Klaviyo vs. Customer.io for Restricted Industries

Klaviyo's acceptable use policy (updated April 9, 2026) prohibits offering gambling, prescription medications, medical therapies and telehealth. Customer.io's policy (revised November 2024) doesn't ban gambling as a category, but it requires consent, age gating and proof of controls for gambling-related SMS and mobile messages. It prohibits U.S. offers for prescription medication and prohibits sending protected health information. Cosmetic products, including cosmetic peptide skincare, aren't named on Klaviyo's prohibited list; confirm your use case with the vendor.

WIN is a Klaviyo Master Platinum agency, and for most ecommerce brands we still recommend Klaviyo. Its policy is also clear about who it isn’t for. Its list of products and services you may not offer includes gambling (it names online poker, casino games, lotteries, and college and pro sports betting) and prescription medications, pharmaceutical products, medical therapies and telehealth. It also bars soliciting, storing or sending medical records or health information, including protected health information.

If your brand falls in those categories and runs on Klaviyo today, the risk isn’t theoretical. It’s a policy violation waiting to be noticed.

Customer.io takes a rules-based approach rather than a category ban for gambling. In its SMS and mobile section, messages related to gambling, alcohol, tobacco and similar categories require recipient consent, age gating by the recipient’s location, content lawful where the recipient lives, and proof those controls exist. Customer.io also reserves the right to decline any account.

• Gambling: not banned as a category; SMS and mobile messages need consent, age gating and proof of controls
• Prescription medication: U.S. offers for prescription drugs that can’t be sold over the counter are prohibited
• Health data: content with diagnostic information, test results or similar PHI is prohibited
• Anything unlawful where the recipient lives is prohibited

For telehealth that means promoting the care service and membership rather than the drug, and keeping clinical messages in a HIPAA-covered system. For gaming it means gating every send.

Use this order of questions:

1. Is my category allowed by the platform’s published policy?
2. Can I keep health data and other sensitive fields out of marketing messages?
3. Does the platform model my data: app events, subscriptions, objects, not just orders?
4. Can it gate by age and geography if my category requires it?
5. Can my team, or my agency, actually operate it well?

Feature comparisons come after those five. A great feature on a platform you’re not allowed to use is a liability.

A safe migration protects the two things that are hardest to rebuild: consent records and sender reputation.

• Export profiles with consent source and timestamp, plus every suppression list
• Rebuild the tracking plan around events, not just orders
• Recreate the journeys that make money first; retire the rest
• Warm up sending domains and IPs on your most engaged segments
• Run both platforms in parallel until the new journeys beat the old baseline

Reviewed by Damon Didier, Owner & CEO of WIN, with 18+ years in email and lifecycle marketing. Last reviewed October 23, 2026.

Policies and regulations change, so we review these pages at least quarterly. This page is general information, not legal advice.

• Klaviyo Acceptable Use Policy (updated April 9, 2026)
• Customer.io Acceptable Use Policy (revised November 2024)