Does Klaviyo require visitor consent before loading on my site?

Yes. Klaviyo sets the __kla_id identification cookie, tracks individual browsing behavior including product views and cart events, and links on-site activity to marketing email profiles. This requires explicit marketing consent under GDPR and ePrivacy before the script loads.

What does the Klaviyo script track and store?

Klaviyo sets __kla_id (2-year persistent visitor ID linking browsing to subscriber profiles) and tracks Viewed Product, Added to Cart, and Started Checkout events sent to a.klaviyo.com. When visitors click Klaviyo email links, the _kx URL parameter identifies them on-site, connecting their session to their email profile.

How does ConsentStack manage Klaviyo on e-commerce sites?

ConsentStack blocks the Klaviyo script until marketing consent is granted. Once granted, Klaviyo loads and begins behavioral tracking. ConsentStack also suppresses _kx identification for visitors arriving via Klaviyo email links until consent is confirmed, preventing unauthorized profile linking on landing pages.

What tracker domains does Klaviyo use?

ConsentStack has catalogued tracker domains for Klaviyo including klaviyo.com. These are the network destinations Klaviyo's scripts contact, which a consent platform blocks until a visitor agrees.

What cookies does Klaviyo set?

Klaviyo sets cookies such as __kla_id. ConsentStack identifies these and classifies them so they can be blocked or allowed based on the visitor's consent choice.

Klaviyo - Email & SMS Marketing Consent & Privacy Info

Back to Vendor Library

Overview

Klaviyo is an email and SMS marketing automation platform widely used by e-commerce brands. Its on-site scripts track visitor behavior, product interactions, and cart activity to trigger automated email and SMS flows. Klaviyo connects on-site browsing data to email subscriber profiles, enabling personalized marketing campaigns based on real-time behavior.

What This Script Does

Klaviyo's JavaScript snippet (klaviyo.js) loads on every page and performs several operations:

Visitor identification: Sets a first-party cookie (__kla_id) containing an encoded visitor identifier. If the visitor is a known email subscriber, the cookie links browsing activity to their Klaviyo profile.
Page and product tracking: Sends Viewed Product, Added to Cart, and Started Checkout events to Klaviyo's servers in real-time. These events include product names, prices, URLs, and image paths.
On-site forms: Renders email/SMS signup forms, popups, and flyouts configured in Klaviyo's dashboard. Form submissions create or update subscriber profiles.
Back-in-stock and browse abandonment: Monitors product page visits and cart state to trigger automated flows when a visitor leaves without purchasing.
Active on Site tracking: Sends periodic heartbeat requests to track session duration and active browsing.

The script makes requests to a.]klaviyo.com and static.klaviyo.com. It reads and writes to localStorage for form display state and suppression logic. It may also fire identify calls when a visitor clicks through from a Klaviyo email (via URL parameters like _kx).

Consent & Compliance

Consent Category: Marketing / Analytics

Klaviyo's tracking serves dual purposes: behavioral analytics for campaign optimization and direct marketing automation (email/SMS triggers). The visitor identification cookie and behavioral event tracking constitute personal data processing under GDPR. Key considerations:

GDPR/ePrivacy: The __kla_id cookie and behavioral tracking require opt-in consent. Klaviyo's forms that collect email addresses are separate consent touchpoints requiring explicit marketing consent.
CCPA: Behavioral data linked to email profiles constitutes personal information. Disclosure is required, and consumers must be able to opt out of sale/sharing.
Email identification via URL parameters: When a subscriber clicks a Klaviyo email link, the _kx parameter automatically identifies them on-site. This cross-context identification requires consent under GDPR.

Klaviyo provides a consent API that can delay tracking until consent is granted. Use klaviyo.push(["consent", "email"]) to gate identification.

Should You Block This Without Consent?

Yes. Klaviyo's on-site script sets identification cookies, tracks individual browsing behavior, and links activity to marketing profiles. This constitutes personal data processing for direct marketing purposes. Block the script until the user grants marketing consent. If you need Klaviyo signup forms to function, configure them to load independently of the tracking script, or use Klaviyo's consent API to defer behavioral tracking until consent is obtained.

Is Klaviyo GDPR compliant?

Klaviyo typically loads marketing and analytics trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So Klaviyo can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads Klaviyo, not on Klaviyo itself.

Visit website

Products (1)

Klaviyo SMS

Klaviyo SMS is the SMS marketing channel within the Klaviyo platform for e-commerce businesses. Scripts embed phone number capture forms and pop-ups on websites to collect SMS opt-ins. Cookies and identifiers associate website visitors with SMS subscriber profiles for attribution.

Consent Categories

Marketing Analytics

Also Known As

klaviyo GDPRklaviyo cookiesklaviyo tracking pixelemail marketing consentklaviyo SMS consentklaviyo privacy

Industries

Business and Consumer ServicesMarketing and Advertising

Tracked Domains (1)

Klaviyo's trackers are common, seen on about 4% of the sites ConsentStack has scanned. Scan your own site to see which of these are firing before consent.

klaviyo.comMarketing

klaviyo.com is a marketing domain operated by Klaviyo, used to serve ads, build audiences, and measure ad conversions. Seen on about 4% of scanned sites.