> SiteSpect GDPR guide: server-side A/B testing, variant assignment cookies, US transfers under SCCs, optional EU deployment and consent for personalisation. > > Canonical: https://www.flowconsent.com/en/services/personalization/sitespect Personalization # SiteSpect Analytics SiteSpect is a US based A/B testing, multivariate testing, personalisation and feature flagging platform founded in 2004 and headquartered in Boston. It is distinguished by its server-side reverse proxy architecture (Origin Mode), which removes the flicker effect of client-side tools. For European customers, the default US deployment requires Standard Contractual Clauses; EU based reverse proxies are available on request. [Block SiteSpect until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=personalization) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Personalization](https://www.flowconsent.com/en/services/personalization) - Consent Analytics - Prior consent Required - Documented cookies 3 - Third-party domains 4 - Servers United States (Boston, MA) with optional EU presence (Frankfurt, Dublin) for customers requiring EU data residency Overview ## What does SiteSpect do? ## **What is SiteSpect** SiteSpect is a US based experimentation and personalisation platform founded in 2004, headquartered in Boston, Massachusetts. It supports A/B testing, multivariate testing, personalisation, feature flagging and server-side experimentation. SiteSpect is distinguished by its Origin Mode reverse proxy architecture, which delivers variants from the server to the visitor and avoids the flicker effect typical of client-side tools. ## **Data and cookies collected** SiteSpect processes visitor IP, user agent, page URL, referrer, basket events, conversion events and any custom attributes the customer sends. It sets first party cookies (SSID, SSRT) to keep variant assignment and session state consistent. In Origin Mode the cookie is set server side; in the JavaScript SDK mode, the cookie is set client side. Conversion events can be sent to SiteSpect or to integrated analytics tools. ## **GDPR and ePrivacy implications** SiteSpect is a data processor under Art. 28 GDPR. Variant assignment cookies are non essential and require consent under Art. 5(3) ePrivacy. The reverse proxy architecture means SiteSpect can see all request and response data, which raises significant data minimisation considerations: configure it to inspect only what is needed and exclude sensitive endpoints. Personalisation that builds a profile may trigger Art. 22 GDPR safeguards if it leads to significant decisions. ## **Consent requirements** Explicit consent is required for the variant cookies and for any persistent personalisation identifier. A simple AB test that does not profile individuals and uses session only cookies may rely on legitimate interest after a strict balancing, but most deployments require consent. Personalisation based on logged in user attributes still requires a lawful basis under the customer's own framework. ## **Data transfers outside the EEA** Default SiteSpect deployment processes data in the United States. EU customers can request EU based reverse proxies in Frankfurt or Dublin. US transfers rely on SCCs and the EU US Data Privacy Framework where SiteSpect is certified. Document both transfer mechanisms and run a Transfer Impact Assessment for US deployments. ## **Practical compliance steps** Sign SiteSpect's DPA, request the EU reverse proxy if available, configure the proxy to inspect only the required URLs and parameters, exclude sensitive endpoints (account, payment, health), load AB tests after cookie consent, document SiteSpect as a sub processor and run a TIA for US deployments. Compliance ## SiteSpect and the GDPR SiteSpect is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent (Art. 6(1)(a) GDPR) for personalisation cookies and behavioural testing; Legitimate interest (Art. 6(1)(f) GDPR) may apply for minimal AB testing that does not profile individuals, with strict balancing - Risk level medium - Applicable regulations GDPR, ePrivacy Directive (Cookie Law), CCPA, EU US Data Privacy Framework ### Impact assessment (DPIA) SiteSpect processes visitor IP, user agent, page URLs, variant assignments and conversion events. Key DPIA considerations: (1) variant assignment cookies are typically first party and non essential, requiring consent under Art. 5(3) ePrivacy; (2) the server-side proxy can inspect personal data in real time, raising data minimisation considerations; (3) US deployment triggers SCCs and EU US Data Privacy Framework, EU deployment is available; (4) personalisation based on persistent identifiers builds a profile that should be disclosed; (5) feature flagging based on user attributes (logged in user data) requires the customer's own lawful basis; (6) integrations with analytics tools (GA4, Adobe Analytics) add their own data flows. ### Sample text for your banner > With your consent, we use SiteSpect to run A/B tests and personalise content on our site. SiteSpect places first party cookies to keep your variant assignment consistent across pages. Data is processed in the United States under Standard Contractual Clauses, or in our EU reverse proxy if selected. Cookies and trackers ## What SiteSpect sets and contacts - Tracking method Server-side reverse proxy or hybrid JavaScript tag for A/B testing, multivariate testing, personalisation and feature flagging; first-party cookies for variant assignment and visitor consistency - Server location United States (Boston, MA) with optional EU presence (Frankfurt, Dublin) for customers requiring EU data residency - Data transferred outside the EU SiteSpect, Inc. is headquartered in Boston, Massachusetts. The default deployment processes data in the United States; EU options are available on request and rely on EU based reverse proxies. Transfers to US infrastructure are covered by Standard Contractual Clauses under Art. 46(2)(c) GDPR and the EU US Data Privacy Framework where applicable. ### Cookies set (3) | Name | Type | Duration | Purpose | | ---- | ---------- | -------- | ---------------------------------------------------------------------------------------------------------------------------- | | SSID | Marketing | 1 year | Persistent first party visitor identifier used by SiteSpect to keep variant assignment consistent across pages and sessions. | | SSRT | Functional | Session | Stores runtime and session state used by SiteSpect Origin Mode reverse proxy to maintain experimentation context. | | SSPV | Analytics | 30 days | Counts page views per visitor for SiteSpect goal tracking and engagement analysis. | ### Third-party domains contacted (4) - `sitespect.com` - `sitespect.net` - `sitespect-cdn.com` - `cdn.sitespect.com` Questions ## Frequently asked questions about SiteSpect Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does SiteSpect set? SiteSpect typically sets first party cookies SSID (visitor identifier used for variant assignment, 1 year) and SSRT (session/runtime state). In Origin Mode the cookie is set by the reverse proxy on the customer domain; in the SDK mode it is set by JavaScript. ### Do I need consent to use SiteSpect? Yes for persistent variant cookies and any personalisation that builds a profile. A short session only test that does not link to a persistent identifier may rely on legitimate interest after a strict balancing, but most production deployments need cookie consent. ### What is the legal basis for processing via SiteSpect? Consent (Art. 6(1)(a) GDPR) for variant cookies and persistent personalisation. Legitimate interest (Art. 6(1)(f) GDPR) only for minimal AB testing that does not profile individuals. Contract (Art. 6(1)(b) GDPR) if testing is explicitly part of a service the user signed up for. ### Where does SiteSpect process and store data? Default deployment processes in the United States. EU customers can request EU based reverse proxies in Frankfurt or Dublin. US transfers rely on SCCs and the EU US Data Privacy Framework where SiteSpect is certified. ### Is a DPIA required for SiteSpect? A DPIA is recommended for any large scale personalisation deployment, when SiteSpect inspects payment, account or health endpoints, or when feature flags affect significant decisions (pricing, access). The DPIA should cover the reverse proxy inspection scope, US transfers and Art. 22 GDPR safeguards. ### How do I deploy SiteSpect compliantly? Sign the DPA, choose an EU reverse proxy if available, restrict the inspected URLs and parameters to the minimum, exclude sensitive endpoints, load AB test variants only after consent, document SiteSpect in your sub processor list and run a TIA for US transfers. ### What are GDPR friendly alternatives to SiteSpect? EU based experimentation tools include Kameleoon (France), AB Tasty (France), Convert.com (Spain) and Webtrends Optimize (UK). Open source alternatives include GrowthBook, Wasabi and Unleash. Server side experiments via your own backend with first party identifiers can also be lower risk. ### How should I update my privacy policy for SiteSpect? Disclose SiteSpect as a personalisation processor, name SSID and SSRT cookies with their duration, explain whether you use Origin Mode or SDK mode, describe the data inspected by the reverse proxy, mention US transfers under SCCs and the EU US Data Privacy Framework, and link SiteSpect's privacy notice and DPA. Same category ## More services: Personalization [See the whole category](https://www.flowconsent.com/en/services/personalization) ### [Perzonalization](https://www.flowconsent.com/en/services/personalization/perzonalization) [Perzonalization is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Perzonalization enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Perzonalization empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/personalization/perzonalization) [Preferences](https://www.flowconsent.com/en/services/personalization/perzonalization) · ### [Zoho PageSense](https://www.flowconsent.com/en/services/personalization/zoho-pagesense) [Zoho PageSense is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Zoho PageSense supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Zoho PageSense enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/personalization/zoho-pagesense) [Analytics](https://www.flowconsent.com/en/services/personalization/zoho-pagesense) · ### [Salesforce Interaction Studio](https://www.flowconsent.com/en/services/personalization/salesforce-interaction-studio) [Salesforce Interaction Studio is a web hosting and cloud infrastructure provider delivering reliable, scalable hosting solutions for websites and applications of all sizes. It offers shared, VPS, and dedicated server options with SSD storage, global CDN, and automated backups. Salesforce Interaction Studio provides one-click deployment, managed databases, and 24/7 monitoring. With high uptime guarantees and developer-friendly tools, Salesforce Interaction Studio ensures optimal performance at scale.](https://www.flowconsent.com/en/services/personalization/salesforce-interaction-studio) [Preferences](https://www.flowconsent.com/en/services/personalization/salesforce-interaction-studio) · ### [Pickzen](https://www.flowconsent.com/en/services/personalization/pickzen) [Pickzen is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Pickzen supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Pickzen enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/personalization/pickzen) [Analytics](https://www.flowconsent.com/en/services/personalization/pickzen) · ### [ParticularAudience](https://www.flowconsent.com/en/services/personalization/particularaudience) [ParticularAudience is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. ParticularAudience provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, ParticularAudience helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/personalization/particularaudience) [Preferences](https://www.flowconsent.com/en/services/personalization/particularaudience) · ### [PureClarity](https://www.flowconsent.com/en/services/personalization/pureclarity) [PureClarity is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. PureClarity provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, PureClarity helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/personalization/pureclarity) [Preferences](https://www.flowconsent.com/en/services/personalization/pureclarity) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)