> Complete GDPR compliance guide for Kartra: cookies, consent management, US data transfers, DPIA considerations and legal basis under Art. 6 GDPR. > > Canonical: https://www.flowconsent.com/en/services/marketing/kartra Marketing # Kartra Marketing · [Official website](https://home.kartra.com) Kartra is a US all-in-one marketing platform combining funnels, email marketing, membership sites, helpdesk, video hosting and affiliate management for solopreneurs and small businesses. [Block Kartra until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=marketing) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Marketing](https://www.flowconsent.com/en/services/marketing) - Consent Marketing - Prior consent Required - Documented cookies 5 - Third-party domains 5 - Servers United States (Genesis Digital LLC, Los Angeles, AWS US) Overview ## What does Kartra do? ## What is Kartra Kartra is an all-in-one online marketing and business platform created by Genesis Digital LLC, headquartered in Los Angeles, California. Founded in 2018 by Andy Jenkins and Mike Filsaime, it bundles sales funnels, email marketing automation, membership sites, helpdesk ticketing, video hosting, affiliate management, calendar booking, online courses and surveys into a single hosted environment. Kartra is primarily used by solopreneurs, coaches, course creators and small businesses to manage their entire customer journey from lead capture to recurring billing without juggling separate tools. ## Data collection and cookies Kartra deploys JavaScript tags on funnel pages, membership areas and checkout flows, and embeds tracking pixels in marketing emails. It sets cookies such as \_kartra\_session for active user sessions, kartra\_visitor for cross visit identification with a typical 12 month duration, kartra\_funnel\_\* for funnel attribution and kartra\_lead\_\* for prospect identification. Data collected includes IP address, browser fingerprint, page views, email opens and clicks, video watch time, form submissions, purchase history, support tickets and membership activity. ## GDPR and ePrivacy obligations Under Art. 5(3) of the ePrivacy Directive transposed in national cookie laws, the storage of Kartra tracking cookies on a visitor device requires prior informed consent. The processing of behavioural data, email engagement and lead scoring relies on Art. 6(1)(a) GDPR (consent), while membership access and payment processing rely on Art. 6(1)(b) GDPR (performance of contract). The controller must inform users about the categories of data, retention periods, transfer to the United States and the right to withdraw consent at any time under Art. 7(3) GDPR. ## Consent management Kartra tracking scripts and email pixels should only fire after explicit opt in collected through a Consent Management Platform. Block the Kartra JavaScript snippet by default, load it conditionally when the marketing or analytics category is accepted, and disable email open tracking for recipients located in the EEA who have not consented. Maintain a consent log linking each lead record to the timestamp, version of the privacy notice and granular choices made. ## International transfers to the United States All Kartra processing takes place on AWS infrastructure located in the United States. Transfers from the EEA must rely on Standard Contractual Clauses under Art. 46(2)(c) GDPR. Following the Schrems II ruling (C-311/18), the controller must perform a Transfer Impact Assessment evaluating US surveillance laws (FISA 702, EO 12333) and document supplementary measures such as encryption in transit, pseudonymisation of lead identifiers and contractual safeguards. ## Practical compliance steps Sign a Data Processing Agreement with Genesis Digital LLC, maintain a record of processing activities under Art. 30 GDPR, list all Kartra cookies in the cookie policy with duration and purpose, configure granular consent in your CMP, complete a Transfer Impact Assessment, define retention periods for leads and customers, train staff on data subject rights (access, erasure, portability under Art. 15 to 20 GDPR) and review the configuration whenever Kartra adds new tracking features. Compliance ## Kartra and the GDPR Kartra is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent (Art. 6(1)(a) GDPR) for marketing emails, tracking cookies and behavioural analytics; performance of contract (Art. 6(1)(b) GDPR) for member access and payment - Risk level medium - Applicable regulations GDPR, ePrivacy Directive (Cookie Law), CCPA ### Impact assessment (DPIA) A Data Protection Impact Assessment is recommended when Kartra is used for large scale behavioural tracking across funnels, membership areas and email campaigns. Key risk areas: combination of email engagement data with funnel conversion tracking, profiling of leads through tags and scoring, international transfers to the United States on AWS, retention of customer data in membership sites, processing of payment data through Stripe, PayPal and Authorize.net. Document the legitimate purposes, perform a Transfer Impact Assessment for US flows, evaluate the necessity and proportionality of behavioural profiling, and define clear retention periods for lead, customer and member records. ### Sample text for your banner > We use Kartra to operate our sales funnels, send marketing emails and manage our membership area. With your consent, Kartra sets cookies to track your visits across our funnel pages, attribute conversions and personalise our email communications based on your engagement. Your data may be transferred to the United States where Kartra is hosted on AWS, under Standard Contractual Clauses. You can withdraw your consent at any time through our cookie preference centre. Cookies and trackers ## What Kartra sets and contacts - Tracking method JavaScript tag (funnels, membership, email marketing) and email tracking pixel - Server location United States (Genesis Digital LLC, Los Angeles, AWS US) - Data transferred outside the EU Kartra processes data on AWS infrastructure in the United States. International transfers are governed by Standard Contractual Clauses under Art. 46(2)(c) GDPR and require a Transfer Impact Assessment. ### Cookies set (5) | Name | Type | Duration | Purpose | | ------------------ | ---------- | --------- | -------------------------------------------------------------------------------------------------------------------------- | | \_kartra\_session | session | Session | Maintains the active user session on Kartra pages, funnels and membership areas during a visit. | | kartra\_visitor | persistent | 12 months | Identifies unique visitors across visits for funnel attribution and lead tracking. | | kartra\_funnel\_\* | persistent | 6 months | Tracks the visitor journey through specific sales funnels and attributes conversions to the correct funnel and step. | | kartra\_lead\_\* | persistent | 12 months | Identifies leads who have submitted forms or interacted with email campaigns, linking browser activity to the lead record. | | kartra\_affiliate | persistent | 60 days | Stores affiliate referral identifiers to attribute commissions in the Kartra affiliate management module. | ### Third-party domains contacted (5) - `kartra.com` - `app.kartra.com` - `cdn.kartra.com` - `members.kartra.com` - `t.kartra.com` Questions ## Frequently asked questions about Kartra Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Which cookies does Kartra set on visitor browsers? Kartra installs several first party cookies including \_kartra\_session for active user sessions, kartra\_visitor for cross visit identification with a typical 12 month duration, kartra\_funnel\_\* for funnel attribution and kartra\_lead\_\* for prospect identification. Email campaigns add tracking pixels that record opens and clicks. All these cookies are classified as marketing or analytics and require prior consent under Art. 5(3) of the ePrivacy Directive. ### Is prior consent required before loading Kartra scripts? Yes. Kartra tracking scripts and email pixels qualify as non essential technologies. They must be blocked by default and only loaded after the user has accepted the marketing or analytics category in a Consent Management Platform. The consent must be specific, informed, freely given and unambiguous as required by Art. 4(11) and Art. 7 GDPR. ### What is the legal basis for processing data through Kartra? Two legal bases apply. Consent (Art. 6(1)(a) GDPR) covers marketing emails, tracking cookies, behavioural analytics and lead scoring. Performance of contract (Art. 6(1)(b) GDPR) covers membership access, course delivery and payment processing through Stripe, PayPal or Authorize.net. Each purpose must be documented separately in the record of processing activities. ### How are data transfers to the United States handled? Kartra is operated by Genesis Digital LLC in Los Angeles and hosted on AWS US infrastructure. Transfers from the EEA rely on Standard Contractual Clauses under Art. 46(2)(c) GDPR. Following Schrems II (C-311/18), controllers must complete a Transfer Impact Assessment evaluating US surveillance laws (FISA 702, EO 12333) and document supplementary measures such as encryption and pseudonymisation. ### When is a DPIA required for Kartra? A Data Protection Impact Assessment is required under Art. 35 GDPR when Kartra is used for systematic behavioural profiling of leads or members, large scale processing, or combination of email engagement, funnel tracking and payment data. The DPIA should cover risks of profiling, US transfers, retention in membership areas and payment processing through third party gateways. ### How do I implement Kartra in a GDPR compliant way? Block the Kartra JavaScript snippet by default in your tag manager, integrate a Consent Management Platform that conditionally loads the script after opt in, disable email open tracking for non consenting EEA recipients, sign a Data Processing Agreement with Genesis Digital LLC, declare all cookies in your cookie policy, document a Transfer Impact Assessment and provide a clear withdrawal mechanism in your preference centre. ### What are GDPR friendly alternatives to Kartra? European or EU hosted alternatives include Systeme.io (France, EU hosting), ConvertKit for email marketing, Kajabi for courses and membership (US but with strong DPA), GoHighLevel for agencies and ClickFunnels for funnels. None of these are fully exempt from international transfer rules, so each must be evaluated against the specific use case and EEA hosting options. ### What must I include in my cookie policy for Kartra? List each Kartra cookie by name (\_kartra\_session, kartra\_visitor, kartra\_funnel\_\*, kartra\_lead\_\*), its purpose (session, attribution, lead identification), its duration (session or up to 12 months for kartra\_visitor), the data controller (your organisation), the processor (Genesis Digital LLC) and the transfer destination (United States, AWS). Include a direct link to the consent preference centre. Same category ## More services: Marketing [See the whole category](https://www.flowconsent.com/en/services/marketing) ### [Progreda](https://www.flowconsent.com/en/services/marketing/progreda) [Progreda is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Progreda enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Progreda empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/marketing/progreda) [Marketing](https://www.flowconsent.com/en/services/marketing/progreda) · ### [Nift](https://www.flowconsent.com/en/services/marketing/nift) [Nift is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Nift supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Nift ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/marketing/nift) [Preferences](https://www.flowconsent.com/en/services/marketing/nift) · ### [Emanda](https://www.flowconsent.com/en/services/marketing/emanda) [Emanda is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Emanda enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Emanda empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/marketing/emanda) [Marketing](https://www.flowconsent.com/en/services/marketing/emanda) · ### [user.com](https://www.flowconsent.com/en/services/marketing/user-com) [user.com is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. user.com provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, user.com helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/marketing/user-com) [Marketing](https://www.flowconsent.com/en/services/marketing/user-com) · ### [Quoli](https://www.flowconsent.com/en/services/marketing/quoli) [Quoli is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Quoli supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Quoli ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/marketing/quoli) [Preferences](https://www.flowconsent.com/en/services/marketing/quoli) · ### [Smarter Click](https://www.flowconsent.com/en/services/marketing/smarter-click) [Smarter Click is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Smarter Click supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Smarter Click enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/marketing/smarter-click) [Marketing](https://www.flowconsent.com/en/services/marketing/smarter-click) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)