracks email opens and clicks and shares subscriber data with its US infrastructure. Without your consent, no tracking cookie is set and you only receive transactional emails. Cookies and trackers ## What ConvertKit (now Kit) sets and contacts - Tracking method JavaScript form embed and tracking pixel with first party cookies, email open and click tracking, hosted on Heroku and Cloudflare - Server location United States (ConvertKit LLC, Boise Idaho, AWS and Heroku) - Data transferred outside the EU ConvertKit (now Kit) is operated by ConvertKit LLC, based in Boise, Idaho, with production infrastructure on Heroku (Salesforce, US) and Cloudflare. EU subscriber data is transferred to the United States under EU SCCs and the EU US Data Privacy Framework. ### Cookies set (4) | Name | Type | Duration | Purpose | | ------------------------ | --------- | -------- | ---------------------------------------------------------------------------------------------------------------- | | ck\_subscriber\_id | Marketing | 5 years | Identifies a returning ConvertKit subscriber on the publisher site to prefill forms and avoid duplicate signups. | | \_ckid\_\* | Marketing | 1 year | Persistent visitor identifier used by ConvertKit to attribute conversions and feed automation workflows. | | \_convertkit\_subscribed | Marketing | 5 years | Flag set when a visitor has subscribed to a ConvertKit form, used to hide signup forms on subsequent visits. | | ckforms\_visitor\_uuid | Marketing | 1 year | Unique visitor identifier set by ConvertKit forms for analytics and conversion attribution. | ### Third-party domains contacted (5) - `convertkit.com` - `convertkitcdn.com` - `kit.com` - `app.kit.com` - `f.convertkit.com` Questions ## Frequently asked questions about ConvertKit (now Kit) Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does ConvertKit set? ConvertKit drops first party cookies on the publisher domain when forms are embedded: ck\_subscriber\_id (subscriber identifier), \_ckid\_\* (ConvertKit visitor identifier), \_convertkit\_subscribed. Third party cookies are set on convertkitcdn.com and kit.com when assets load from the CDN. ### Is consent required for ConvertKit? Yes. The form embed cookies are not strictly necessary and trigger article 5(3) ePrivacy. Newsletter signups require article 6(1)(a) GDPR consent. Marketing emails to prospects require prior opt in under article 13 ePrivacy. ### What is the legal basis for ConvertKit? Consent for prospects, with double opt in and proof storage. Soft opt in for existing customers receiving similar products. Performance of a contract for transactional emails strictly necessary to a paid service. ### What about transfers to the United States? ConvertKit data is processed on Heroku and Cloudflare in the US. Transfers rely on the ConvertKit DPA, EU SCCs and the EU US Data Privacy Framework when ConvertKit LLC is certified. ### Do I need a DPIA for ConvertKit? A DPIA is recommended for lists over 50,000 EU subscribers, when behavioural automation enriches profiles via web tracking, for sensitive sectors (health, finance) or when Commerce processes card data. ### How do I implement ConvertKit compliantly? Enable the GDPR form setting. Use double opt in. Block the form embed behind your CMP. Sign the ConvertKit DPA with EU SCCs. Provide a one click unsubscribe and honour Subject Access and Erasure via the ConvertKit API. ### What are the alternatives to ConvertKit? Beehiiv (US, creators), Substack (US, paid newsletters), Ghost (open source, EU friendly), MailerLite, Brevo (EU hosted), ActiveCampaign, Klaviyo and Mautic for self hosted needs. ### How do I document ConvertKit in my cookie policy? List ck\_subscriber\_id, \_ckid and \_convertkit\_subscribed with domain, duration and purpose. Identify ConvertKit LLC as processor in the privacy notice. Describe the US transfers and safeguards. Link to the ConvertKit privacy notice and unsubscribe page. Same category ## More services: Marketing [See the whole category](https://www.flowconsent.com/en/services/marketing) ### [Plezi](https://www.flowconsent.com/en/services/marketing/plezi) [Plezi is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Plezi enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Plezi empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/marketing/plezi) [Marketing](https://www.flowconsent.com/en/services/marketing/plezi) · ### [Perfex CRM](https://www.flowconsent.com/en/services/marketing/perfex-crm) [Perfex CRM is a customer relationship management (CRM) platform that helps businesses organize, track, and nurture customer interactions across the entire lifecycle. It provides contact management, sales pipeline tracking, and automated workflows. Perfex CRM centralizes customer data from multiple touchpoints, enabling personalized experiences, faster deal closing, and improved retention. With reporting dashboards and integrations, Perfex CRM empowers data-driven relationship management.](https://www.flowconsent.com/en/services/marketing/perfex-crm) [Marketing](https://www.flowconsent.com/en/services/marketing/perfex-crm) · ### [Real Geeks](https://www.flowconsent.com/en/services/marketing/real-geeks) [Real Geeks is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Real Geeks offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Real Geeks empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/marketing/real-geeks) [Analytics](https://www.flowconsent.com/en/services/marketing/real-geeks) · ### [Agillic](https://www.flowconsent.com/en/services/marketing/agillic) [Agillic is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Agillic enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Agillic empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/marketing/agillic) [Marketing](https://www.flowconsent.com/en/services/marketing/agillic) · ### [CartRocket](https://www.flowconsent.com/en/services/marketing/cartrocket) [CartRocket is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. CartRocket integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, CartRocket helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/marketing/cartrocket) [Marketing](https://www.flowconsent.com/en/services/marketing/cartrocket) · ### [Shoutout Testimonial](https://www.flowconsent.com/en/services/marketing/shoutout-testimonial) [Shoutout Testimonial is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Shoutout Testimonial integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Shoutout Testimonial helps organizations maintain robust websites that meet user.](https://www.flowconsent.com/en/services/marketing/shoutout-testimonial) [Preferences](https://www.flowconsent.com/en/services/marketing/shoutout-testimonial) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)