Last updated 2026-07-10
TL;DR
Klaviyo gives you the tools for TCPA and GDPR compliance. It does not make you compliant. You need prior express written consent before any marketing text, a clear opt-in disclosure, a working STOP path, and a lawful basis for EU contacts. Gaps in any of those layers are where TCPA suits start. Here is what Klaviyo does, what you own, and where the risk hides.
What TCPA rules actually apply to Klaviyo SMS campaigns?
The Telephone Consumer Protection Act, 47 U.S.C. § 227, is the federal law that governs commercial texts sent to U.S. mobile numbers [1]. It requires "prior express written consent" before you send a marketing text using an automatic telephone dialing system or a prerecorded message [1]. Business SMS platforms like Klaviyo route messages through carrier short codes and long codes, and the FCC has long treated that kind of mass texting as covered conduct, even though the exact definition of an ATDS has been fought over in court for years.
The practical floor is simple. Send a promotional text through Klaviyo and you need written consent that meets specific disclosure standards.
"Written" includes electronic consent captured on a web form, a checkout page, or a keyword opt-in, as long as the subscriber affirmatively agrees. The FCC's 2012 order made clear that this consent cannot be made a condition of buying anything [12].
TCPA statutory damages run $500 per violation for negligent violations and up to $1,500 per violation for willful ones [1]. An SMS blast can touch tens of thousands of numbers at once, so class actions are common, and the statute puts no cap on class damages. That math is why a single missing disclosure can turn into eight-figure exposure. For the statute itself, see our tcpa breakdown.
Klaviyo is a platform vendor, not the sender. The legal exposure sits with you, the brand whose name is on the message. Klaviyo hands you the infrastructure. You own the liability.
What does valid TCPA SMS consent actually require?
Valid TCPA consent for marketing texts is a written disclosure with five parts, and none of them are optional. The FCC's 2012 rules, codified at 47 C.F.R. § 64.1200, spell them out [12]. Miss one and you have a defect a plaintiff's attorney can build a case on.
The disclosure must:
1. Identify the seller or brand whose texts the person is agreeing to receive. 2. State that consent is not a condition of purchase. 3. Tell the subscriber the message type and rough frequency (for example, "up to 4 marketing texts per month"). 4. Disclose that message and data rates may apply. 5. Explain how to opt out (STOP) and how to get help (HELP).
Courts have found that burying this in a general terms-of-service link, with no separate mention of SMS, does not satisfy the statute.
For Klaviyo users, this lives at the point of collection, not inside Klaviyo. Your web form, checkout page, or lead capture tool is where the disclosure shows up. Klaviyo's timestamp and source data record the when and how. The actual words the subscriber read are yours to draft and keep.
Double opt-in is not required by federal law. It is still the smartest evidentiary backstop you can add. If a plaintiff claims they never signed up, a confirmed opt-in reply gives you a timestamped record that is hard to argue with. Klaviyo supports SMS double opt-in natively [3]. We walk through the mechanics in our sms double opt in guide.
One consent does not cover everything. Transactional consent for order confirmations and shipping alerts does not authorize marketing texts. Promotional content needs its own separate, specific consent capture.
How does Klaviyo handle SMS consent collection and storage?
Klaviyo stores SMS consent as a profile-level attribute tied to each subscriber [3]. When someone opts in through a signup form, a checkout box, or a keyword reply to a short code, the platform records the timestamp, the source (form, API, import), and the channel. That audit trail is your first line of defense in a TCPA dispute.
Klaviyo tracks three states: subscribed, unsubscribed, and never subscribed. When a subscriber texts STOP, Klaviyo suppresses that number from future SMS sends and logs the opt-out event [3]. The suppression is carrier-enforced as well, so the STOP travels back through the carrier network, not only Klaviyo's database. Both layers matter, because the FCC expects both to work.
Here is what Klaviyo will not do for you. It does not check that your opt-in form language meets TCPA disclosure standards. It captures the consent event without auditing the words your form actually showed. That gap is where most real-world failures start.
Picture the common one. A brand uploads a list of email subscribers and maps SMS consent from an email opt-in checkbox. Klaviyo accepts the import. The TCPA violation is already live.
List imports deserve extra caution. If you import phone numbers and mark those profiles as SMS subscribed, you are asserting valid TCPA consent for every single number. That assertion is entirely on you. Klaviyo cannot verify it, and plaintiff attorneys know imported lists are a common source of bad consent. Before you touch that CSV, read our sms opt in guide.
One thing Klaviyo does correctly: suppression lists sync at the account level across every flow and campaign. An opt-out from one flow removes the number from all SMS sends in the account. Some platforms suppress only within the specific campaign and leave the number exposed in automation flows. That behavior is a TCPA problem, and it is worth confirming your platform does not do it.
What GDPR requirements apply to Klaviyo SMS for EU contacts?
If you text subscribers in the EU or UK, the General Data Protection Regulation (Regulation (EU) 2016/679) applies on top of your local telemarketing rules, not instead of them [4]. GDPR governs how you collect, store, and process personal data, and a mobile phone number is personal data.
Under GDPR Article 6 you need a lawful basis to process personal data [4]. For marketing SMS the most defensible basis is explicit consent under Article 7, which requires an affirmative, specific, informed, and unambiguous agreement. Pre-ticked boxes do not count. Bundled consent ("agree to terms AND receive marketing texts") does not count either.
Article 7(3) gives subscribers the right to withdraw consent at any time, and withdrawal must be as easy as giving it [4]. A STOP keyword clears that bar. Making someone email a support address to stop texts does not.
Records of consent are mandatory under Article 7(1), and you have to be able to demonstrate that consent was obtained [4]. Klaviyo's timestamp and source data help, but you also need the actual form language the subscriber saw at sign-up. That language is what proves the consent was "informed" and "specific."
Data minimization under Article 5 applies too. Do not collect phone numbers if you have no active SMS program. Do not keep numbers after a subscriber opts out unless you have a separate legal basis for retention. Klaviyo's suppressed profiles keep the number in your account by default, so periodic purging of suppressed EU contacts is good practice.
For how GDPR intersects with B2B data sourcing and list buying, the b2b lead generation platforms gdpr compliance article covers the adjacent ground.
What does a compliant Klaviyo SMS opt-in form look like?
A compliant opt-in form for Klaviyo SMS has six components. Drop any one and you have a TCPA disclosure problem waiting for a plaintiff.
| Element | Example language | Required by |
|---|---|---|
| Brand name | "[Your Brand] text alerts" | FCC 2012 Order |
| Message type | "Promotions, cart reminders, and product updates" | FCC 2012 Order |
| Frequency | "Up to 6 messages per month" | FCC 2012 Order |
| Rates disclosure | "Msg & data rates may apply" | FCC 2012 Order |
| Opt-out instruction | "Reply STOP to unsubscribe" | 47 C.F.R. § 64.1200 |
| Not a purchase condition | "Consent is not a condition of purchase" | 47 C.F.R. § 64.1200 |
The disclosure has to be visible before the subscriber submits, not tucked into a thank-you message afterward. Font size matters in practice. Courts have looked hard at disclosures rendered in 8px gray text that a reasonable person would never notice.
For checkout opt-ins, put the SMS checkbox (unchecked by default) next to the phone number field, with the full disclosure right below it. Do not combine it with an email marketing checkbox. Separate boxes for separate consent types is the cleanest setup, and it is the one that holds up.
Klaviyo's native form builder lets you add custom HTML text blocks for disclosures, and you can use conditional logic to show the SMS fields only when a user interacts with the phone input. That keeps the form clean without hiding the required language. Our sms opt-in form guide has worked examples you can copy.
After submission, send a confirmation text that restates what they signed up for and reminds them how to opt out. Klaviyo sends this through its onboarding flow trigger. Do not skip it.
How do the 2024 FCC one-to-one consent rules change Klaviyo SMS workflows?
The FCC adopted one-to-one consent rules in December 2023, originally set to take effect January 27, 2025. Litigation and stays have thrown the timeline into question, so treat the effective date as unsettled [5]. The core change is this: consent given on a lead generation form or comparison shopping site would have to name each specific seller, instead of authorizing a broad category of "marketing partners."
For most Klaviyo users running first-party opt-in forms on their own site, these rules change almost nothing. You are already the named brand, and your own form captures consent for your own messages.
The weight of the rule falls on performance marketers, lead aggregators, and affiliate marketers who share or resell consent.
Where Klaviyo brands do need to pay attention: third-party list sources, co-registration opt-in programs, and any opt-in page that is not your own domain. If you acquired a number through a partner or lead vendor, you need documentation that your brand was specifically named in that partner's consent disclosure. A generic "you may hear from our partners" clause will not survive under the new rules.
Track the status through the FCC's proceedings and through tcpa news today, because the implementation date has already moved more than once.
What are the biggest TCPA compliance risks specific to Klaviyo users?
The practical risks cluster around a handful of failure modes that show up again and again in Klaviyo accounts. Here are the ones worth watching.
List imports without consent validation lead the pack. Klaviyo makes importing a CSV easy, and it will not stop you from marking imported numbers as subscribed. If those numbers came from a purchased list, a trade show scan, or a CRM migration where phone consent was never separately captured, you have a TCPA problem on every message you send them.
Flow triggers that bypass consent checks come second. Klaviyo flows fire on profile property changes, events, or segment membership. If a flow triggers when someone joins a segment built from a bad import, the flow sends to those numbers automatically. The automation has no idea the consent is worthless.
Missing or broken suppression sync bites when you run Klaviyo next to another SMS platform or a CRM. If a subscriber texts STOP to a short code managed in Twilio, that opt-out has to propagate back to Klaviyo's suppression list or Klaviyo keeps sending. That sync usually takes custom API work. It does not happen on its own. See our comparison on twilio tcpa compliance for how suppression differs between platforms.
Time-zone sending errors are smaller but real. TCPA bars calls and texts before 8 a.m. or after 9 p.m. in the recipient's local time [1]. Klaviyo's smart send time and quiet hours settings help, but they lean on accurate time zone data for each profile. Numbers with no location data default to the account time zone, so a California sender can text a New York subscriber at 6 a.m. their time.
Last, transactional versus promotional misclassification. Klaviyo lets you fire flows on purchase events that many brands treat as purely transactional. Add promotional language (a discount code, a product recommendation, a referral ask) and the message becomes marketing under TCPA, which requires explicit marketing consent, not transactional consent. That line is blurry in practice and has been litigated more than once.
How should you audit your existing Klaviyo SMS consent records?
A consent audit is the single most useful thing you can do before your next campaign if you already have an SMS list in Klaviyo. It takes about two hours for a typical account and surfaces the gaps worth fixing before they become a lawsuit. Here is the approach I would run.
Export your full SMS subscriber list with the consent source and timestamp fields. Klaviyo's export includes these attributes if you have them mapped. Sort by consent source. Any profiles marked subscribed via "manual import" or "API" get immediate scrutiny. Those are the records where you need to trace back to the original consent documentation.
For each source, pull the form or landing page that was live when the consent event happened. Does it carry all six disclosure elements from the table above? If the form changed after consent was collected, can you document what it looked like at the time? Screenshots, version-controlled HTML, or the Wayback Machine all work here.
Check your suppression list for gaps. Are there numbers that should be suppressed from external opt-outs (carrier-level, CRM opt-outs, verbal requests) that never made it into Klaviyo's unsubscribed state? If any other outbound channel touches the same numbers, you need a process to cross-reference opt-outs.
Look at your quiet hours configuration. In Klaviyo's SMS settings, confirm quiet hours are on and set to block sends before 8 a.m. and after 9 p.m. in the subscriber's local time. Confirm your account time zone is set correctly.
The point of the audit is documentation you can defend. If a plaintiff's attorney sends a preservation letter, you want to show exactly when each subscriber consented, what language they saw, and how the opt-out was honored. If you want a structured version, the LeadCompliant compliance kit includes a consent audit checklist and a consent language review template you can run against your setup.
How does Klaviyo's SMS compare to other platforms on compliance features?
Klaviyo sits in the middle of the field on compliance features. It has solid consent storage and suppression. Its form builder makes you add disclosure text blocks manually, where a platform like Attentive ships more opinionated compliance templates. Here is an honest comparison on the features that matter for TCPA and GDPR.
| Feature | Klaviyo | Attentive | Postscript | Twilio (raw API) |
|---|---|---|---|---|
| Consent timestamp storage | Yes | Yes | Yes | Manual/DIY |
| Double opt-in support | Yes | Yes | Yes | Manual/DIY |
| Quiet hours enforcement | Yes | Yes | Yes | Manual/DIY |
| Carrier opt-out (STOP) handling | Yes | Yes | Yes | Yes (built-in) |
| Consent source tracking | Yes | Yes | Limited | Manual/DIY |
| GDPR data subject tools | Partial | Partial | Limited | None |
| Form disclosure builder | Partial | Yes | Yes | None |
Twilio's raw API gives you full control and zero guardrails. That is power for an engineering team and a trap for everyone else.
None of these platforms will stop you from importing a bad list. That stays a human process problem, not a software problem, across every major SMS tool. For a wider look at how these compare in practice, our text message marketing software guide covers the landscape.
What should your Klaviyo SMS opt-out flow look like?
Opt-out handling is the easiest piece of TCPA to get right and still goes wrong in practice. The statute requires that opt-out requests be honored promptly, and the FCC treats "promptly" as meaning before the next message goes out [12].
Klaviyo processes STOP replies in real time through the carrier network. When a subscriber texts STOP, the carrier flags the number and Klaviyo marks the profile unsubscribed. That sequence usually completes in seconds. The risk is what happens next.
If you scheduled a campaign that was already queued when the STOP arrived, check whether Klaviyo's suppression catches it before delivery. For immediately queued sends, the suppression check runs at send time, so a STOP processed before the send executes will suppress the message. For batch sends already submitted to the carrier, suppression may not catch it. Know that window for any large-list campaign.
Handle opt-outs from non-standard channels too. Some subscribers reply UNSUBSCRIBE, CANCEL, QUIT, or NO THANKS. Klaviyo recognizes a range of opt-out keywords beyond STOP, but test your specific short code or toll-free number to confirm. The CTIA guidelines list the standard set of recognized keywords [6].
After a subscriber opts out, Klaviyo sends one confirmation message acknowledging it. That confirmation is standard practice and is exempt from TCPA's marketing consent rules, because it is a transactional response to the subscriber's own action. Do not add promotional language to it.
For re-opt-in programs, you can invite a suppressed subscriber to re-subscribe, but that invitation cannot go by SMS. It has to go by email or on-site, and the re-opt-in process has to capture a fresh consent event with full disclosure before any SMS resumes.
What state laws add extra SMS compliance requirements beyond federal TCPA?
Federal TCPA sets the floor. Several states have passed stricter telemarketing and data privacy laws that reach SMS marketing, and California and Florida are the ones that drive most nationwide programs [7].
Florida's Telephone Solicitation Act (FTSA) extended its reach in 2021 to cover automated text messages and gives Florida residents a private right of action with damages up to $500 per message [7]. Florida plaintiffs' attorneys have been busy under this statute. If you send to Florida numbers, make sure your consent specifically authorizes texts, more than calls, because some consent forms are drafted for calls only.
California's Consumer Privacy Act (CCPA) and its CPRA amendment treat phone numbers as personal information and give California residents the right to know, delete, and opt out of the sale of their data [8]. For SMS, that means you need a way to answer data subject requests for your Klaviyo list. Klaviyo's GDPR deletion tools work for CCPA requests too, but you need a process to receive and route them.
Washington's My Health My Data Act, effective through 2023 and 2024, covers health-related personal data and reaches any health or wellness brand collecting phone numbers tied to health conditions.
Texas and Oklahoma have their own telemarketing statutes with extra restrictions. The general rule: if you send to consumers nationwide, design your consent program to satisfy the strictest applicable state law, which usually means California and Florida.
For a state-by-state breakdown, our state laws hub covers the major jurisdictions. This moves fast, so check lead generation compliance news for recent changes.
What does a TCPA-compliant Klaviyo SMS program look like end to end?
A compliant Klaviyo SMS program has five layers working in sequence. None of them is optional, and each one is a place a program breaks.
Consent capture comes first. Your opt-in form, checkout page, or keyword capture carries all required disclosures, is not pre-checked, does not condition purchase on SMS sign-up, and records a timestamp and source in Klaviyo. If you use double opt-in, the confirmation text goes out before any marketing message.
List hygiene runs continuously. You do not import lists without consent documentation. You scrub against the National Do Not Call Registry for any voice calls (less directly relevant to SMS, but it matters if your program includes outbound calling). You cross-reference opt-outs from every other system before importing into Klaviyo.
Campaign execution respects quiet hours and time zones. Your account has quiet hours configured. Flows carry segment filters that exclude suppressed profiles. You test sending logic before launching new flows.
Suppression stays synchronized. If any other platform touches the same numbers, you run an automated or scheduled sync so opt-outs propagate both directions.
Consent records stay retained and accessible. Keep copies of the form language, more than the timestamp, for at least four years, the outer bound of TCPA's statute of limitations [11]. You can pull the consent record for any single subscriber within a reasonable time if a dispute lands.
Starting from scratch? The opt-in sms marketing guide is a good first read. Already sending? An audit against the checklist above finds the gaps faster than a full rebuild. TCPA sms compliance is worth a read if you want the statutory analysis next to the operational steps.
No platform makes you compliant automatically. Klaviyo is a capable tool. Compliance is the process you run around it.
Frequently asked questions
Does Klaviyo automatically make my SMS program TCPA compliant?
No. Klaviyo gives you consent timestamps, opt-out processing, and quiet hours settings, but it cannot audit the language on your opt-in form, verify that imported numbers have valid consent, or stop you from sending to a list you built wrong. TCPA compliance is a process you own. The platform supports it. It does not guarantee it.
What is the TCPA penalty for sending a marketing text without consent?
TCPA statutory damages are $500 per violation for negligent violations and up to $1,500 per violation for willful or knowing ones under 47 U.S.C. § 227(b)(3). Because a single SMS campaign can reach thousands of recipients, class action exposure can reach millions fast. Courts can reduce awards but often do not when the non-compliance is clear.
Can I import a phone number list into Klaviyo and start sending SMS?
Technically yes, Klaviyo accepts imports. Legally, no, not without documented prior express written consent for each number. Importing and marking profiles subscribed is an assertion that you hold valid consent. If you cannot produce the consent record for an imported number, you are exposed to TCPA liability for every message you send it.
Is Klaviyo SMS double opt-in required by law?
No, double opt-in is not a federal requirement under TCPA or FCC rules. It is a strong evidentiary safeguard. A confirmed opt-in reply creates a timestamped record that is hard for a plaintiff to dispute. Klaviyo supports SMS double opt-in natively, and the small drop in list size is usually worth the protection.
How does GDPR apply to Klaviyo SMS if I have European customers?
GDPR Regulation (EU) 2016/679 requires a lawful basis to process personal data, and a phone number is personal data. For marketing SMS to EU contacts, explicit consent under Article 7 is the standard. That consent has to be specific, informed, affirmative, and easy to withdraw. Klaviyo's consent records support GDPR documentation, but you also have to keep the form language shown at the time of consent.
What opt-out keywords does Klaviyo recognize for SMS?
Klaviyo recognizes standard opt-out keywords including STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, and QUIT, which line up with CTIA guidelines. When a subscriber sends any of these, the carrier processes the opt-out and Klaviyo updates the profile to unsubscribed. Test your specific short code or toll-free number to confirm keyword handling works as expected.
Do I need separate consent for SMS and email in Klaviyo?
Yes. TCPA requires specific written consent for marketing texts. An email marketing opt-in does not satisfy it, even if the subscriber gave their phone number in the same transaction. Klaviyo tracks email and SMS consent as separate channel attributes. You need a form element that explicitly references SMS messages, with the required disclosures, before you can lawfully text.
How long do I need to keep Klaviyo SMS consent records?
TCPA has a four-year statute of limitations under 28 U.S.C. § 1658, which most practitioners use as their retention floor. Keep the consent timestamp, the consent source, and a copy of the form language the subscriber saw at opt-in for at least four years from the date of the last message sent to that subscriber.
What are the quiet hours rules for Klaviyo SMS?
TCPA prohibits calls and texts before 8 a.m. or after 9 p.m. in the recipient's local time under 47 U.S.C. § 227. Klaviyo's quiet hours settings block sends during those windows. The setting uses the subscriber's profile time zone, so profiles without location data may default to the account time zone. Verify your configuration and check how profiles without time zone data are handled.
How do the FCC's 2024 one-to-one consent rules affect Klaviyo SMS?
The FCC's December 2023 order requires that consent name the specific seller, not a broad category of marketing partners. For Klaviyo brands collecting consent on their own website, the impact is minimal since the brand is already named. The bigger impact hits brands that acquire leads from third-party lead generators or co-registration programs, where the consent form must now specifically identify your brand.
Can I send transactional SMS through Klaviyo without marketing consent?
Yes, for purely transactional messages like order confirmations and shipping updates, the consent standard is lower. But if a transactional message adds promotional content such as a discount code, upsell, or referral ask, it becomes a marketing message under TCPA and needs prior express written consent. Draw a clear line in your Klaviyo flow content between transactional and promotional messaging.
What happens to Klaviyo SMS suppressed profiles under GDPR?
Klaviyo's suppressed SMS profiles keep the phone number in your account after opt-out. Under GDPR, continued storage of personal data needs a lawful basis beyond consent once consent is withdrawn. For EU contacts, periodically purge suppressed profiles or document an alternative lawful basis for retention. GDPR Article 17 gives data subjects the right to erasure, which applies to suppressed phone numbers.
Does Klaviyo SMS work with the National Do Not Call Registry?
The National DNC Registry at donotcall.gov mainly covers outbound voice calls, not text messages, under current rules. SMS is governed by TCPA consent requirements rather than the DNC Registry. Some state laws extend DNC-style protections to texts. Klaviyo does not scrub against the DNC Registry automatically, and that scrub is more relevant if your program includes any voice outreach.
Sources
- U.S. Government, 47 U.S.C. § 227 (Telephone Consumer Protection Act), full statute text via Legal Information Institute: TCPA requires prior express written consent for marketing texts, prohibits calls and texts before 8 a.m. or after 9 p.m. local time, and sets damages at $500 per violation ($1,500 for willful violations)
- Klaviyo, SMS Consent and Compliance documentation: Klaviyo records SMS consent timestamps and sources, supports double opt-in, and automatically suppresses numbers that reply STOP through carrier opt-out handling
- European Parliament, General Data Protection Regulation (EU) 2016/679, Articles 5, 6, 7, and 17: GDPR requires a lawful basis for processing personal data, mandates explicit affirmative consent for marketing, gives data subjects the right to withdraw consent and request erasure, and requires records of consent
- Florida Legislature, Florida Telephone Solicitation Act, Fla. Stat. § 501.059: Florida's FTSA as amended in 2021 extended restrictions to automated text messages and created a private right of action with damages up to $500 per text for Florida residents
- California Attorney General, California Consumer Privacy Act (CCPA) and CPRA overview: CCPA and CPRA treat phone numbers as personal information and give California residents rights to know, delete, and opt out of sale of their personal data, applicable to SMS subscriber lists
- Federal Trade Commission, National Do Not Call Registry, donotcall.gov: The National Do Not Call Registry primarily covers outbound voice calls; text messages are governed separately under TCPA consent requirements rather than the DNC Registry
- U.S. Code, 28 U.S.C. § 1658, general four-year statute of limitations for federal civil actions: The four-year general statute of limitations under 28 U.S.C. § 1658 applies to TCPA claims, setting the floor for how long SMS consent records should be retained
- 47 C.F.R. § 64.1200, FCC implementing regulations for TCPA, via Electronic Code of Federal Regulations: 47 C.F.R. § 64.1200 codifies the FCC's TCPA rules including specific disclosure requirements for written consent to receive marketing calls and texts and the requirement to honor opt-outs promptly