# Your A/B Test Needs Consent First: The Testing Cookies Nobody Banners

Source: https://cookiebastion.com/blog/2026-11-14-ab-test-needs-consent-first.html

[Home](../index.md) / [Blog](index.md) / Your A/B Test Needs Consent First: The Testing Cookies Nobody Banners


Published 2026-11-14

A team runs an A/B test on its homepage and calls it measurement, not tracking. The testing tool disagrees. VWO sets \_vis\_opt\_s and \_vwo\_uuid. Optimizely sets optimizelyEndUserId. Those cookies store a visitor ID, assign a variant, and track behavior across pages. Under Article 5(3) of the ePrivacy Directive, any storage of information on a visitor's device needs prior consent unless it is strictly necessary for a service the visitor explicitly requested.

A/B testing does not meet that threshold. The visitor did not ask to see a different headline. The test serves the business, not the visitor's request. The EDPB's Guidelines 2/2023, adopted in final form in October 2024, confirm the consent requirement covers all device storage and access, not just traditional HTTP cookies.

## The cookies in question

The testing cookies are easy to name because the vendors document them. VWO's \_vwo\_uuid identifies the visitor across sessions. Optimizely's optimizelyEndUserId does the same job. Google Optimize did the same before Google closed it in September 2023. Every one of them has to stay unset in the EU until the visitor has given valid consent.

The same logic decides how you test the cookie banner itself. A test that assigns banner variants with a tracking tool needs consent for the tool before it can measure the banner. The workaround is to assign variants without tracking: a strictly necessary cookie for the variant, or server-side assignment that stores nothing on the device. TermsFeed's guide shows the pattern with a plain document.cookie assignment and a 30-day max-age, with results logged only after consent.

## The UK split that trips teams up

Since February 5, 2026, the UK has differed. Paragraph 5 of Schedule A1 to the Privacy and Electronic Communications Regulations lets a site store or read information without consent when the sole purpose is collecting statistics about how its service is used, with a view to improving it. Visitors must be given clear information and a simple, free means of objecting, and must not have objected. A first-party A/B test that only measures which variant works better on your own site may fit paragraph 5.

That exception stops at the UK border. EU visitors are still governed by Article 5(3), and a test that runs the same code for both audiences is non-compliant for the EU half. The CNIL's enforcement record makes the point in euros: on September 1, 2025 it fined Google 325 million euros and SHEIN 150 million euros under Article 82 of the French Data Protection Act, which implements Article 5(3) in France. In January 2025 the ICO wrote to 134 of the UK's 200 most visited websites about their cookie banners.

## How to test compliantly

Move variant assignment to the server where you can, so nothing is stored on the device before consent. Where you need a client-side assignment, use a strictly necessary cookie and nothing else. Log results only after consent, and keep the variant record in the consent log: when a visitor withdraws consent six months later, you need to know exactly what banner variant they originally agreed to.

Run tests long enough to reach statistical significance, typically 30 days minimum for moderate-traffic sites. A test that ends early because the numbers looked good is not a finding. It is a guess with a chart attached.

Keep reading: [The Reject Button That Logs Nothing: Consent Records After a No](https://cookiebastion.com/blog/2026-11-13-reject-button-logs-nothing-consent-records.md), [The Consent Cookie That Expires in 30 Days: What Short Expiry Does to Your Records](https://cookiebastion.com/blog/2026-11-11-consent-cookie-short-expiry-records.md), [The Reject Button That Does Not Survive Navigation](https://cookiebastion.com/blog/2026-11-11-reject-choice-lost-navigation.md) cover the nearby cases in this series.

## Frequently asked questions

### Do A/B testing tools need cookie consent?

Yes, in the EU. Tools like VWO and Optimizely store a visitor ID on the device, and Article 5(3) of the ePrivacy Directive requires prior consent for any device storage that is not strictly necessary. A/B testing does not qualify as strictly necessary.

### Does the UK exception cover my A/B tests?

Only for UK visitors, and only for first-party tests that collect statistics to improve your own site, with clear information and a simple way to object. The exception has applied since February 5, 2026. EU visitors still need consent.

### How can I test my cookie banner without breaking the rules?

Assign variants without tracking: a strictly necessary cookie for the variant, or server-side assignment that stores nothing on the device. Log results only after consent, and record which variant each visitor saw in the consent log.

### How long should a banner test run?

Long enough to reach statistical significance, typically 30 days minimum for a moderate-traffic site. Ending early because the numbers look good produces a guess, not a finding.