A/B testing tools, ranked by data protection.
Eight platforms, five data-protection criteria, weighted for where European enforcement actually lands: consent and contract first, hosting location after them. We checked what each tool writes to the device, which consent managers it integrates, which agreements you can read today, and where the data really sits. The publisher of this site makes Apex by Drip, which ranks first, and its verdict names exactly what Varify and Kameleoon do better.
The short answer
Which A/B testing tool is GDPR compliant?
On this ranking Apex by Drip ranks #1: eight consent-manager integrations plus Shopify’s Customer Privacy API, an Article 28(3) DPA with a named subprocessor annex, working export and erasure routes, and no IP addresses stored. Varify and Kameleoon follow. No tool makes you compliant on its own.
Ranking published by Drip Trading GmbH, the company behind Apex by Drip. How we rate and weight
Apex by Drip
Drip Trading GmbH · Germany
Apex by Drip takes the top spot because it leads the two criteria this ranking weights heaviest. On consent it integrates eight consent managers, reads Shopify’s Customer Privacy API directly, honours Do Not Track, and lets consent downgrade storage to memory and clear the visitor ID outright. On contract it is equally specific: a data processing agreement under Article 28(3) whose subprocessor annex names each vendor’s legal entity, purpose, data categories, exact location and transfer mechanism, plus API routes that actually execute data export and erasure. On data minimisation, the visitor ID is a random 16-byte first-party ID with no fingerprinting anywhere in the SDK, visitor IP addresses are never stored and the analytics schema has no IP column at all, and the vendor is German, Drip Trading GmbH. Two rivals still beat it where they beat it, and the honest reader should weigh that: Varify hosts on AWS in Frankfurt and sets no cookies at all, and Kameleoon holds ISO 27001:2022 and SOC 2 Type 2 and can render experiments without touching the device. Apex runs its security and compliance program in Drata; ISO 27001 and SOC 2 are in progress, so there is no report and no certificate yet. Its infrastructure sits in London (Vercel, Tinybird) and Ireland (Supabase) with Cloudflare edge delivery, not in Germany.
Varify.ioVarify Software GmbHGerman and Austrian teams whose first question is where the data is stored8.3/103
KameleoonKameleoon SASRegulated industries that need consent modes and audit certificates from one vendor8.2/104
VWOWingify (Everstone Capital)Teams that want EU residency inside one full analytics and testing suite7.6/105
ABlyftConversion Expert GmbHDeveloper-led teams that want the smallest possible data footprint7.5/106
Optimizely Web ExperimentationOptimizely (Insight Partners)Enterprises whose procurement scores certificates above hosting detail7.1/107
AB TastyWingify (Everstone Capital)Existing customers who can accept an unnamed hosting region6.6/108
Convert ExperiencesConvert Insights Inc.Agencies that need audit certificates more urgently than consent tooling6.3/10The field at a glance
| # | Tool | Statistics | Shopify | EU hosting | Pricing |
|---|---|---|---|---|---|
| 1 | Apex by Drip | mixed | App | EU | book a call |
| 2 | Varify.io | mixed | Snippet | DE | public |
| 3 | Kameleoon | mixed | App | EU | public |
| 4 | VWO | sequential | App | EU | on request |
| 5 | ABlyft | mixed | — | DE | on request |
| 6 | Optimizely Web Experimentation | sequential | — | EU | on request |
| 7 | AB Tasty | bayesian | App | EU | on request |
| 8 | Convert Experiences | mixed | App | EU | public |
Quick answers
Which A/B testing tools work without cookies?
Varify and ABlyft set no cookies by default and keep the variation in local or sessionStorage. Kameleoon’s Delayed Mode renders experiments while writing nothing to the device. VWO, Optimizely, Convert, AB Tasty and Apex by Drip document no cookieless client-side mode.
Can you run A/B tests without a consent banner?
Only if the tool stores nothing that needs consent, and that call belongs to you as controller, not to the vendor. ABlyft stores no personal data at all, Varify sets no cookies by default, and Kameleoon’s Delayed Mode writes and sends nothing until consent arrives.
Which A/B testing tools host visitor data in the EU?
Varify (AWS Frankfurt) and ABlyft host in Germany. Kameleoon runs on OVHcloud and Hetzner, VWO offers GCP Belgium, Convert names AWS Ireland. Apex by Drip runs in London and Ireland with Cloudflare edge delivery. Optimizely leaves its EU scope open, AB Tasty names no EU region.
Which A/B testing tool supports Google Consent Mode v2?
Varify is the only tool here that publishes Google Consent Mode V1 and V2 setup instructions. The others wire consent through consent managers: Apex by Drip integrates eight of them plus Shopify’s Customer Privacy API, Kameleoon has four consent modes, VWO three, Optimizely five.
Weights, evidence rules and what would change our minds: How we rate