GDPR-friendly A/B testing without cookies: what EU websites should check

Two sets of rules, two questions

The ePrivacy Directive (Article 5(3)) covers storing information on, or reading it from, a visitor's device: that is allowed only with consent or where it is necessary for the specific purposes the article lists. The European Data Protection Board says the provision does not apply exclusively to cookies but also to "similar technologies", and its guidelines discuss local storage alongside cookies (EDPB Guidelines 2/2023).

The GDPR covers personal data: identifiers, IP addresses, anything that can single out a visitor. It asks for a lawful basis, a data processing agreement (DPA, Article 28) with every processor, and safeguards for transfers outside the European Economic Area.

A testing script touches both. To show a returning visitor the same version, it usually stores an assignment on the device (ePrivacy). To measure the result, it sends something back to a server (GDPR, if that is personal data). A tool can reduce both, but no tool can decide the legal question for you.

Why "without cookies" isn't the whole answer

• Replacing cookies with local storage changes the technology, not the rule: device storage is still device storage.
• Fingerprinting instead of storage is no way out either; the EDPB guidelines build on the earlier Article 29 Working Party opinion that fingerprinting falls under the same article.
• Truly storing nothing has a statistical cost: a returning visitor can't be recognised, may land in another version, and multi-visit journeys (travel, B2B) dilute the effect.
• What happens after storage matters as much: a tool that keeps per-visitor event logs or session recordings processes far more personal data than one that keeps daily totals.

What to check in a tool

The consent decision

With a cookie banner on the site, there are two set-ups. Either the testing script always loads and itself holds back until the consent manager says yes (no flicker on the first consented page; visitors without consent see the original), or the consent manager blocks the script until consent (it then runs late, so the first consented page shows the original, and samples are smaller). Which one is allowed depends on how you classify A/B testing, and that is your decision.

Vendors put it the same way. Kameleoon's documentation offers a "consent required" and a "consent not required" policy, says the level depends on the applicable legislation, and advises consulting your DPO for the final decision (Kameleoon docs). AB Tasty's documentation offers no restriction, consent handled by a third-party tool, or consent delegated to AB Tasty's tag, and calls two of its own detection methods (any page action, or any other cookie, counting as consent) legacy methods that don't comply with ePrivacy, for staging only (AB Tasty docs).

Tools EU sites often consider

• PostHog: PostHog Cloud EU is hosted in Frankfurt, its GDPR page points to how to get a signed DPA, and it links a guide to cookieless tracking (PostHog docs).
• GrowthBook: can run on your own infrastructure with Docker Compose or a Helm chart, so the data stays where you host it (GrowthBook docs).
• Kameleoon and AB Tasty: consent settings built into the product, described above.
• Duelpilot: no cookies, daily totals, EU hosting and a public DPA, described below.

Each vendor's DPA and sub-processor list is the document to read before you decide.

How Duelpilot handles it

• No cookies. The script keeps a random visitor id and the versions shown in the browser's own storage on your domain (dp_vid, dp_first, dp_a in local storage). In cookieless mode they live in session storage and are gone when the tab closes, so returning visitors may switch versions. The random id stays in the browser: the script does not send it to us.
• Consent modes: off, Google Consent Mode, IAB TCF, Cookiebot or OneTrust categories, or an explicit call from your own code. In every mode but off, a visitor without consent gets the original page and nothing is stored or counted; a withdrawal stops counting at once.
• We count, we don't track: a few counting pings per test (version shown, goal converted, device type, new or returning) become daily totals. No visitor-level records, profiles or session recordings. About 1% of pageviews send a health ping with the page path.
• IP addresses are used in memory only, as a hash with a daily-changing salt for rate limiting, and never stored with the counts.
• The version shown is passed to the analytics tools you already use, such as GA4, where your own consent settings apply.
• A Data Processing Agreement under GDPR Article 28, part of the terms (a signed PDF on request). Hosting in Frankfurt on DigitalOcean; Cloudflare only for DNS and forwarding email to our addresses. Visitor data is never transferred outside the EEA.

Whether Duelpilot may run before consent, and in which banner category, stays your decision: the agent explains the two set-ups and asks you, and an owner sets the consent mode. Details are in our privacy policy and cookie policy.

Try Duelpilot with your own agent