Klaviyo's onsite tracking is not just analytics — it is profile building. The script sets a cookie identifying the browser, and when a visitor arrives from a Klaviyo email or completes a form, that browser is linked to a real person and everything it did before is attached to them retroactively.
The short answer
Two behaviors do most of the work. First, the onsite script sets a __kla_id cookie on load, so browsing is being recorded against a profile before anyone has agreed to anything. Second, a click from a Klaviyo email carries an identifier in the URL, which the script uses to resolve that browser to a known profile — meaning a visitor who never filled in a form on this visit is nonetheless identified.
Neither is a defect; it is what the product does, and it is why the tool is effective. The question is timing: whether it runs before the visitor answers your banner.
Fresh incognito window, DevTools → Network, banner untouched. An ungated install loads static.klaviyo.com/onsite/js/klaviyo.js (with your public API key in the URL) and then talks to a.klaviyo.com. Application → Cookies shows __kla_id set on first paint.
The clearer demonstration: click a link in one of your own marketing emails, land on the site, and check the cookie again. It now carries an identified profile — and the sessions recorded before that click can be attributed to the same person.
Three passes: cold visitor, identified visitor, and the install inventory. The middle one is the pass most teams have never run.
klaviyo. If klaviyo.js loads and requests go to a.klaviyo.com, tracking started before consent.__kla_id present before you clicked anything on the banner? Note its expiry.klaviyo.js and check your GTM container.What a healthy result looks like: A gated install contacts no Klaviyo domain and sets no __kla_id until the visitor accepts. After acceptance, everything works normally.
On Shopify and similar platforms the Klaviyo integration injects the onsite script itself. It never passes through your theme, so a consent tool that only manages theme code has no chance to gate it.
The integration's onsite-tracking toggle is enabled as part of a standard setup, because it is what makes browse-abandonment and product-viewed flows work. Nobody framed it as a consent decision at the time.
Email tools frequently land in "functional" or "necessary" buckets because they are associated with transactional messaging. A script that builds a behavioral profile and attaches an identity is hard to defend in either category.
Teams that try to gate Klaviyo sometimes discover their signup popups disappear too, revert the change, and leave the tracking ungated. That is a real tradeoff, and it needs a deliberate answer rather than a rollback.
California's Invasion of Privacy Act (CIPA), Penal Code § 631, prohibits intercepting a communication without the consent of all parties. Since 2022, plaintiff firms have applied that decades-old wiretapping statute to websites — arguing that building a behavioral profile of a shopper and linking it to a real identity when they arrive from an email before the visitor consents is an intercepted communication. Statutory damages under § 637.2 run up to $5,000 per violation, and plaintiffs argue each affected visitor session is a separate count, which is why even small sites receive demand letters. Similar all-party-consent statutes in Pennsylvania (WESCA), Florida (FSCA), and Massachusetts have produced parallel filings.
Ecommerce sites carry a second consideration alongside the timing question: shopping behavior tied to an identified person is exactly the kind of profile California's consumer-privacy rules give consumers rights over, including notice at collection and the right to opt out of sharing for cross-context behavioral advertising.
To be precise about what a network log can tell you: a tracker firing before consent is a technical finding — it establishes when a script transmitted data, not whether any law was broken. But timing is exactly what these claims are built on, which is why fixing the timing is the practical response.
Terminology bridge
Klaviyo calls it onsite tracking; the general pattern is identity resolution — linking an anonymous browser to a known profile, here via an email click. The flows it powers are browse abandonment and cart abandonment. In consent language the script belongs to the analytics/marketing category, never to strictly necessary. On Shopify, the supported mechanism for scripts to check consent before tracking is the Customer Privacy API.
A scan shows that Klaviyo's script loaded and that a profile cookie was set, with timing relative to the banner. It cannot see what is inside your Klaviyo account, what data your flows use, or whether any of it is lawful in your jurisdiction — and this page is general information, not legal advice. The timing, though, is entirely in your hands, and it is the part an automated scanner on the other side would look at.
RegSentry loads your site in a real browser, records when each third-party tracker first contacts its server, and flags everything that fires before consent — with the fix for each one. Continuous monitoring re-runs it and emails you when something new appears.
Free real-browser scan
See every pre-consent tracker on your site — free, 30 seconds, no signup.
Real browser scan, no signup to run it. You see a summary of the findings; the full report with every tracker unlocks with your email.