GrowthBook

What is GrowthBook?

GrowthBook is an open source feature flagging and A/B testing platform created in 2020 to give product and growth teams a privacy-friendly alternative to legacy experimentation tools. It is distributed under an MIT license for the SDKs and a commercial source-available licence for the core, and can be installed on premise, on Kubernetes, or used through a managed cloud service. Where most experimentation suites store all event data on the vendor side, GrowthBook keeps the analysis on the customer's own data warehouse: BigQuery, Snowflake, Redshift, ClickHouse, Postgres, MySQL, Databricks, and others. The product is used to ship features behind flags, run controlled experiments, gradually roll out releases, and run multivariate tests without leaking visitor data to a third party.

Cookies and data collected by GrowthBook

By default, the GrowthBook JavaScript and front-end SDKs do not write any cookie. Visitor assignment to a test variant is computed deterministically from a hashed attribute that the integrator supplies (user ID, account ID, anonymous device ID, or any custom identifier). When the optional Sticky Bucketing feature is enabled, GrowthBook can persist the variant assignment in localStorage or in a first-party cookie named gbuuid so a returning visitor keeps the same variant across sessions. Experiment exposure events are typically forwarded to the operator's analytics warehouse, not to GrowthBook's servers, which means the personal data footprint depends on what identifiers the integrator chooses to send.

GDPR and ePrivacy implications

Under the ePrivacy Directive, any storage of or access to information on the visitor's terminal that is not strictly necessary requires prior consent. A/B testing for marketing optimisation is not strictly necessary, so the gbuuid cookie or any localStorage entry written by GrowthBook for sticky bucketing falls under the consent requirement. Pure server-side feature flags that never touch the browser storage and do not profile users can sometimes rely on legitimate interest, provided that a Legitimate Interest Assessment is documented. The CNIL, the BfDI in Germany, and the AEPD in Spain have all clarified that A/B testing tools writing identifiers must obtain consent.

Consent requirements and CMP integration

For client-side experiments, the GrowthBook SDK must be loaded only after the visitor has accepted the relevant consent category, typically Statistics or Marketing. Most consent management platforms can gate the SDK script via a data-category attribute or by deferring initialisation until a consent event is fired. For server-side flags that do not personalise content based on personal data, the SDK can run unconditionally as long as no identifying attribute is forwarded to the warehouse before consent is given. Recording the consent decision alongside experiment exposure is a good practice that helps demonstrate accountability.

International data transfers

GrowthBook Cloud runs on AWS. The default region is in the United States, which means SDK telemetry, dashboard usage data, and any personal data sent to GrowthBook traverse the US. Pro and Enterprise plans offer EU data residency on AWS Frankfurt, which keeps the metadata inside the EEA. GrowthBook is certified under the EU, US Data Privacy Framework and signs Standard Contractual Clauses (modules 2 and 3) for transfers that fall outside the framework. Self-Hosted deployments avoid the question entirely: the operator picks the cloud provider and region. A Transfer Impact Assessment is recommended when relying on the DPF.

Practical compliance steps

Add GrowthBook to the record of processing activities and to the cookie policy under the Statistics or Marketing category. Sign a Data Processing Agreement with GrowthBook Inc. for the Cloud version. Configure SDK initialisation to wait for the consent event, prefer the EU region for production, and avoid sending raw email addresses or other direct identifiers as targeting attributes (use hashed values instead). Set a reasonable retention period for assignment events in the warehouse, document the legal basis per experiment, and review the configuration whenever a new SDK version is deployed.