A/B testing and GDPR: what actually matters
First-party instead of third-party, your own server instead of someone else’s data centre.
What this article covers
This article is not legal advice. It describes which technical decisions make the data protection difference in A/B testing, the legal assessment is made by your data protection officer or your lawyer.
What an A/B test actually stores
Technically an A/B test needs exactly two things: an identifier so the same visitor sees the same variation on their next page view, and counters for exposures and conversions. No names, no e-mail addresses, no profile.
The difference between privacy-friendly and problematic rarely lies in that identifier, but in where it ends up and who else gets to see it.
First-party instead of third-party
If the testing script loads from a foreign domain, every request is contact with a third party, including the IP address, before anything is even measured. If the same script runs on a subdomain of your own site, that contact stays with you.
Practical side effect: first-party delivery is restricted less often by browsers and ad blockers, so your measurement has fewer gaps.
Consent: a switch, not good intentions
If you need consent, it has to work technically. That means: before consent nothing happens, no identifier, no event, no request. A tool that already measures “anonymously” beforehand makes your documentation hard.
The clean approach is the other way round: the script lies dormant until the consent manager releases it. In abdriven that happens through the data-consent="required" attribute and a call to abdriven.consent() once consent is given.
Five questions for any testing tool
- Where is the data, and who besides us has access to it?
- Is genuinely nothing stored or sent before consent?
- Can the script be delivered through our own domain?
- What is in the reports, aggregated numbers or individual visitors?
- How long is raw data kept, and can we decide that ourselves?
What remains
Privacy-friendly A/B testing is not a question of intent but of architecture: your own server, your own domain, consent as a switch, aggregated analysis. Set it up that way and you will not have to explain anything at the next audit that you cannot prove.