Privacy policy clauses for Klaviyo
Klaviyo is an email marketing platform that tracks customer behavior and purchase history to send targeted promotional campaigns. E-commerce sites use it to build subscriber lists, segment audiences, and automate personalized email communications based on user activity.
Free scan · No signup · Results in 60 seconds
What data Klaviyo collects
Your privacy policy must disclose each of the following data types when you use Klaviyo.
When does Klaviyo trigger privacy obligations?
Installation triggers immediate tracking
The moment Klaviyo's tracking code is deployed, the __kla_id cookie is set on visitors' browsers with a 2-year lifespan. This initiates behavior tracking—Klaviyo begins collecting browsing activity, email addresses, and purchase history without waiting for opt-in. This cookie placement itself is a legal event.
GDPR applicability (if EU visitors present)
If your site receives traffic from the EU, GDPR Article 4(11) classifies Klaviyo as a joint controller (you set collection purposes; Klaviyo processes). The __kla_id cookie qualifies as tracking under ePrivacy Directive Article 5(3)—you must obtain prior explicit consent before the cookie fires, not after. GDPR Article 13 requires a privacy notice *before* data collection begins, disclosing Klaviyo as a processor, data categories (browsing behavior, purchase history), and retention (2 years for the cookie). Consent must be granular: Article 7(4) prohibits pre-ticked boxes.
