Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Optimizely Content Management is a digital experience platform and CMS that can set functional, analytics and experimentation cookies, with data potentially processed in the United States.
Optimizely Content Management, formerly known as Episerver, is an enterprise content management system and digital experience platform. It powers websites and often comes with built in experimentation and personalisation features. Optimizely is a United States company, although it offers regional cloud hosting.
The CMS itself sets functional cookies for sessions and editor logins, while its experimentation and personalisation modules set analytics cookies that assign visitors to test variations and measure behaviour. It can process the visitor IP address, pages viewed, test assignments and interaction events. The experimentation cookies are non essential.
Functional CMS cookies can be treated as strictly necessary, but experimentation, personalisation and analytics cookies are not, so they fall under the ePrivacy consent rule. The behavioural data they collect is personal data under the GDPR, and Optimizely typically acts as your processor.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
You must obtain consent before experimentation, personalisation or analytics cookies are set. Configure the platform so tests and tracking only run after the visitor accepts, and present the categories clearly. Strictly necessary CMS cookies can load without consent.
Optimizely is based in the United States and offers regional hosting. Where data is processed in the United States, transfers rely on the EU US Data Privacy Framework or Standard Contractual Clauses. Confirm your hosting region and sign the data processing agreement.
Integrate Optimizely with your consent manager so experimentation and analytics scripts are blocked until consent, choose an EU hosting region where possible, and document the cookies, the processor relationship and any transfer. Minimise the behavioural data you collect for tests.
Websites using Optimizely Content Management must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is advisable where Optimizely experimentation or personalisation profiles visitors at scale or processes special category inferences. Assess the analytics cookies, the test data and any United States transfer.
Sample consent text
This site uses Optimizely for content and experimentation. Experimentation and analytics cookies are set only if you accept. Strictly necessary cookies keep the site working.
Third-party domains contacted
optimizely.comcdn.optimizely.comlogx.optimizely.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| optimizelyEndUserId | Analytics | 6 months | Assigns a unique identifier so a visitor stays in the same experiment variation and results can be measured. |
| ASP.NET_SessionId | Strictly necessary | Session | Maintains the server session for the content management system. |
This service may collect user data. Ensure GDPR compliance with FlowConsent.
Yes, the CMS sets functional cookies for sessions, and its experimentation and personalisation features set analytics cookies that assign test variations and track behaviour. The latter are non essential.
You need consent before experimentation, personalisation and analytics cookies are set, but not for the strictly necessary CMS cookies that keep the site and editor working.
Core CMS functionality relies on contract or legitimate interest, while experimentation and analytics cookies require consent under Article 6(1)(a) and the ePrivacy rules.
Optimizely is a US company offering regional hosting. Where processing occurs in the US, it relies on the EU US Data Privacy Framework or Standard Contractual Clauses.
Consider a DPIA where experimentation or personalisation profiles visitors at scale or draws sensitive inferences. Assess the analytics cookies, the test data and any transfer.
Connect Optimizely to your consent manager so tests and analytics wait for consent, choose EU hosting where possible, sign the processing agreement and document the cookies and transfers.
European or self hosted content management and experimentation tools can keep data in the EU. The right choice depends on your scale and experimentation needs.
List the functional, experimentation and analytics cookies Optimizely sets, with purpose and duration, state that non essential cookies load only after consent and disclose any United States transfer.