A/B testing tools, ranked by data protection.
Eight platforms, five data-protection criteria, weighted for where European enforcement actually lands: consent and contract first, hosting location after them. We checked what each tool writes to the device, which consent managers it integrates, which agreements you can read today, and where the data really sits. The publisher of this site makes Apex by Drip, which ranks first, and its verdict names exactly what Varify and Kameleoon do better.
The short answer
Which A/B testing tool is GDPR compliant?
On this ranking Apex by Drip comes first: eight consent-manager integrations plus Shopify’s Customer Privacy API, an Article 28(3) DPA with a named subprocessor annex, working export and erasure routes, and no IP addresses stored. Varify and Kameleoon follow. No tool makes you compliant on its own.
Ranking published by Drip Trading GmbH, the company behind Apex by Drip. How we rate and weight
Apex by Drip
Drip Trading GmbH · Germany
Apex by Drip takes the top spot because it leads the two criteria this ranking weights heaviest. On consent it has the broadest coverage in the field: integrations for eight consent managers, Shopify’s Customer Privacy API read directly, Do Not Track honoured, and consent that can downgrade storage to memory only and clear the visitor ID outright. On contract it is equally specific: a data processing agreement under Article 28(3) whose subprocessor annex names each vendor’s legal entity, purpose, data categories, exact location and transfer mechanism, plus API routes that actually execute data export and erasure, a random 16-byte visitor ID with no fingerprinting anywhere in the SDK, no IP address column in the analytics schema at all, and a German vendor, Drip Trading GmbH in Traunstein, so the processor contract sits under German law. Two rivals still beat it where they beat it, and the honest reader should weigh that: Varify hosts on AWS in Frankfurt and sets no cookies at all, and Kameleoon holds ISO 27001:2022 and SOC 2 Type 2 and can render experiments without touching the device. Apex runs its security and compliance program in Drata with 295 tracked controls and has prepared an integrated SOC 2, ISO 27001, ISO 42001 and GDPR management-system audit package, but the SOC 2 audit has not begun, so there is no report and no certificate yet. Two facts are the open items that would widen the gap: the infrastructure sits in London (Vercel, Tinybird) and Ireland (Supabase) with Cloudflare edge delivery rather than in Germany, and the EU-only storage option in the settings is not yet effective, so an EU-only residency and the first SOC 2 report are what would move Apex further ahead.
Varify.ioVarify Software GmbHGerman and Austrian teams whose first question is where the data is stored8.3/103
KameleoonKameleoon SASRegulated industries that need consent modes and audit certificates from one vendor8.2/104
VWOWingify (Everstone Capital)Teams that want EU residency inside one full analytics and testing suite7.6/105
ABlyftConversion Expert GmbHDeveloper-led teams that want the smallest possible data footprint7.5/106
Optimizely Web ExperimentationOptimizely (Insight Partners)Enterprises whose procurement scores certificates above hosting detail7.1/107
AB TastyWingify (Everstone Capital)Existing customers who can accept an unnamed hosting region6.6/108
Convert ExperiencesConvert Insights Inc.Agencies that need audit certificates more urgently than consent tooling6.3/10The field at a glance
| # | Tool | Statistics | Shopify | EU hosting | Pricing |
|---|---|---|---|---|---|
| 1 | Apex by Drip | mixed | App | EU | book a call |
| 2 | Varify.io | mixed | Snippet | DE | public |
| 3 | Kameleoon | mixed | App | EU | public |
| 4 | VWO | sequential | App | EU | on request |
| 5 | ABlyft | mixed | — | DE | on request |
| 6 | Optimizely Web Experimentation | sequential | — | EU | on request |
| 7 | AB Tasty | bayesian | App | EU | on request |
| 8 | Convert Experiences | mixed | App | EU | public |
Quick answers
Which A/B testing tools work without cookies?
Varify and ABlyft set no cookies by default and keep the variation in local or sessionStorage. Kameleoon’s Delayed Mode renders experiments while writing nothing to the device. VWO, Optimizely, Convert, AB Tasty and Apex by Drip document no cookieless client-side mode.
Can you run A/B tests without a consent banner?
Only if the tool stores nothing that needs consent, and that call belongs to you as controller, not to the vendor. ABlyft stores no personal data at all, Varify sets no cookies by default, and Kameleoon’s Delayed Mode writes and sends nothing until consent arrives.
Which A/B testing tools host visitor data in the EU?
Varify (AWS Frankfurt) and ABlyft host in Germany. Kameleoon runs on OVHcloud and Hetzner, VWO offers GCP Belgium, Convert names AWS Ireland. Apex by Drip runs in London and Ireland with Cloudflare edge delivery. Optimizely leaves its EU scope open, AB Tasty names no EU region.
Which A/B testing tool supports Google Consent Mode v2?
Varify is the only tool here that publishes Google Consent Mode V1 and V2 setup instructions. The others wire consent through consent managers: Apex by Drip integrates eight of them plus Shopify’s Customer Privacy API, Kameleoon has four consent modes, VWO three, Optimizely five.
Weights, evidence rules and what would change our minds: How we rate