How to Identify Anonymous Shopify Visitors and Add Them to Klaviyo

Klaviyo can only email a visitor, or send them through a flow, once it has identified them. A visit on its own doesn't identify anyone. There are three ways to identify more of your Shopify visitors: Klaviyo's own identification, first-party identity resolution for returning customers, and third-party visitor identification for shoppers who never gave you an email.

This is the Shopify and Klaviyo chapter of our website visitor identification guide. Upstack Data sells a product for the second and third routes, and we say so where they come up. Klaviyo, Shopify and vendor details were checked against their own documentation on October 24, 2026.

The three ways to identify Shopify visitors for Klaviyo

Work through them in that order: switch on everything Klaviyo offers, recover the customers you already have, then decide whether paying for new contacts makes sense.

---

1. How does Klaviyo identify Shopify visitors?

Klaviyo identifies a browser when the shopper submits a Klaviyo form, clicks a link in a Klaviyo email or SMS, or enters contact details at checkout. Until one of those happens, the visitor is anonymous to Klaviyo.

Klaviyo's onsite script sets a first-party cookie, __kla_id, on your domain. Klaviyo's cookie documentation lists what ties it to a profile: a Klaviyo sign-up form, a click from a Klaviyo email or SMS (email-to-website tracking adds a _kx parameter to your links) and Shopify checkout events. A visit alone doesn't make a browser known.

That is why the Active on Site metric counts only identifiable browsers. Klaviyo records it when one starts a browsing session, and a session ends after 60 minutes of inactivity (Klaviyo). Compared with your Shopify sessions for the same week, it's a rough measure of how much of your traffic Klaviyo can act on.

Known shoppers also become unknown again. Klaviyo sets __kla_id to last two years, but Safari deletes it after seven days of browser use without interaction with your site, and Brave caps JavaScript-set cookies at seven days.

What to turn on in Klaviyo

Does Klaviyo have its own visitor identification tool?

Not for visitors who have never identified themselves. First-Party ID and Extended ID only re-identify people who already have a profile, and Klaviyo's help articles for both say so directly.

Depending on your Shopify Customer Privacy settings, Klaviyo may not track visitors in the EU, EEA, UK and Switzerland until they consent, which also keeps them out of browse abandonment.

---

2. How do you recognize returning customers Klaviyo has lost?

Use first-party identity resolution. Match the returning visit to a customer you already know, then send the event to the Klaviyo profile they already have, so the flow fires.

Klaviyo's identification lives in one browser. A subscriber known on their phone is a stranger on their laptop, in another browser or after Safari deletes the cookie, so their cart never reaches the profile they already have. First-party identity resolution links the visit to the person using data you already hold: checkout and sign-up emails, logins and clicks from your own emails (how the matching works).

How Upstack Signal does it. Upstack Signal matches each visit against your first-party data and Upstack's graph of 750M+ devices and 150M+ customers, using deterministic and probabilistic matching. An Upstack ID lasts the life of the customer, not the life of a cookie. Signal finds the shopper's existing Klaviyo profile, first by the _kx ID on email clicks and then by email address, and adds the event to it. If there is no profile, nothing is sent and no contact is created. Our team mirrors your browse, cart, checkout and site abandonment flows as "Upstack Data" copies that wait 30 minutes longer than the originals, and a 7-day exclusion means nobody gets both.

The Klaviyo flow recovery page shows the setup, and haircare brand Champo recovers $24K a month in abandoned carts with Upstack. Signal is $149 a month for up to 1,000 orders a month, with a 21-day free trial.

---

3. How do you identify visitors who never gave you an email?

Only third-party visitor identification can. A vendor matches the anonymous visitor against an opt-in consumer network and sends you a verified contact, which arrives in Klaviyo as a new profile.

These tools put a pixel on your store, look the visitor up in an outside dataset and deliver the match to your email platform. Here is how each vendor describes its own product:

Upstack Audience is our product, so weigh this paragraph accordingly. It matches anonymous visitors to verified contacts from our partner data network, delivers them to Klaviyo or Omnisend, and sends the match to Meta, where upper-funnel events reach an Event Match Quality of 8+. One identified visitor is one match, even when it carries several emails or phone numbers. Packages are 8,000 matches for $200 a month, 25,000 for $500 ($0.020 each) and 80,000 for $1,200 ($0.015 each), billed monthly on a yearly plan you can opt out of within 60 days. Unused matches roll over. Partner data is collected on an opt-in basis, and California residents can opt out under the CCPA. Audience is an add-on to a Signal plan, and its only email destinations are Klaviyo and Omnisend. In a September 2025 pilot, a Shopify apparel brand logged 106 orders in the first 7 days. Shoppers Audience identified made up 7 to 8% of its daily orders, and the flow's unsubscribe rate was 2.8%.

Retention.com says everyone in its network has opted in to partner marketing and that it keeps verifiable consent records with timestamp, source and IP. It says it also fires your existing flows for known subscribers shopping anonymously, and that it collects no net-new anonymous data from the EU or UK. Opensend also sells Reconnect, a separate product that recognizes returning customers across devices. For contracts and more tools, see our comparison of Retention.com alternatives.

---

What consent rules apply to emailing identified visitors?

It depends on where the shopper lives and what your email platform allows. US law sets opt-out rules, UK rules generally require consent before marketing email, and Klaviyo's own policy restricts third-party lists. This section is general information, not legal advice.

• United States. The FTC's CAN-SPAM compliance guide doesn't require prior consent for commercial email. Each message needs accurate headers and subject lines, a valid physical postal address and a working opt-out honored within 10 business days, and each violating email can cost up to $53,088.
• United Kingdom. The ICO says you must not send marketing emails to individuals without specific consent, and the soft opt-in for existing customers doesn't cover new contacts.
• Your email platform. Klaviyo's Acceptable Use Policy, updated April 9, 2026, bars sending to contacts that were purchased, rented, borrowed or provided by a third party, and to any list that hasn't consented to hear from your business. Ask any vendor how its consent basis fits those terms.
• Your store. Shopify collects data from visitors in regions you set as requiring consent only after they consent (Shopify). Name your identification tools in your privacy policy.

What to ask a visitor identification vendor

1. Where does the data come from, and what did each consumer opt in to? Ask for a sample consent record.
2. Which countries does it cover, and are EU and UK visitors excluded?
3. Is every email verified before it reaches Klaviyo?
4. What happens to shoppers already in your account? You want an update or a separate list, not a duplicate.
5. What email consent status do new profiles get? Klaviyo lets "never subscribed" profiles receive flow and campaign emails but recommends caution, and they can't get SMS marketing until they opt in.
6. How do unsubscribes and CCPA opt-outs pass between you?
7. What will it add to your Klaviyo bill? Klaviyo bills on active profiles: any profile that can be emailed, whatever its consent status.

Gmail's sender guidelines say to keep the spam rate in Postmaster Tools below 0.10% and never reach 0.30%. Start new contacts in flows that match what they just did on your site, and keep them out of campaigns until complaint rates look normal.

How to set up Klaviyo flows for identified visitors

Point identified visitors at three flows: a welcome flow for new contacts, browse abandonment for product views, and cart or checkout abandonment for carts. Give each source its own list or segment so you can measure it.

1. Turn on onsite tracking. In Klaviyo's Shopify integration, check Track behavioral events, turn on the Klaviyo app embed in your theme and confirm Viewed Product tracking is selected.
2. Switch on re-identification. Enable Anonymous backfill and Extended ID under Settings > Data > Onsite identification, and add First-Party ID if you can edit your DNS. Update your cookie notice first.
3. Keep each source on its own list. Ask the vendor which list or profile property its contacts arrive with, and segment on it. If you import contacts yourself, set list-triggered flows to Manual first, because a live flow schedules its first message for everyone imported.
4. Build a welcome flow for identified contacts. Trigger it on Added to list for the vendor's list. These shoppers never filled in your form, so the first email should say who you are and why they're hearing from you, with a visible unsubscribe link.
5. Check browse abandonment. It triggers on Viewed Product. Klaviyo recommends at least a one-hour delay and filters for Placed Order and Started Checkout zero times since starting the flow.
6. Check cart and checkout abandonment. Klaviyo's pre-built abandoned cart flows trigger on Started Checkout, with Added to Cart as an optional second flow. Send the first message 2 to 4 hours after the trigger, and turn off Shopify's own abandoned checkout emails under Apps > Messaging > Automations (Shopify). Our abandoned cart guide has a template.
7. Use one source per trigger. If Klaviyo, Signal and a vendor can all send Added to Cart for the same shopper, pick one per flow, or the shopper gets the email twice.

Identified contacts also make better ad audiences, which our guide to using Klaviyo data to improve ad performance covers.

---

How to measure whether it worked

Compare new profiles, flow entries and orders from identified visitors with a holdout group that wasn't contacted. If you can't run a holdout, compare the same numbers with the four weeks before you switched it on.

Record a four-week baseline first:

Treat Klaviyo's flow revenue as an upper bound. By default Klaviyo uses last-touch attribution with 5-day windows for email opens and clicks, so a shopper who would have bought anyway still counts.

A holdout shows how much of that revenue is extra. Klaviyo's global holdout groups need at least 400,000 profiles, so smaller stores can ask the vendor to hold back a random share of identified visitors instead. An illustration with round numbers:

Lift is (2.0 − 1.2) ÷ 1.2, or about 67%. At the holdout's rate the contacted group would have placed 48 orders anyway, so 32 of the 80 orders (40%) are incremental. Divide the tool's cost for the test period by 32 for your cost per incremental order. Our incrementality testing guide covers how to size and read a test.

Without a holdout, compare per-session numbers for four weeks before and after, and avoid periods where a sale or launch falls in only one of the two.

---

Frequently asked questions

Can Klaviyo identify anonymous visitors on its own?

Only after they identify themselves through a Klaviyo form, a click from a Klaviyo email or SMS, or checkout. Klaviyo's First-Party ID and Extended ID re-identify people who already have a profile, but neither creates profiles for visitors who have never given you an email.

How do I add anonymous Shopify visitors to Klaviyo?

First let Klaviyo identify everyone it can, with onsite tracking, sign-up forms, Anonymous backfill, Extended ID and First-Party ID. Then recover lost returning customers with first-party identity resolution. For shoppers who never gave you an email, a third-party visitor identification tool can add verified contacts to a Klaviyo list once you've checked its consent basis.

What is the __kla_id cookie?

__kla_id is Klaviyo's main first-party cookie, set on your domain by its onsite script. It links the browser to a Klaviyo profile once the visitor is identified. Klaviyo sets it to last two years, but Safari deletes it after seven days without interaction with your site.

Why isn't my Klaviyo browse abandonment flow triggering?

Browse abandonment triggers on Viewed Product, which on Shopify needs the Klaviyo app embed and Viewed Product tracking. It also needs a known browser, so anonymous visitors, shoppers on a new device and Safari visitors with an expired cookie don't trigger it. Visitors in the EU, EEA, UK and Switzerland may not be tracked until they consent.

Is it legal to email visitors identified by a third-party tool?

It depends on where the shopper lives and on the vendor's consent basis. US email follows CAN-SPAM's opt-out rules, while UK rules generally require specific consent before marketing email to new contacts, and Klaviyo's Acceptable Use Policy restricts third-party lists. Ask the vendor for its consent records and check your setup with counsel.

Do identified visitors count toward my Klaviyo bill?

Yes, if they can be emailed. Klaviyo bills Profile and Email plans on active profiles and emails sent, and any profile that can be emailed counts as active whatever its consent status. If new contacts take you past your plan's profile count, Klaviyo moves you to a higher tier at the next billing cycle.

---

Want to know how many of your Shopify visitors Klaviyo can't see? Request a demo and we'll compare your carts with your flow entries on the call.