How to comply with data privacy laws

Estimated 7 minute read

|

Updated Aug 5, 2025, 12:00 AM EST

Table of contents

• You will learn
• Keep your privacy policy up to date
• Collect consent
• Manage open tracking consent
• Update and target your content
• Clean your lists
• Additional resources

You will learn

Learn some best practices for complying with data protection regulations in your marketing.

As regulations about data and privacy continue to roll out, it’s important to keep an eye on how you contact customers to ensure their protection and comply with the law.

The information provided here is intended to be educational and should not be construed as legal advice. Klaviyo encourages all of our customers — and all ecommerce merchants — to seek legal advice for counsel on how they specifically should ensure that they are compliant with data protection regulations.

Keep your privacy policy up to date

To start, it’s important to keep your privacy policy up to date so that it meets regulation guidelines. As a best practice, your privacy policy should be concise, transparent, intelligible, and in an easily accessible format. If you’re potentially collecting information about children, your privacy policy will need to be clear and written in plain language so they can understand it. Include the following in your privacy policy:

• Information about your business’s location and where someone could get in contact with you
• Information about the data you collect, use, and share (e.g., the purpose of collection, how data is used, who data will be shared with, how long you will retain their data, etc.)
• Information about their rights in regard to their data

If you make any changes to how you handle someone’s data, it’s important to update your privacy policy to reflect those changes.

Collect consent

In order to remain compliant, you’ll want to collect marketing consent from your subscribers. When collecting consent, it’s important to note what a customer can expect by subscribing to your marketing and what you will do with the data you collect. Klaviyo makes it easy to add fields to your sign-up forms that make them suitable to comply with data protection regulations.

When creating a popup, flyout, embed, or full-page sign-up form from scratch, turn on Enable data protection fields to include consent fields and disclosure language.

You’ll want to consult with your legal counsel to ensure that the content is suitable for your specific regulations and needs.

If you use Klaviyo forms and have subscribers who are in more regulated locations, like the EU or California, you may wish to include this consent language on all of your forms. If you have separate sites for customers coming from different locations, you can have 2 different sign-up forms. Use one with more specific information designed to comply with data protection regulations, and one without the additional information for shoppers from other locations.

Regardless, it’s better to be over-protected than under-protected when it comes to collecting consent. For more information around targeting customers in the EU, see our guide on collecting GDPR compliant consent.

Manage open tracking consent

Some regulators require that you have consent before you record an email open through a tracking pixel. To help you comply, Klaviyo lets you stop recording email opens, either across your whole account or for individual recipients.

You decide which recipients this applies to. Klaviyo provides the controls and surfaces helpful profile data such as location, but you are responsible for determining who is in scope and setting the controls accordingly.

Open tracking consent is separate from email marketing consent. Open tracking is on unless you turn it off for your account or unsubscribe a recipient from open tracking; collecting marketing consent does not automatically set this preference.

For step-by-step instructions, see How to manage open tracking.

Update and target your content

While it may not explicitly be required by regulatory bodies in all circumstances, it’s better to personalize the customer experience both on-site and within your marketing. If you target your communication, shoppers browsing your site will be more likely to subscribe to your marketing and stay engaged with your brand.

Using sign-up forms

An easy way to encourage first-time shoppers to subscribe to your email list is to show a discount to people who haven’t already engaged with your brand. To do that, create 2 sign-up forms that add subscribers to the same email list: one with the promotion for visitors Klaviyo does not recognize, and one without the promotion for recognized profiles who are not in that list.

Open the form with the promotion in the editor and select Targeting & display behavior > Targeting. Under Audience, select Don’t show to existing Klaviyo profiles.

These settings rely on Klaviyo recognizing the visitor. Someone using a new device or private browsing, or who has cleared their cookies, can still see the promotion even if they already have a profile. A visitor who is not recognized will not qualify for a form restricted to a list or segment.

For the form without the promotion, first create a segment of profiles that are in your Klaviyo account but are not in your email list.

Open the form without the promotion and select Targeting & display behavior > Targeting. Under Audience, select Show to specific profiles in a list or segment. Check Include certain lists and segments, then select the segment you created.

When each form is ready, click Publish, or Publish changes for a form that is already live. Complete any required publishing prompts so the targeting changes take effect on your site.

Targeting sign-up forms to a particular audience is an easy way to personalize the on-site content for your subscribers. Follow our article on Creating Customer Engagement Tiers to get inspiration on different segments you can use to personalize content.

In flows

Flows are another area where you want to be conscious of data protection regulations. When creating flows, especially ones in a regulatory gray area like abandoned cart or browse abandonment, ask your legal team which customers you can contact and what consent or other legal basis is required. You can then use filters or splits to:

• Exclude customers in regulated areas
• Give customers you are permitted to contact different messaging with less promotional language, personalized to the items they have shown interest in

Exclude customers

1. To exclude profiles whose recorded country is in the EU, select the trigger at the top of your flow.
2. Next to Profile filters, click Add, or Edit if the flow already has profile filters.
3. Add the condition If someone is or is not within the EU (GDPR) and set it to is not within European Union. Keep any other filters the flow needs.
4. Click Save to apply the filter.

This filter excludes profiles whose recorded country is in the EU. Check your profile location data before relying on it; the location condition does not check marketing consent.

Personalize messaging

To send different messages to customers you are permitted to contact, add a split before the messages you want to vary:

1. Drag Split from the Logic section of the sidebar onto your flow, then select it.
2. Select Add path criteria on a path. Choose If someone is or is not within the EU (GDPR) and set it to is not within European Union.
3. Click Save. If the path editor shows Apply, click it, then click Save in the split configuration to save your changes.
4. Place the message for profiles that match the condition on that path, and the alternative message under Everyone else. Review the messages and set them live when they are ready to send.

If your sidebar shows Conditional split, add it and configure the same location condition, then click Save. Profiles that match go down the Yes path; the others go down the No path. Place the appropriate message on each path and set it live when ready.

Make sure to contact your legal team to ensure that the content within your emails is compliant with the regulations in that particular area. Even if your business is not based in an area with data protection restrictions, you may still be required to abide by the rules if you're contacting a customer who is in a location with specific requirements.

In campaigns

As you build your campaigns, all of your emails must contain links to your unsubscribe page and your business’s contact information.

On the campaign review page, check Unsubscribe link to see whether your template includes one. If the link is missing, Klaviyo will add one when sending the email. If template syntax errors prevent the check, correct them and check again. Review your business’s contact information in the email separately.

In all of your messages, and especially in campaign sends, personalize the content to your audience. Batch and blast emails are never a good idea. Think about your customers and why they come back to your brand; then, customize your emails from there.

An easy way to do this is through Klaviyo’s show/hide block feature, allowing you to ensure that customers see copy and creative work that’s compelling to them.

Clean your lists

It’s important to not email customers who have not opted-in to your marketing as well as those who do not regularly engage with your brand to maintain good deliverability in the eyes of inbox providers. The process of identifying customers who aren’t engaged and excluding them from your messaging is called list cleaning. For more information, check out our article on list cleaning.

If you have turned off open tracking for an audience, use other available activity, such as clicks or purchases, when assessing engagement. An absence of recorded opens for that audience does not mean they did not open your emails.

Additional resources

• Frequently asked questions about GDPR
• How to handle GDPR and CCPA requests
• How to collect GDPR compliant consent
• Frequently asked questions about the CCPA and CPRA

Was this article helpful?

YesNo

Use this form only for article feedback. Learn how to contact support.

Explore more from Klaviyo

Community

Connect with peers, partners, and Klaviyo experts to find inspiration, share insights, and get answers to all of your questions.

Visit Community

Partners

Hire a Klaviyo-certified expert to help you with a specific task, or for ongoing marketing management.

Hire a partner

Support

Access support through your account.

Email support (free trial and paid accounts) Available 24/7

Chat/virtual assistance Availability varies by location and plan type

Log in