How to collect GDPR-compliant consent

You will learn

Learn how consent is stored in Klaviyo to help you be GDPR compliant, and how to collect GDPR-compliant consent.

GDPR (General Data Protection Regulation) was adopted in 2016 and went into effect on May 25, 2018. It protects personal data regardless of a person’s nationality. It applies to businesses established in the EU and can also apply to businesses outside the EU that offer goods or services to, or monitor the behavior of, people in the EU. For more information on GDPR, check out our blog series.

When you rely on consent for marketing, that consent must be informed and freely given. Klaviyo provides form templates with data protection fields as a starting point. Customize the wording for your marketing activities and ask legal counsel to review your forms and consent process. If you have an existing list that you would like to import into Klaviyo and you have already collected consent, check out our guide to applying consent properties to an existing list.

Collect consent with a sign-up form

After you install Klaviyo sign-up forms on your site, you can start building forms within the Sign-up forms tab of your account.

1. Click Create form. If prompted to choose a channel, select Web, enter a form name, and click Create form.
2. Click Create blank form.
3. Enter or confirm a form name, choose a form type (Popup, Flyout, Full page, or Embed), and select the list subscribers should join.
4. Turn on Enable data protection fields.
5. Click Save and design to open the form editor.

You can edit the language of this form or add additional fields using checkboxes to suit your needs. Bear in mind that GDPR requires granular consent, which means that subscribers must have the option to subscribe to some, but not all, types of marketing. For example, a subscriber may want to receive emails from you, but not be retargeted by your business on social media. Using checkboxes allows subscribers to choose as many or as few types of marketing they would like to receive from you.

Checkbox selections are saved to the profile property assigned to the checkbox block. To record explicit choices separately, select the checkbox block and assign it a custom property, such as GDPR consent choices. The $consent property uses a list data type and can contain multiple values. However, Klaviyo can also add email to $consent automatically when processing an email subscription. Do not use that value alone as proof that someone selected your email consent checkbox.

Once your form is styled to suit your needs, the consent wording has been reviewed, and your checkbox properties and recipient filters are configured, select Publish or schedule, then Publish now to publish it on your site. For an embedded form, you must also add its embed code to your site, as described below.

You can show or hide this form for visitors in specific locations. In the form editor, open Targeting & display behavior > Targeting. Under Location, turn on Show to audience in certain locations or Don’t show to audience in certain locations, then select the countries or regions, such as European Union. Publish your changes for the targeting to take effect. Klaviyo determines a browser’s location using its IP address.

Collect consent with an embedded form

In addition to a pop-up or flyout, you may want to include an embedded form on your site. Follow the creation steps above and choose Embed as the form type. After publishing, copy the form’s embed code and paste it into your site’s HTML where you want the form to appear. Save your website changes.

Alternatively, you can customize the code provided below and install it on your site. Replace every LIST_ID value with your newsletter list’s ID, replace the privacy policy and customer support email placeholders, and have legal counsel review the consent wording. The example records checkbox selections in a separate GDPR consent choices property. Use that property to identify email consent before sending marketing: the form submits an email subscription even if the Email checkbox is left unchecked. For forms created in the Klaviyo editor, follow the embed installation guide. Learn more about how to find the ID for a given list.

<form id="email_signup" class="klaviyo_styling klaviyo_gdpr_embed_LIST_ID" action="//manage.kmail-lists.com/subscriptions/subscribe" data-ajax-submit="//manage.kmail-lists.com/ajax/subscriptions/subscribe" method="POST" 
target="_blank" novalidate="novalidate">
 <input type="hidden" name="g" value="LIST_ID">
 <input type="hidden" name="$fields" value="GDPR consent choices">
 <input type="hidden" name="$list_fields" value="GDPR consent choices">
 <div class="klaviyo_field_group">
 <label for="k_id_email">Newsletter Sign Up</label>
 <input class="" type="email" value="" name="email" id="k_id_email" placeholder="Your email"/>
 <div class="klaviyo_field_group klaviyo_form_actions">
 <div class="klaviyo_helptext"> How would you like to hear from us? (please select at least one option) </div>
 <input type="checkbox" name="GDPR consent choices" id="consent-email" value="email">
 <label for="consent-email" >Email</label><br>
 <input type="checkbox" name="GDPR consent choices" id="consent-web" value="web" >
 <label for="consent-web">Online advertisements</label>
 <div class="klaviyo_helptext klaviyo_gdpr_text"> We use email and targeted online advertising to send you product and services updates, promotional offers and other marketing communications based on the information we collect about you, such as your email address, general location, and purchase and website browsing history. <br>
<br>
 We process your personal data as stated in our Privacy Policy {Insert privacy policy link}. You may withdraw your consent or manage your preferences at any time by clicking the unsubscribe link at the bottom of any of our marketing emails, or by emailing us at {insert customer support email address}.</div>
 </div>
 </div>
 <div class="klaviyo_messages">
 <div class="success_message" style="display:none;"></div>
 <div class="error_message" style="display:none;"></div>
 </div> <div class="klaviyo_form_actions">
 <button type="submit" class="klaviyo_submit_button">Subscribe</button> </div>
</form><style type="text/css">
.klaviyo_styling.klaviyo_gdpr_embed_LIST_ID,
.klaviyo_condensed_styling.klaviyo_gdpr_embed_LIST_ID {
 font-family: "Helvetica Neue", Arial;
}.klaviyo_styling.klaviyo_gdpr_embed_LIST_ID .klaviyo_helptext,
.klaviyo_condensed_styling.klaviyo_gdpr_embed_LIST_ID .klaviyo_helptext {
 font-family: "Helvetica Neue", Arial;
 padding-top: 10px; padding-bottom: 10px;
}.klaviyo_styling.klaviyo_gdpr_embed_LIST_ID .klaviyo_gdpr_text,
.klaviyo_condensed_styling.klaviyo_gdpr_embed_LIST_ID .klaviyo_gdpr_text {
 font-size: 14px;
 line-height: 1.3;
}
.klaviyo_styling.klaviyo_gdpr_embed_LIST_ID label,
.klaviyo_condensed_styling.klaviyo_gdpr_embed_LIST_ID label {
 color:#222;
}
.klaviyo_styling .klaviyo_field_group .klaviyo_form_actions {
 text-align:left;
 }
.klaviyo_styling.klaviyo_gdpr_embed_LIST_ID input[type=checkbox] + label,
.klaviyo_condensed_styling.klaviyo_gdpr_embed_LIST_ID input[type=checkbox] + label {
 display: inline;
 font-weight:normal;
 padding-left:5px;
}.klaviyo_styling.klaviyo_gdpr_embed_LIST_ID input[type=text],
.klaviyo_styling.klaviyo_gdpr_embed_LIST_ID input[type=email],
.klaviyo_condensed_styling.klaviyo_gdpr_embed_LIST_ID input[type=text],
.klaviyo_condensed_styling.klaviyo_gdpr_embed_LIST_ID input[type=email] {
 border-radius: 2px;
}.klaviyo_styling.klaviyo_gdpr_embed_LIST_ID .klaviyo_submit_button,
.klaviyo_condensed_styling.klaviyo_gdpr_embed_LIST_ID .klaviyo_submit_button {
 background-color:#0064cd;
 border-radius: 2px;
}.klaviyo_styling.klaviyo_gdpr_embed_LIST_ID .klaviyo_submit_button:hover,
.klaviyo_condensed_styling.klaviyo_gdpr_embed_LIST_ID .klaviyo_submit_button:hover {
 background-color:#0064cd;
}
</style>
<script type="text/javascript" src="//www.klaviyo.com/media/js/public/klaviyo_subscribe.js"></script>
<script type="text/javascript">
 KlaviyoSubscribe.attachToForms('#email_signup', {
 hide_form_on_success: true,
 extra_properties: {
 $source: '$embed',
 $method_type: "Klaviyo Form",
 $method_id: 'embed',
 $consent_version: 'Embed default text'
 }
 });
</script>

How consent is stored in Klaviyo

To find the consent status of a specific contact, head to their individual profile in Klaviyo.

For forms created in Klaviyo’s editor, Klaviyo records the following form details on the profile during subscription processing. These identify the form used; review your separate checkbox property to see the visitor’s explicit marketing choices.

• Form ID
  This is the unique form ID that allows you to identify the specific form someone used to opt-in. Every form created in Klaviyo has a unique ID, which can be found in the URL of the form as a 6-character alphanumeric code.
  

• Method
  This identifies the method that a subscriber used to opt-in. If you are using a Klaviyo sign-up form as outlined above, this will read Klaviyo Form.
• Form Version
  This identifies the specific form version the subscriber saw. It is a version ID, not a count of how many times you edited the form. Klaviyo keeps a record of the text and language used for each form version, which you can request from support if necessary.
  
• Timestamp
  This records when Klaviyo processed the subscription information. Review the channel’s subscription details for its consent date, especially if your list uses double opt-in.

How to handle requests for data or deletion

Under GDPR, you may be required to provide a contact with all of their user data if they request it. Additionally, if a contact requests that their data is deleted, you may be required to delete certain information and to keep a record of this deletion to prove that the request was met.

Check out our guide on Handling GDPR Requests for specific instructions.

Build a segment of EU contacts

To isolate contacts whose profile location is in the EU, create a segment using If someone is or is not within the EU (GDPR) with Location is within European Union. This condition uses the country saved on the profile; it does not establish someone’s citizenship or whether GDPR applies to all of your processing.

Filter marketing flows by consent

For marketing email flows, add Profile filters so contacts in the EU and UK only receive marketing when you have the required email consent. For ordinary checkbox forms, include the separate property that records the explicit email choice. SMS marketing requires SMS marketing consent regardless of location; being outside the EU and UK or having email consent does not replace SMS consent. If a flow sends both email and SMS, keep the consent conditions appropriate to each channel.

Some common flows that will require this filter are:

• Browse abandonment
• Winback
• Upsell
• Cross-sell
• Product review

For more information on the difference between transactional and non-transactional flows, check out this guide. The one exception to this list may be abandoned cart emails. Many organizations take the view that you can still send abandoned cart emails without explicit consent for marketing communications under the basis of legitimate interest. You may be able to consider an abandoned cart email as a communication relevant to the explicit intent to complete a transaction with your business. Other triggered emails, like browse abandonment and winbacks, on the other hand, may not be permissible unless customers have previously consented to receive marketing emails from you in a GDPR-compliant fashion.

That said, the applicability of legitimate interests or any other legal basis will depend on the particular circumstances; for example, the number and frequency of emails and the amount of time that has elapsed since the cart was abandoned. We strongly recommend that you consult with your legal team about your campaigns and flows to confirm they are compliant with applicable law.

Suppressing EU contacts who do not provide consent

Suppress EU contacts when you cannot establish the required consent to email them. Before contacting legacy profiles whose explicit opt-in you cannot prove, consult your legal team; do not send a re-permissioning campaign simply to obtain missing consent. Add conditions to your EU segment that identify profiles without the required consent. For a checkbox property stored as a list, include profiles where the property is missing or does not contain the value for email consent, joining those 2 alternatives with OR. Combine that group with the EU location condition using AND. If you collect consent through ordinary checkboxes, use the separate property recording the email choice rather than relying only on $consent or the profile’s subscription status.

Suppress this segment to ensure that you don’t inadvertently email these contacts. If they later decide to opt back in, they can resubscribe.

Best practices

Once your sign-up forms and consent records are in place, use segmentation and profile filters to send marketing emails only to profiles with the required consent. For the standard subscription condition, select If someone can or cannot receive marketing > can receive > email marketing and Because person > subscribed. This distinguishes explicit subscription from the ability to receive email. If you use ordinary checkbox fields, also require the separate custom property that records the visitor’s explicit email choice.

In order to maintain your GDPR compliance, you’ll also want to adhere to the following best practices:

• Display links to your Privacy Policy, Terms of Service, and cookie policy in all of your emails.
• Use double opt-in.
• Understand what consent means:
  
  • Freely given. In other words, you can’t mislead or force someone into letting you use their information. They must be given a legitimate choice — and you can’t withhold a service or transaction on the basis of consent if that consent is not integral to the service or transaction.
  • Specific. Consent to process personal data must include details around both the purpose of the processing and the type of processing.
  • Informed. Closely tied to the idea of specific consent, informed consent simply means that the individual data subject must be told how their data is going to be used, the specific purpose their data is being used for, and the type of data processing you are using.
  • Unambiguous. To go one step further, consent under GDPR must be obtained through clear language and indicated through affirmative action on the part of the data subject.
  • Easy to withdraw. Though not called out in the definition of consent upfront, Article 7 of the GDPR goes on to specify that consent must be as easy to withdraw as it is to grant.

Additional resources