The change

Klaviyo is an email and SMS marketing platform used by many online stores. On November 4, 2026, it published a new version of its Cookie Notice, the page that explains how its websites and app track visitors. The version it replaces was effective November 6, 2025.

Most of the update covers Klaviyo’s mobile app. One new paragraph covers something else: who you are when you visit Klaviyo’s website.

What changed

• Visitors can be identified. Klaviyo uses a provider that matches your IP address and browsing to a company or a person.

• The match can name you. It may include your name, work email, job title and company.

• It is used for sales. Klaviyo says the purpose is lead generation and sales outreach.

• Browser privacy signals now count. Klaviyo’s websites treat signals like the Global Privacy Control as an opt-out request.

How the visitor identification works

The new paragraph sits in the section on what Klaviyo collects with cookies. It says: “On our websites, we also use a service provider's visitor identification technology that matches your IP address and browsing activity to a company or business contact (which may include a name, business email address, job title and company).”

The next sentence gives the purpose: “We use this information to identify organizations and individuals that visit our websites for lead generation and sales outreach.” Klaviyo adds that “The provider acts on our behalf and may not use this information for its own purposes.”

In plain words, you do not have to fill in a form. Your IP address and the pages you read can be enough for Klaviyo to work out which company you are from, and sometimes who you are, and pass that to its sales team.

The notice does not name the provider and does not explain how a visit is matched to a specific person.

What was there before

The November 2025 version already said Klaviyo collects “your IP address, operating system, browser type, date/time of your visit, and other similar information”, and that it uses advertising and analytics cookies. It said nothing about matching visits to companies or people, or about using visits for sales outreach.

Klaviyo’s main privacy policy is still dated October 2, 2026 and does not describe visitor identification. For now, the Cookie Notice is the only one of the two that discloses it.

Your choices

The Cookie Notice points you to its cookie tool: “You can visit our cookie management tool to manage your cookie preferences”. It also says “Our websites treat opt-out preference signals, such as the Global Privacy Control (GPC), that your browser sends as a request to opt out of targeted advertising cookies”. The same signal also counts as an opt-out from the sale or sharing of your personal information on that browser or device.

The notice does not say whether either choice stops visitor identification. If you want to limit it, the practical steps are to reject non-essential cookies in Klaviyo’s cookie settings and to turn on a browser signal such as the Global Privacy Control. For visitors with a European IP address, the notice says Klaviyo asks for consent to analytics cookies.

Why this matters

Visitor identification tools are common in B2B sales, and they change what a quiet look at a vendor’s website means. Comparing tools used to be anonymous until you asked for a demo. Now the visit itself can start a sales conversation.

Business contact data keeps moving into sales tools. Zoom now says it may sell business contact data, and HubSpot collects email engagement data for its commercial dataset. This is also not the first time Klaviyo’s privacy terms changed: Klaviyo no longer promises to pass privacy requests on to you.

There is a second lesson for your own company. If your website uses a visitor identification tool, your cookie notice and privacy policy should say so, and both should match.

Potential impact

Check four things:

• Does your team research vendors like Klaviyo from work devices before you are ready to talk to sales?

• Have you set Klaviyo’s cookie settings, or turned on a browser privacy signal such as GPC?

• Does your own website identify visitors, and do your cookie notice and privacy policy both say so?

• Do you know which of your vendors use visitor identification on their sites?

How Venpo detected it

Venpo monitors Klaviyo’s legal pages and compared the November 4, 2026 Cookie Notice line by line with the November 6, 2025 version on record. The details are on the Klaviyo Cookie Notice change page. Every quote in this article was checked against Klaviyo’s live pages and the November 2025 version of the notice at the time of publication.

Business outcome

Teams that catch this can decide how they research vendors, set their privacy choices before they browse, and check their own disclosures. Teams that miss it find out when a sales email arrives after a visit nobody announced. That is the case for continuous vendor risk monitoring and for continuous monitoring of vendor legal changes.

Key takeaway

Since November 4, 2026, Klaviyo’s Cookie Notice says it matches website visitors’ IP address and browsing activity to a company or business contact, including name, work email and job title, for lead generation and sales outreach, while its main privacy policy does not yet describe this.