Klaviyo GDPR Setup: A Technical Guide
Where the consent, double opt-in, export and deletion settings live in Klaviyo, what Klaviyo records as proof, and what its own legal pages say about the DPA and where your data is stored.
Technical guide, not legal advice. It shows where the settings are and quotes Klaviyo's own pages, read on 6 October 2026. Whether your setup meets GDPR is a decision for you and your lawyer.
Built into Klaviyo's Terms of Service
Default data location (AWS, Northern Virginia)
Double opt-in link validity
Listed on Klaviyo's Trust Center
What Klaviyo provides, and what stays with you
Klaviyo gives you the contract terms and the tools. How you use them, and what you write on your forms, is yours.
What Klaviyo's own pages say
- DPA: incorporated into the Terms of Service, so nothing separate to sign. Transfers rely on the EU-US Data Privacy Framework, with Standard Contractual Clauses as the fallback. Privacy FAQ · DPA
- Data location: the privacy FAQ says all customer data is stored in the United States (AWS us-east-1). The DPA, updated September 2026, adds EU storage where the customer has stipulated EU data residency. Confirm with Klaviyo whether that applies to your account.
- Audits: the Trust Center lists SOC 2 Type II, ISO 27001, ISO 27017 and PCI DSS. Trust Center
- Tools: consent fields on forms, double opt-in, profile export, profile deletion and a Data Privacy API.
What stays with you
- What you collect, and why.
- The consent wording on every form, and a copy of each version.
- Your privacy policy, linked from your emails and forms.
- Answering access and deletion requests, in Klaviyo and in Shopify.
- How long you keep inactive profiles.
- The legal assessment of all of the above, with your lawyer.
Seven settings to check in your Klaviyo account
Each step names the menu path and links the Klaviyo help page it comes from.
1. Collect consent on your sign-up forms
In the form builder, choose Create from Scratch, then Enable Data Protection Fields, so the template starts with consent wording and a checkbox. Leave the checkbox unticked by default. One trap Klaviyo documents itself: people who submit the form are subscribed whether or not they tick the box, so build your EU sending segment on the consent property, not on the list alone. To show the form only to EU visitors, use Targeting & Behaviors, Targeting, By Location.
Sign-up forms → Create from Scratch → Enable Data Protection FieldsSource: How to collect GDPR-compliant consent (Klaviyo Help Center)
2. Collect consent at a Shopify checkout
A Shopify customer who gives an email and ticks the marketing box at checkout is subscribed in Klaviyo. Klaviyo recommends not having that box ticked by default. Note the reverse case: a profile that is already subscribed in Klaviyo is not unsubscribed if it leaves the box empty at a later checkout.
Shopify checkout → email marketing checkbox (unticked by default)Source: How to sync Shopify email subscribers to a Klaviyo list (Klaviyo Help Center)
3. Turn on double opt-in
Double opt-in is set per list: open the list, Settings, Consent. With the Single opt-in box unticked, new subscribers get a confirmation email and only join after clicking it. New lists take your account default. Imports skip double opt-in, and the confirmation link expires after 72 hours. The confirmation email itself is edited under Audience, Growth tools, Customize subscribe and preferences pages, for the whole account or per list.
Lists & segments → [list] → Settings → ConsentSource: Understanding double opt-in (Klaviyo Help Center)
4. Know what Klaviyo records as proof
For a form with data protection fields, Klaviyo stores the choice as a $consent property, plus Form ID, Method, Form Version and Timestamp. Each profile also shows a consent status per channel, and consent status is separate from suppression status. Klaviyo keeps the exact text of each form version, which you can request from its support. Keep your own copy of the wording too: Klaviyo's GDPR FAQ says you must retain the language people saw.
Profile → Details tab → consent status per channelSource: Understanding consent in profiles (Klaviyo Help Center)
5. Answer an access request: export the profile
Open the profile, choose Profile actions, then Export profile and start the export. The file appears under Settings, Other, Downloads as a .zip with the profile's data.
Profile → Profile actions → Export profile → Settings → Other → DownloadsSource: How to handle GDPR and CCPA requests (Klaviyo Help Center)
6. Answer a deletion request
Open the profile, Profile actions, Delete profile, and tick the box saying the person asked for deletion under a data privacy request. The deletion is listed under Settings, Other, Profile maintenance, which Klaviyo describes as a permanent record of compliance with deletion requests. For volume, the Data Privacy API deletes by email, phone number or profile ID (one identifier per call). Three things to know: deletion cannot be undone, the same person can come back as a new profile if they sign up again, and a profile deleted in Klaviyo is not deleted in Shopify, so handle that side too.
Profile → Profile actions → Delete profile → tick the data privacy boxSource: How to delete profiles (Klaviyo Help Center)
7. Decide what happens to inactive profiles
We found no automatic retention or auto-delete setting on Klaviyo's pages. Bulk removal is manual, under Settings, Other, Profile maintenance, Remove Profiles, by list or segment. Klaviyo's own advice for unengaged profiles is to suppress rather than delete. How long you keep data is your decision, so write it down and run the clean-up on a schedule.
Settings → Other → Profile maintenance → Remove ProfilesSource: How to bulk delete profiles (Klaviyo Help Center)
Frequently Asked Questions
Where is Klaviyo's Data Processing Agreement?
Klaviyo publishes its Data Processing Agreement at klaviyo.com/legal/data-processing-agreement. Klaviyo's privacy FAQ says the DPA is incorporated into its Terms of Service, so customers who accept the Terms are covered by it without signing a separate document. The DPA names the EU-US Data Privacy Framework for transfers, with Standard Contractual Clauses as the fallback.
Where does Klaviyo store customer data?
Klaviyo's privacy FAQ says it stores all customer data in the United States, in the AWS us-east-1 data center in Northern Virginia. Its Data Processing Agreement, updated September 2026, adds that data is stored in the European Union where the customer has stipulated EU data residency. Check with Klaviyo whether that option applies to your account before relying on it.
How do I turn on double opt-in in Klaviyo?
Double opt-in is set per list. Open the list, select Settings, then Consent. If the Single opt-in box is unticked, the list uses double opt-in. New lists take your account's default setting. List imports do not trigger double opt-in, and the confirmation link is valid for 72 hours.
What consent information does Klaviyo record?
When someone consents through a Klaviyo form with data protection fields, Klaviyo stores the choice as a $consent property, plus the form ID, method, form version and a timestamp. Each profile also has a consent status per channel (subscribed, unsubscribed, never subscribed). Klaviyo keeps the text of each form version, which you can request from its support.
How do I delete a profile for a GDPR request?
Open the profile, choose Profile actions, then Delete profile, and tick the box saying the person asked for deletion under a data privacy request. The record appears under Settings, Other, Profile maintenance. The Data Privacy API can do the same with an email, phone number or profile ID. Deletion is permanent and cannot be undone.
Is this page legal advice?
No. It explains where the settings are in Klaviyo and what Klaviyo says about them on its own pages. Whether your consent wording, retention period and privacy policy meet GDPR is a legal assessment for you and your lawyer.
All statements about Klaviyo on this page come from Klaviyo's own pages, read on 6 October 2026. Klaviyo changes its product and documents; if something here no longer matches, the Klaviyo page linked next to it is the one that counts.
Want a second pair of eyes on your Klaviyo setup?
We review the technical side: sign-up forms and consent fields, double opt-in, checkout consent, and how deletion requests are handled in Klaviyo and Shopify. You get the findings in writing. The legal assessment stays with you and your lawyer.