A/B testing and personalisation tools generally require prior consent in the EU/EEA and UK when they store or access information on a visitor’s device for a non-exempt purpose. Not every experiment or personalisation feature needs cookie-consent opt-in.

• Across the EU/EEA, website optimisation alone does not make tracking strictly necessary. France permits certain narrowly limited statistical measurement without consent, although this does not automatically cover assigning visitors to different page versions. In Ireland, analytics cookies require consent.
• Qualifying statistical A/B tests in the UK can run without prior opt-in, provided visitors receive clear information and have a simple, free way to object.
• Ordinary First-party A/B testing generally does not require prior Cookie Consent in the US simply because cookies are used. State privacy laws may require notices and opt-outs for data sales or targeted advertising, while certain uses of sensitive or children's information require consent.

A/B testing shows different versions of a webpage or feature to different groups of visitors and compares how they perform. Personalisation adapts the content or experience visitors receive based on their preferences, behaviour or other information.

A genuinely server-side test that involves no relevant device storage or access may avoid a separate consent requirement for variant selection, although its analytics or other tracking may still require consent.

In the EU/EEA and UK, user-selected interface preferences can qualify for narrow exceptions; behavioural personalisation and targeted advertising require consent when they use non-exempt device tracking. First-party status, session-only storage or a “cookieless” label does not itself create an exemption.

Where personal data is processed, GDPR or UK GDPR requirements also apply, even when device-access consent is unnecessary.

Two Legal Questions Behind Cookie Consent in the EU/EEA and UK

The first concerns storage of or access to information on a visitor’s device. In the EU/EEA, Article 5(3) of the ePrivacy Directive is implemented through national law. In the UK, the Privacy and Electronic Communications Regulations (PECR) govern the equivalent activity. These rules can apply even where no personal data is involved. A browser value containing only variant=A, for example, still represents information stored on a device.

The EDPB’s technical-scope guidelines address other mechanisms, including tracking pixels and links. Local storage, browser identifiers and fingerprinting can also involve relevant storage or access.

The second question concerns processing personal data under the GDPR or UK GDPR. Experiment assignments and activity records may become personal data if they can be connected to an identifiable visitor, including through an account or other identifier. That brings lawful-basis, transparency, minimisation, retention and other data-protection duties into play.

A legitimate-interests assessment cannot replace consent required for device access; equally, an exception from device-access consent does not remove the separate data-protection obligations. The EDPB’s opinion on the interaction between ePrivacy and GDPR explains this distinction.

EU/EEA: Website Optimisation Is Not Automatically Necessary

Under Article 5(3), consent is generally required unless storage or access is solely for transmitting a communication or is strictly necessary to provide a service explicitly requested by the user. The scope of these exceptions depends on national law and regulatory guidance.

Consider an online checkout. A shopping-basket cookie that remembers what the visitor intends to buy helps deliver the requested purchase. An identifier used to compare which checkout design produces more sales serves an optimisation purpose. It does not become strictly necessary simply because the experiment benefits the business. The European guidance on cookie-consent exemptions examines that distinction.

France: A Narrow Route for Statistical Testing

France’s CNIL guidance on audience measurement recognises that certain trackers can operate without consent when their function remains strictly within the exemption. Relevant conditions include:

• Measurement for the website or app publisher’s exclusive benefit, limited to its own audience or performance.
• Anonymous statistical outputs, rather than individual behavioural profiles.
• No combining the information with unrelated processing or passing non-anonymous data to independent third parties.
• No tracking of a person’s activity across different websites or applications.

Measurement of some A/B tests may meet those conditions; a tool that also builds advertising audiences or chooses personalised content cannot rely on the measurement exemption for those additional purposes.

The CNIL recommends informing users and limiting tracker lifetimes and collected-data retention. It gives 13 months as an example of an appropriate tracker lifetime, without automatic extension on return visits, and recommends retaining collected information for no more than 25 months.

These recommendations do not automatically authorise equivalent retention for every experiment identifier. Where personal data is processed on the basis of legitimate interests, the CNIL also calls for an accessible way to object.

The CNIL’s July 2025 self-assessment framework also excludes creating visitor groups to display different content, even where assignment is random.

Other configurations may still qualify if the exemption can be justified, but an exemption for measuring A/B outcomes should not be assumed to cover variant assignment.

Ireland: Analytics Cookies Require Consent

The Irish Data Protection Commission requires consent for analytics cookies, including first-party analytics used only by the website operator. A statistical configuration that may qualify for an exemption in France should not be deployed on the assumption that the same consent-free arrangement is accepted in Ireland.

UK: Some Statistical A/B Tests Can Run Without Opt-In

The UK introduced additional PECR exceptions to its storage and access rules on 5 February 2026 through the Data (Use and Access) Act 2025 and its commencement regulations.

The statistical-purposes exception can apply where:

• Storage or access is solely to collect statistics about use of a website or service with a view to improving it.
• Information is shared only to enable another party to assist with those improvements.
• Visitors receive clear and comprehensive information about the purpose.
• Visitors have a simple, free means of objecting, and have not objected.

The ICO’s guidance on exceptions identifies A/B tests comparing aggregate interactions with two versions of a page as likely candidates. The resulting statistics must not identify people. Where individual-level personal data is collected to produce those results, it must be aggregated and retained only for as long as necessary for that process.

The exemption does not cover tracking an individual’s browsing journey for profiling or advertising. Nor does it permit conversion information to be shared with advertising partners merely because that information originated in an experiment.

A third-party analytics provider may assist with qualifying measurement, but the ICO requires it to act on the publisher’s behalf as a processor where personal data is involved, without independently combining the information with its other datasets.

Consent and objection are different controls. A qualifying UK statistical test may not require prior opt-in, but it still needs the specified information and a working way to object. If the operation exceeds the exemption, prior consent is required.

United States: A/B Testing, Advertising and State Privacy Rights

The US does not have a nationwide rule equivalent to the EU/EEA requirement for consent to non-exempt device storage or access. A first-party A/B test is not automatically subject to prior cookie opt-in simply because it uses a browser identifier. Instead, applicable state privacy laws focus on personal-information practices, notices and rights such as opting out of data sales or targeted advertising.

California: CCPA and CPRA

The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), applies to businesses meeting its coverage requirements.

• Covered businesses must provide a notice at collection describing the Personal Information collected and its purposes.
• California residents can opt out of the sale of Personal Information or its sharing for cross-context behavioural advertising.
• Businesses must honour applicable Global Privacy Control (GPC) signals expressing that choice.

Measuring which version of a checkout page produces more purchases for the website's own use does not, by itself, establish a sale or advertising-related sharing. But forwarding visitor identifiers and conversion events to an advertising partner for retargeting may trigger those rights. The CCPA's term sharing has a specific advertising-related meaning; not every disclosure to a contracted service provider qualifies.

California also has separate rules on sensitive personal information and opt-in requirements for selling or sharing the personal information of children under 16. These are not a general opt-in requirement for ordinary first-party experiments.

Other States: Targeted Advertising and Sensitive Data

Under the Colorado Privacy Act, covered controllers must provide opt-outs for targeted advertising, data sales and certain profiling. They must also honour recognised universal opt-out mechanisms, including GPC, and obtain consent for specified sensitive-data processing and certain other uses. The Connecticut Data Privacy Act likewise provides targeted-advertising and sale opt-outs.

Children's Data: COPPA

The federal Children's Online Privacy Protection Rule (COPPA Rule) applies to covered services directed at children under 13 and certain services with actual knowledge of collecting their information. Persistent tracking identifiers can be personal information, so verifiable parental consent is generally required before collecting them unless an exception applies.

The FTC recognises a narrow support-for-internal-operations exception for certain uses of persistent identifiers, including qualifying site analytics, when the prescribed conditions are met. It does not cover behavioural advertising or building individual profiles.

How Different A/B Testing Setups Affect Consent

The duration of an experiment identifier, where it is stored and how results are measured can all affect the analysis.

Suppose a server selects page B without setting an experiment cookie. An analytics script on that page nevertheless reads a persistent visitor identifier and records clicks or purchases. The assignment might avoid additional experiment-related storage; measurement must still satisfy the applicable consent requirement or qualify for an exception.

An existing analytics cookie is not automatic permission to reuse it for another purpose. If the initial consent did not cover the experiment or subsequent advertising use, that additional activity needs its own assessment.

Personalisation: Chosen Preferences and Inferred Interests

A visitor who selects a language, text size or display preference has requested a particular interface setting. Under the EU framework, limited storage needed to deliver such a preference may be strictly necessary, depending on its design and duration. Remembering the preference across visits requires assessing what the visitor requested and what information they received.

The UK also has an appearance exception covering qualifying storage/access to adapt a site’s appearance or functionality to user preferences, or otherwise enhance its appearance or functionality. The statutory conditions require clear information and a simple, free means of objecting. The statute does not expressly impose a session-only limit on this exception.

However, the ICO’s settings-based consent guidance says consent must be obtained if preference technologies persist beyond the current session. A clearly explained “remember this setting” choice can provide an opportunity to obtain that consent without a separate site-wide banner.

For recommendations, the method matters:

• Using an inferred profile to choose promoted products, articles or adverts does not fall within the UK appearance exception merely because it changes what the visitor sees. Where that activity uses non-exempt device storage/access, consent is required.
• A recommendation generated on a server from personal data the organisation already lawfully holds does not necessarily create a new cookie-consent question. It may still involve GDPR or UK GDPR obligations, and any new browser identifier or tracking operation needs consideration on its own facts.

Random A/B allocation alone does not necessarily amount to profiling; profiling involves automated evaluation of personal aspects.

Consent, Data Protection and Working Controls

Where consent is required, it must be freely given, specific, informed and unambiguous.

• Pre-ticked options, silence and continued browsing do not provide valid consent.
• The request should explain the relevant purposes and third parties, allow meaningful choice and make withdrawal as easy as giving consent.

Where PECR consent is required and personal data is involved, the ICO advises using consent for the associated subsequent processing. If a PECR exception applies, another UK GDPR lawful basis may be appropriate. A separate right to object under data-protection law should not be confused with the objection mechanism required by the UK statistical or appearance exceptions.

How a CMP Can Support A/B Testing and Personalisation Compliance

A Consent Management Platform (CMP) can help apply visitor choices to A/B testing and personalisation technologies, particularly when several scripts or vendors are involved. Relevant capabilities include:

• Cookie Scanner identifies cookies and related technologies for assessing storage and access purposes. Automatic monthly scans can flag new trackers introduced by experimentation tools.
• Automatic script blocking helps prevent non-exempt experiment, analytics and personalisation scripts from running before consent. Third-party cookie blocking supports the same control for third-party technologies; server-set cookies and some requests need separate measures.
• User consents recording documents visitors’ consent choices, including changes and withdrawals.
• Consent events allow experiment and analytics tags to respond to visitor choices, while Google Tag Manager integration helps coordinate changes across tags.
• Geo targeting allows different banner configurations to be displayed according to visitors’ locations. Location detection alone does not establish their legal residency or which rules apply.
• Global privacy regulation support can help configure jurisdiction-specific consent and objection controls. Verify that any UK objection mechanism and US opt-out signals, including Global Privacy Control, actually work for the affected technologies.

CookieScript, a CMP, appears on Google’s list of partners available for Consent Mode setup. It is also a Google-certified CMP and received Gold tier status in Google’s CMP tiering system.

A Pre-Launch Checklist

1. Map the operations. Record which scripts, identifiers and browser or server interactions assign variants, remember choices, measure results and share information with vendors.
2. Check duration and recognition. Test page reloads, new tabs and return visits. Identify links between experiment data, analytics IDs and customer profiles.
3. Determine the rule for each jurisdiction. Record the relevant consent requirement, named exception or US notice and opt-out obligation, including any information and objection conditions. Do not apply a French exemption automatically to visitors in Ireland or the UK.
4. Separate purposes where needed. Disable unrelated advertising or profiling reuse, constrain retention, and distinguish exempt measurement from operations that require consent.
5. Configure the choices. Where prior consent is required, keep non-exempt storage/access inactive until it is obtained. Supply the necessary information, objection controls and means of withdrawal.
6. Test the real behaviour. Inspect cookies, browser storage, network requests and Set-Cookie headers before a choice, after rejection, after partial acceptance, after objection and after withdrawal. Repeat the tests when tools or vendors change.

Key Takeaways: Consent Depends on the Operation

An exemption for limited statistics or an explicitly requested setting does not automatically cover the platform’s other functions. Verify that the deployed technologies comply with the consent or objection requirements applicable to each function.