Klaviyo

Overview

Klaviyo is an email and SMS marketing automation platform widely used by e-commerce brands. Its on-site scripts track visitor behavior, product interactions, and cart activity to trigger automated email and SMS flows. Klaviyo connects on-site browsing data to email subscriber profiles, enabling personalized marketing campaigns based on real-time behavior.

What This Script Does

Klaviyo's JavaScript snippet (klaviyo.js) loads on every page and performs several operations:

• Visitor identification: Sets a first-party cookie (__kla_id) containing an encoded visitor identifier. If the visitor is a known email subscriber, the cookie links browsing activity to their Klaviyo profile.
• Page and product tracking: Sends Viewed Product, Added to Cart, and Started Checkout events to Klaviyo's servers in real-time. These events include product names, prices, URLs, and image paths.
• On-site forms: Renders email/SMS signup forms, popups, and flyouts configured in Klaviyo's dashboard. Form submissions create or update subscriber profiles.
• Back-in-stock and browse abandonment: Monitors product page visits and cart state to trigger automated flows when a visitor leaves without purchasing.
• Active on Site tracking: Sends periodic heartbeat requests to track session duration and active browsing.

The script makes requests to a.]klaviyo.com and static.klaviyo.com. It reads and writes to localStorage for form display state and suppression logic. It may also fire identify calls when a visitor clicks through from a Klaviyo email (via URL parameters like _kx).

Consent & Compliance

Consent Category: Marketing / Analytics

Klaviyo's tracking serves dual purposes: behavioral analytics for campaign optimization and direct marketing automation (email/SMS triggers). The visitor identification cookie and behavioral event tracking constitute personal data processing under GDPR. Key considerations:

• GDPR/ePrivacy: The __kla_id cookie and behavioral tracking require opt-in consent. Klaviyo's forms that collect email addresses are separate consent touchpoints requiring explicit marketing consent.
• CCPA: Behavioral data linked to email profiles constitutes personal information. Disclosure is required, and consumers must be able to opt out of sale/sharing.
• Email identification via URL parameters: When a subscriber clicks a Klaviyo email link, the _kx parameter automatically identifies them on-site. This cross-context identification requires consent under GDPR.

Klaviyo provides a consent API that can delay tracking until consent is granted. Use klaviyo.push(["consent", "email"]) to gate identification.

Should You Block This Without Consent?

Yes. Klaviyo's on-site script sets identification cookies, tracks individual browsing behavior, and links activity to marketing profiles. This constitutes personal data processing for direct marketing purposes. Block the script until the user grants marketing consent. If you need Klaviyo signup forms to function, configure them to load independently of the tracking script, or use Klaviyo's consent API to defer behavioral tracking until consent is obtained.