> Klaviyo and GDPR: email and SMS consent, on-site tracking cookies, US data transfers, the DPA and how to use Klaviyo lawfully for e-commerce in Europe. > > Canonical: https://www.flowconsent.com/en/services/marketing/klaviyo Marketing # Klaviyo Marketing · [Official website](https://klaviyo.com) Klaviyo is a US-based email and SMS marketing automation platform widely used by e-commerce businesses. It tracks on-site behaviour, segments audiences based on purchase history and browsing, and automates personalised email and SMS campaigns. For EU-facing e-commerce, Klaviyo presents significant GDPR obligations: valid opt-in consent is required for both marketing emails and on-site tracking cookies, all data is processed in the US requiring SCCs, and the combination of behavioural tracking and marketing profiling warrants careful compliance documentation. [Block Klaviyo until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=marketing) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Marketing](https://www.flowconsent.com/en/services/marketing) - Consent Marketing - Prior consent Required - Documented cookies 2 - Third-party domains 3 - Servers United States (Klaviyo is a US company with US-primary infrastructure) Overview ## What does Klaviyo do? ## **What is Klaviyo?** Klaviyo is a marketing automation platform focused on email and SMS, purpose-built for e-commerce businesses. It integrates deeply with Shopify, WooCommerce, Magento, and other e-commerce platforms to access purchase data, browse abandonment, cart abandonment, and product interaction history. Klaviyo uses this data to build detailed audience segments and trigger automated, personalised email and SMS flows. It is one of the most popular e-commerce marketing platforms, particularly among direct-to-consumer (DTC) brands. ## **Email and SMS consent under GDPR** GDPR requires freely given, specific, informed, and unambiguous consent for email and SMS marketing. For Klaviyo specifically: use a clear opt-in checkbox (not pre-ticked) at checkout or on signup forms, implement double opt-in to verify consent, record the consent timestamp and source, never import purchased or rented lists, and send a confirmation email that allows the subscriber to withdraw consent. SMS marketing requires a separate opt-in from email marketing. ## **On-site tracking and cookies** The Klaviyo JavaScript tag sets first-party cookies and tracks on-site visitor behaviour (page views, product views, cart additions) even before a visitor has identified themselves. This tracking requires consent under the ePrivacy Directive. Block the Klaviyo tag via your CMP until analytics consent is obtained. Without consent, Klaviyo should not be tracking anonymous visitor behaviour. ## **US data transfers and SCCs** All Klaviyo data is processed in the US. Sign the Klaviyo Data Processing Agreement (available from Klaviyo's privacy settings) which includes SCCs. Disclose the US transfer in your privacy policy. Configure your Klaviyo account with EU subscriber data only after DPA signature. ## **Practical compliance steps** Sign DPA and SCCs. Implement double opt-in for all EU subscribers. Record consent with timestamp and source. Block Klaviyo tracking tag until cookie consent. Configure unsubscribe flows that also delete contact data upon request. Add Klaviyo to your privacy policy and cookie notice. Never import contacts without documented consent. Implement a process for data subject erasure requests via the Klaviyo Profile deletion API. Compliance ## Klaviyo and the GDPR Klaviyo is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent (Art. 6(1)(a) GDPR) required for email marketing, SMS marketing, and on-site behavioural tracking cookies under the ePrivacy Directive. Marketing emails require valid opt-in consent. On-site tracking cookies must be blocked until analytics consent is obtained. - Risk level high - Applicable regulations GDPR, ePrivacy Directive, SCCs for US data transfers. Email marketing also subject to national spam laws (CASL, CAN-SPAM equivalent obligations under GDPR). ### Impact assessment (DPIA) A DPIA is recommended for large-scale e-commerce Klaviyo deployments that combine on-site behavioural tracking, purchase history profiling, and automated personalised marketing. The combination of detailed individual profiling for marketing purposes constitutes high-risk processing. ### Sample text for your banner > I agree to receive personalised email and SMS marketing from \[Brand]. I understand my purchase history and browsing behaviour may be used to personalise communications. I can unsubscribe at any time. See our privacy policy for full details. Cookies and trackers ## What Klaviyo sets and contacts - Tracking method JavaScript tracking script, email tracking pixels, on-site behavioural tracking, first-party cookies, SMS marketing, form tracking - Server location United States (Klaviyo is a US company with US-primary infrastructure) - Data transferred outside the EU Klaviyo is a US-based email and SMS marketing automation platform. All data is processed on US infrastructure. EU personal data transfers require Standard Contractual Clauses. Klaviyo provides a GDPR-compliant DPA and SCCs. ### Cookies set (2) | Name | Type | Duration | Purpose | | ----------- | ---------- | -------- | ------------------------------------------------------------------------------------------------------------ | | \_\_kla\_id | persistent | 2 years | Klaviyo visitor identifier linking on-site behaviour to email subscriber profiles for personalised marketing | | \_kl\_ | session | Session | Klaviyo session identifier grouping visitor interactions within a single browsing session | ### Third-party domains contacted (3) - `klaviyo.com` - `a.klaviyo.com` - `static.klaviyo.com` Questions ## Frequently asked questions about Klaviyo Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Does Klaviyo require GDPR consent for email marketing? Yes. Klaviyo email marketing to EU contacts requires valid consent: freely given, specific, informed, unambiguous, and documented. Use unchecked opt-in boxes, implement double opt-in, and record the timestamp and source of each consent. ### Do Klaviyo cookies require consent? Yes. Klaviyo sets first-party tracking cookies monitoring on-site behaviour. These require opt-in consent under the ePrivacy Directive. Block the Klaviyo tag in your CMP until analytics consent is given. ### Does Klaviyo require separate SMS consent? Yes. SMS marketing requires separate explicit consent from email. Collect SMS consent via a dedicated opt-in field and record it separately in Klaviyo. ### Does Klaviyo transfer data outside the EU? Yes. All Klaviyo data is processed in the US. SCCs are required. Sign the Klaviyo DPA in Account Settings. ### How do I configure double opt-in in Klaviyo? Go to Lists and Segments, select your list, click Settings, enable double opt-in. Klaviyo sends a confirmation email subscribers must click to verify. ### Can I import contacts from my e-commerce platform into Klaviyo? Only if those contacts provided valid marketing consent. Contacts who provided email for transactional purposes only have not consented to marketing. ### How do I handle erasure requests for Klaviyo? Delete the profile via the Klaviyo API. Document the deletion and respond to the data subject within 30 days. ### Are there EU-based alternatives to Klaviyo? Brevo (France), ActiveCampaign (EU data centre option), and Mailjet (France) offer EU data residency. Brevo is the most established Klaviyo alternative for e-commerce. Same category ## More services: Marketing [See the whole category](https://www.flowconsent.com/en/services/marketing) ### [CTAwidget](https://www.flowconsent.com/en/services/marketing/ctawidget) [CTAwidget is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. CTAwidget supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, CTAwidget ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/marketing/ctawidget) [Marketing](https://www.flowconsent.com/en/services/marketing/ctawidget) · ### [Mention Me](https://www.flowconsent.com/en/services/marketing/mention-me) [Mention Me is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Mention Me integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Mention Me helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/marketing/mention-me) [Marketing](https://www.flowconsent.com/en/services/marketing/mention-me) · ### [CASAFARI](https://www.flowconsent.com/en/services/marketing/casafari) [Casafari is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Casafari provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Casafari helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/marketing/casafari) [Marketing](https://www.flowconsent.com/en/services/marketing/casafari) · ### [InteractiveCalculator](https://www.flowconsent.com/en/services/marketing/interactivecalculator) [InteractiveCalculator is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. InteractiveCalculator integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, InteractiveCalculator helps organizations maintain robust websites that meet user.](https://www.flowconsent.com/en/services/marketing/interactivecalculator) [Marketing](https://www.flowconsent.com/en/services/marketing/interactivecalculator) · ### [Birdeye](https://www.flowconsent.com/en/services/marketing/birdeye) [Birdeye is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Birdeye enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Birdeye empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/marketing/birdeye) [Marketing](https://www.flowconsent.com/en/services/marketing/birdeye) · ### [Adaptix](https://www.flowconsent.com/en/services/marketing/adaptix) [Adaptix is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. Adaptix integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, Adaptix makes advanced AI accessible to all teams.](https://www.flowconsent.com/en/services/marketing/adaptix) [Preferences](https://www.flowconsent.com/en/services/marketing/adaptix) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)