Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Optimizely Commerce runs A/B tests and personalised experiences and stores which variations a visitor sees. A JavaScript snippet sets cookies such as optimizelyEndUserId, a persistent visitor identifier, along with bucketing and segment cookies. Data is processed by Optimizely in the United States. Because experimentation cookies are not strictly necessary, prior consent is required under the GDPR and the ePrivacy Directive.
Optimizely Commerce is the experimentation and personalization layer that brands use to run A/B tests and tailored experiences on their commerce sites. A JavaScript snippet loads on the page, decides which variation a visitor should see, and keeps that assignment stable so the experience is consistent across pages and visits. The platform records which test a visitor entered, which variation was shown, and how they interacted, feeding results dashboards and personalization rules. The aim is to measure what works and to deliver experiences targeted to a visitor segment.
The snippet sets cookies including optimizelyEndUserId, a persistent visitor identifier that can last about six months or longer, optimizelyBuckets, which stores the variation assignments, optimizelySegments, which records audience attributes, and optimizely_data, which holds experiment state. Optimizely also processes the visitor identifier, the experiments and variations seen, interaction events, IP address, and browser and device information. Because the identifier is persistent, the data supports behavioural analysis and targeting across visits.
Experimentation and personalization cookies are not strictly necessary to deliver a service the visitor has requested, so Article 5(3) of the ePrivacy Directive requires prior consent before they load. The persistent identifier and the segment attributes are personal data under the GDPR, and using them to test and target individuals is a form of profiling, so a lawful basis, transparency, and a record of processing activities are required.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Because experimentation cookies are not strictly necessary, prior consent is required, so the Optimizely snippet must load only after the visitor accepts the relevant marketing or personalization category in your consent management platform. Pre ticked boxes, implied consent from continued browsing, and cookie walls do not meet the GDPR standard. Consent must be freely given, specific, informed, granular, and as easy to withdraw as to give, and visitors who decline should still receive a default experience.
Optimizely processes data in the United States, with some EU hosting available, so you must document the transfer under the Data Privacy Framework and the Standard Contractual Clauses and sign the Optimizely Data Processing Agreement. In practice, gate the snippet behind your consent management platform, list the Optimizely cookies and their durations in your cookie policy, name Optimizely as a recipient, and review retention so that experiment and segment data is not kept longer than necessary. Where available, prefer EU hosting and minimise the attributes used for segmentation.
Websites using Optimizely Commerce must obtain user consent under GDPR regulations.
DPIA considerations
Optimizely Commerce assigns a persistent visitor identifier (optimizelyEndUserId) that can last about six months or longer, stores variation assignments and audience segments, and processes data on US infrastructure. A DPIA should assess the behavioural profiling and targeting, the persistence of the identifier, the international transfer to the United States, and retention periods, together with mitigations such as consent gating, data minimisation in segmentation, and shortened retention.
Sample consent text
We use Optimizely Commerce to test improvements to our site and to personalise your experience. Optimizely places cookies on your device to remember which version of a page you see and to group you into audiences for testing. These cookies load only after you accept the relevant category, and the data may be processed in the United States. You can withdraw your consent at any time through our cookie settings.
Third-party domains contacted
cdn.optimizely.comlogx.optimizely.comcdn3.optimizely.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| optimizelyEndUserId | marketing | About 6 months or longer | Persistent visitor identifier used to recognise the same visitor across visits so that experiments and personalised experiences stay consistent. |
| optimizelyBuckets | marketing | Persistent | Stores the variation assignments for each experiment so the visitor continues to see the same version of a tested page. |
| optimizelySegments | marketing | Persistent | Records audience attributes and segment membership used to target personalised experiences and to evaluate test conditions. |
| optimizely_data | marketing | Persistent | Holds experiment state and related data used by the Optimizely snippet to manage tests and personalization on the page. |
Optimizely Commerce uses cookies for user preferences — inform visitors with a consent banner.
Optimizely sets cookies including optimizelyEndUserId, a persistent visitor identifier that can last about six months or longer, optimizelyBuckets, which stores variation assignments, optimizelySegments, which records audience attributes, and optimizely_data, which holds experiment state. Together they keep a visitor in a consistent test and personalization experience across pages and visits.
Yes. Experimentation and personalization cookies are not strictly necessary, so under Article 5(3) of the ePrivacy Directive and the GDPR you must obtain prior, opt in consent before the Optimizely snippet loads. Running tests before consent is a common cause of supervisory authority complaints.
The storage and reading of the cookies relies on consent under the ePrivacy Directive, and the subsequent processing of personal data relies on consent under Article 6(1)(a) of the GDPR. Because the experimentation cookies are not strictly necessary, legitimate interest is generally not available for this processing.
Yes. Optimizely processes data on infrastructure in the United States, although some EU hosting is available. Transfers are covered by the EU US Data Privacy Framework and Standard Contractual Clauses, which you should reference in your privacy notice.
A full DPIA is not always mandatory, but it is recommended because Optimizely profiles and targets visitors using a persistent identifier, segments audiences, and transfers data internationally. Document the purposes, data categories, retention, and safeguards, and reassess if you enrich segments with sensitive or extensive attributes.
Load the Optimizely snippet only after the visitor accepts the relevant marketing or personalization category in your consent management platform, and keep it blocked until then. Sign the Data Processing Agreement, set sensible retention for experiment and segment data, document the cookies in your cookie policy, and ensure visitors who decline still get a default experience.
Alternatives include experimentation and personalization tools such as VWO, AB Tasty, or open source options like GrowthBook, some of which offer EU hosting or server side testing that reduces client cookies. The right choice depends on your testing needs and how much control you want over data residency.
List each Optimizely cookie, its purpose, and its duration, name Optimizely as a recipient, and disclose the transfer to the United States. Keep the entries in sync with a regular cookie scan so that new or renamed Optimizely cookies are reflected accurately.