Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Google Optimize was Google's free A/B testing and personalisation tool, deeply integrated with Google Analytics. The product was sunset on 30 September 2023, but the optimize.js snippet remains active on many sites, continuing to read Google Analytics cookies and transfer experiment exposure data to Google LLC in the United States. Use requires the same consent as Google Analytics under the GDPR and the ePrivacy Directive.
Google Optimize was a free A/B testing, multivariate testing and personalisation product launched in 2017. It allowed marketers to create experiments without engineering work, target visitors based on Google Analytics segments, and measure variant performance directly against Analytics goals. Google announced the sunset of Optimize and Optimize 360 in January 2023 and the product was officially discontinued on 30 September 2023. From that date no new experiments could be created and existing experiments stopped serving variants. However, the optimize.js library is still loaded on a large number of legacy implementations, often through Google Tag Manager tags that were never disabled, and continues to read existing Analytics cookies and trigger network calls to Google servers in the United States.
Even after sunset, the optimize.js snippet continues to read the _ga, _gid and _ga_<MEASUREMENT_ID> cookies set by Google Analytics, plus its own _gaexp cookie which stores the experiment ID, variant index and expiration. The script accesses the full page URL, document referrer, viewport size, user agent string and any data layer variables pushed by the site, all of which can be used for personalisation targeting. Page level events are sent to Google Analytics over HTTPS to www.google-analytics.com or region1.google-analytics.com, with the IP address visible to Google at network level. For sites that integrated Optimize with Google Analytics 4, exposure events appear as standard GA4 events tied to the Client ID.
Because Optimize reads and writes cookies that are not strictly necessary to deliver the requested service, ePrivacy Directive Art. 5(3) requires prior informed consent before the snippet may run. Under the GDPR, the same processing requires a valid lawful basis: in the consumer web context this can only be consent under Art. 6(1)(a). The data transferred to Google LLC in the United States is personal data within the meaning of the GDPR, since the Client ID is a persistent online identifier. Operators must therefore document the transfer mechanism (EU US Data Privacy Framework or Standard Contractual Clauses), perform a Transfer Impact Assessment under Schrems II, and inform users of the transfer in the privacy notice. Multiple EU authorities (CNIL, Italian Garante, Austrian DSB) have ruled against unconsented Google Analytics deployments, and Optimize falls under the same scope.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Operators still loading Optimize must gate the snippet behind a Consent Management Platform. With Google Consent Mode v2 the Optimize tag should not fire unless analytics_storage is granted, and ad_storage controls any downstream Google Ads remarketing audiences derived from experiments. The anti flicker snippet, which hides body content until Optimize loads, must itself be conditioned on consent, otherwise visitors who refuse cookies will see a blank page for several hundred milliseconds. Pre consent calls to Google domains should be blocked through CMP integration, server side tag wrapping or a tag manager exclusion trigger.
Audit Google Tag Manager containers and source code for residual optimize.js references and remove them. Disable the anti flicker snippet, which loses its purpose once experiments stop serving. Update the privacy notice and record of processing activities to remove Optimize where it has been removed, or to flag it as a legacy script pending removal. Replace Optimize with a successor: Google recommends partner platforms such as AB Tasty, Optimizely or VWO, and for sites prioritising EU data residency, Kameleoon, Convert or self hosted GrowthBook offer EU only options. Whichever tool replaces Optimize, repeat the same DPIA, consent and transfer assessment work, since the same regulatory framework applies.
If your cookie policy still lists Optimize, update it to clarify that the service was discontinued by Google and that the snippet is being removed. Keep the entry until the script is fully gone from production, since the _gaexp cookie may persist on visitor devices for up to 90 days after the script is dropped. Re scan the site with a cookie scanner monthly to confirm the cookie no longer reappears, and document removal in your data protection register.
Websites using Google Optimize must obtain user consent under GDPR regulations.
DPIA considerations
Google Optimize relies on the same _ga Client ID as Google Analytics and writes its own _gaexp cookie (90 day lifetime) holding the experiment ID, variant ID and expiry timestamp. Key DPIA points: (1) all data is transferred to Google LLC in the United States, requiring an active Transfer Impact Assessment even under the EU US Data Privacy Framework; (2) the optimize.js script runs in the page's top frame and can read full URLs, referrers and any data layer values pushed for personalisation rules; (3) variant exposure events are merged with Google Analytics user profiles, extending the retention horizon of behavioural data; (4) the anti flicker snippet hides page content until Optimize loads, which has accessibility and performance implications; (5) since the service was sunset, Google no longer issues product updates or security patches, so unremoved snippets continue to leak data without active vendor support. A DPIA is recommended whenever Optimize is still loaded, even on legacy pages, and removal should be prioritised.
Sample consent text
This website used Google Optimize, an A/B testing and personalisation service operated by Google LLC. Optimize set the _gaexp cookie on your device and shared experiment exposure information with Google Analytics. Data was transferred to Google LLC in the United States. The service was discontinued on 30 September 2023; if you see this notice it means we are still removing legacy scripts. You can refuse consent at any time via our cookie settings.
Third-party domains contacted
www.googleoptimize.comoptimize.google.comwww.google-analytics.comregion1.google-analytics.comstats.g.doubleclick.netCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| _gaexp | Personalization / Experimentation | 90 days | Set by Google Optimize. Stores the experiment ID, variant index and expiry timestamp so that the visitor sees the same variant across sessions. Read on every page load by optimize.js to determine which variant to serve and to report exposure to Google Analytics. |
| _gaexp_rc | Personalization / Experimentation | Session | Set by Google Optimize during a redirect experiment to prevent infinite redirect loops. Holds the redirect chain identifier for the current variant. |
| _opt_awcid | Personalization / Experimentation | 24 hours | Set by Google Optimize when Google Ads click identifiers are present. Used to attribute experiment results back to specific Google Ads campaigns. |
| _opt_awmid | Personalization / Experimentation | 24 hours | Set by Google Optimize. Stores the Google Ads campaign ID for experiments that target paid traffic, allowing Optimize to report variant performance per campaign. |
| _opt_utmc | Personalization / Experimentation | 24 hours | Set by Google Optimize to store the utm_campaign value for the current session, enabling traffic source level analysis of experiment results. |
Google Optimize collects user analytics data — you legally need a consent banner. Try FlowConsent free.
Google Optimize sets its own _gaexp cookie (90 day lifetime) which stores the experiment ID, variant index and expiration timestamp. It also reads existing Google Analytics cookies, _ga (2 years), _gid (24 hours) and _ga_<MEASUREMENT_ID> (2 years), to identify the visitor and tie variant exposure to Analytics user profiles. After the September 2023 sunset the script still writes _gaexp on every page load, so cookie audits should treat Optimize as an active vendor until the snippet is removed.
Yes. The _gaexp and _ga family of cookies are not strictly necessary to deliver the website, so ePrivacy Directive Art. 5(3) requires prior informed consent before optimize.js may execute. Even after the product was sunset, loading the script without consent breaches both ePrivacy and the GDPR. Consent must be granular, freely given and as easy to withdraw as to grant, with a reject all option as prominent as accept all.
The only valid legal basis in a consumer web context is consent under GDPR Art. 6(1)(a). Legitimate interest under Art. 6(1)(f) is generally not available for tracking cookies because it cannot override the ePrivacy consent requirement, and because the European Data Protection Board has repeatedly stated that user expectations do not include cross site behavioural tracking. For internal employee testing on intranets, contractual necessity could in theory apply, but this is a narrow case.
Yes. All Optimize requests are sent to Google LLC servers in the United States. Google self certifies under the EU US Data Privacy Framework, which provides an adequacy decision for transfers from the EEA to certified US importers, however the DPF remains contested and may be invalidated like its Privacy Shield predecessor. A Transfer Impact Assessment is still recommended, and the privacy notice must inform users of the transfer with sufficient detail to meet GDPR Art. 13 and 14.
A DPIA is recommended whenever Optimize is loaded, particularly because it combines persistent online identifiers, behavioural profiling and US data transfer. Under GDPR Art. 35 a DPIA is mandatory where processing is likely to result in a high risk to data subjects, which the EDPB and CNIL guidance suggest applies to large scale online tracking. Document the risk, the mitigations (consent, anonymisation where possible, retention limits) and review at least annually.
Wrap the optimize.js tag in a Consent Management Platform trigger that fires only when analytics_storage is granted via Google Consent Mode v2. Disable the anti flicker snippet, since it has no further purpose. Block calls to www.google-analytics.com and www.googleoptimize.com before consent through CMP integration or server side tagging. Document the residual script in your record of processing activities with a target removal date and a responsible owner.
Google itself recommends partner experimentation platforms: AB Tasty, Optimizely Web, VWO and Dynamic Yield. For sites prioritising EU data residency, Kameleoon (France), Convert (NL), AB Tasty (FR) and self hosted GrowthBook offer EU only data processing. Whichever tool you pick, repeat the same DPIA, consent and Transfer Impact Assessment work, since the framework is identical to Optimize: cookies, persistent IDs, possibly US transfers depending on configuration.
List Optimize under analytics or personalisation cookies, name the _gaexp cookie, give its 90 day duration and explain that it stores experiment exposure information shared with Google Analytics. Add a note that the service was discontinued by Google on 30 September 2023 and that the script is being removed. Re scan the site monthly with a cookie scanner; once _gaexp no longer appears on any visitor session, remove the entry from the cookie policy and update your record of processing.