# Klaviyo privacy rating

Email and SMS marketing platform for online stores, with a customer data platform, segmentation, automated flows and open and click tracking.

## Summary

Klaviyo scores 38 out of 100 (grade F) on the newsletter platforms criteria. It meets 3 of 8 criteria: transparency report, tells users about requests and TLS configuration. It partly meets independent audit. It does not meet open source, no trackers or telemetry, no ads or data sales and security headers. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade D-.

- Website: https://www.klaviyo.com
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Platforms: Web
- Home page trackers: Google reCAPTCHA (not scored), Google Tag Manager, HubSpot, Optimizely
- Category: [Newsletter platforms](https://privacyratings.com/newsletters/)
- Grade: F (38/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | Closed source. |  |
| No trackers or telemetry | No | Open tracking is on by default, and the pixel stays in messages even when open tracking is turned off. The website loads Google Tag Manager and Optimizely. | https://help.klaviyo.com/hc/en-us/articles/52756655778843 |
| No ads or data sales | No | The privacy notice states personal information may be sold or shared with advertising networks, social networks and business partners, which may use it for their own purposes. | https://www.klaviyo.com/legal/privacy/privacy-notice |
| Independent audit | Partial | Annual SOC 2 and ISO 27001 audits are done, but the reports are only available through the Trust Center after requesting access. | https://www.klaviyo.com/trust |
| Transparency report | Yes | The transparency report states no US or non-US government requests for customer personal data have been received, and describes how requests are handled. | https://www.klaviyo.com/legal/government-data-access-request-transparency-report |
| Tells users about requests | Yes | Klaviyo will notify affected customers of government data requests unless the law prohibits it. | https://www.klaviyo.com/legal/government-data-access-request-transparency-report |
| TLS configuration | Yes | Grade A+ | https://www.ssllabs.com/ssltest/analyze.html?d=klaviyo.com&hideResults=on |
| Security headers | No | Grade D- (25/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=klaviyo.com |
| Modern web standards | Not tested yet | Not tested yet. |  |

Source: https://privacyratings.com/newsletters/klaviyo/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/newsletters/klaviyo.md