Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Split, now part of Harness, is a feature flag and experimentation platform. It controls which features a user sees and can run experiments that connect feature exposure to metrics. When used in the browser, its SDK stores targeting data and records impression and event data tied to a user key, and it processes the IP address and device information. Feature flags that are strictly necessary may rely on a different basis, but experimentation that tracks behaviour requires consent.
Split, now part of Harness, is a feature management and experimentation platform. Feature flags let teams turn functionality on or off and roll it out gradually, while the experimentation side connects which variant a user saw to business metrics. It is used by engineering and product teams to release software safely and to measure impact.
When the browser SDK is used, Split stores flag definitions and targeting data in local storage and sends impression and event data tied to a user key, which may be an account identifier or an anonymous id. It processes the IP address and device information. When evaluation runs server side, targeting can happen without storing anything on the user device, which changes the ePrivacy analysis.
User keys, impressions, and events are personal data under the GDPR when they relate to an identifiable person, and reading or writing data in the browser falls under the ePrivacy Directive. A flag that is strictly necessary to deliver a feature the user requested can sometimes be exempt, but experimentation that measures and profiles behaviour is not, so it needs consent and clear information.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Separate the two use cases. Strictly necessary feature flags that simply control whether a function is available can rely on a basis other than consent, provided they do not track behaviour. Experimentation that records impressions and ties them to outcomes should wait for consent, and you should not send experiment data for visitors who decline.
Split is part of Harness, a United States company, so personal data may be processed in the United States and transfers rely on the EU US Data Privacy Framework or on Standard Contractual Clauses. Server side evaluation and the use of anonymous keys can reduce the personal data that leaves the European Economic Area.
Decide which flags are strictly necessary and which are experiments, gate experimentation behind consent, prefer server side evaluation and anonymous keys, and sign a data processing agreement. Document the processing, set retention limits for impressions and events, and describe Split in your privacy notice.
Websites using Split must obtain user consent under GDPR regulations.
DPIA considerations
Distinguish strictly necessary feature flagging from experimentation that profiles users. Assess the user keys used, whether evaluation happens client or server side, the impression and event data retained, and the transfers to the United States.
Sample consent text
We use Split to manage features and to run experiments. When experimentation is active, Split may store data in your browser and record which variant you experienced. This runs only after you accept the relevant cookies.
Third-party domains contacted
split.iosdk.split.ioevents.split.iostreaming.split.ioCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| SPLITIO.splits | Functional | Persistent (local storage) | Stores feature flag definitions so the browser can evaluate which feature to show. |
| SPLITIO.client.key | Functional | Persistent (local storage) | Stores the user key used to evaluate feature flags consistently. |
| SPLITIO.events | Analytics | Persistent (local storage) | Queues impression and event data for experimentation before it is sent. |
Split collects user analytics data — you legally need a consent banner. Try FlowConsent free.
The Split browser SDK stores flag definitions, a user key, and queued impression and event data in local storage rather than classic cookies. The targeting storage can be necessary for a feature, while the impression and event data used for experiments is not, so it belongs in the analytics category.
It depends on the use. Strictly necessary feature flags that only decide whether a function is shown may not need consent, but experimentation that records impressions and profiles behaviour does require prior consent under the ePrivacy Directive and the GDPR.
Strictly necessary flagging can rely on legitimate interest or contract, while experimentation that tracks behaviour should rely on consent under Article 6(1)(a) of the GDPR. Keep the two purposes clearly separated.
Yes. Split is part of Harness, a United States company, so data may be processed there and transfers rely on the EU US Data Privacy Framework or Standard Contractual Clauses. Server side evaluation can keep more data in the region.
A DPIA is rarely needed for plain feature flags, but experimentation that profiles users at scale may warrant one. Document the user keys, whether evaluation is client or server side, retention, and transfers.
Classify each flag, gate experiments behind consent, prefer server side evaluation and anonymous keys, sign a data processing agreement, and set retention limits. Disclose the experimentation in your privacy notice.
Alternatives include LaunchDarkly, Unleash, GrowthBook, and Flagsmith, some of which can be self hosted in the EU. Self hosting and server side evaluation reduce both transfers and device storage.
Describe the Split storage entries with their purpose and persistence, separate strictly necessary flagging from experimentation, name Harness as the recipient, and mention the United States transfer. Update it when your usage changes.