Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
VWO (Visual Website Optimizer) is an experimentation, personalisation and behavioural analytics platform developed by Wingify in New Delhi, India. It runs A/B tests, multivariate tests, personalisation campaigns, heatmaps, session recordings and on site surveys from a single SmartCode tag. EU customers can opt for AWS Frankfurt or Belgium residency, but the default deployment routes through AWS US East and consent is always required.
VWO (Visual Website Optimizer) is a comprehensive experimentation and behavioural analytics platform built by Wingify, an Indian company headquartered in New Delhi since 2010. It runs A/B tests, multivariate tests, split URL tests, personalisation campaigns, heatmaps, session recordings, on site surveys and form analytics from a single SmartCode tag. VWO is widely used by e commerce, SaaS and media publishers and competes head to head with Optimizely, Adobe Target and AB Tasty in the experimentation market.
The publisher inserts the VWO SmartCode in the head of every page. The SmartCode loads synchronously to avoid flicker on the first paint, identifies the visitor with the _vwo_uuid first party cookie, retrieves the experiment configuration from the VWO CDN and renders the assigned variant. Heatmaps, session recordings and surveys are loaded conditionally based on the campaign configuration. VWO FullStack offers a server side SDK for backend or mobile experimentation.
VWO sets several first party cookies: _vwo_uuid (visitor identifier, 10 years), _vwo_uuid_v2 (newer visitor identifier, 1 year), _vwo_sn (session counter, session) and _vis_opt_test_cookie (test exposure, session). When the heatmap or session recording module is active, additional fields are collected: mouse coordinates, scroll depth, click events, form interactions and DOM mutations. IP address is anonymised by default to the country level.
VWO experiments, personalisation, heatmaps and session recording are non essential and require prior consent under Art. 5(3) ePrivacy and Art. 6(1)(a) GDPR. The CNIL has reaffirmed in 2024 that A/B testing tools that store a persistent identifier on the visitor terminal cannot rely on the analytics consent exemption. The session replay module triggers the same DPIA criteria as Hotjar or Smartlook (systematic monitoring under Art. 35(3)(c)).
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Wire VWO to your CMP so that the SmartCode is loaded only after the visitor has accepted the experimentation or analytics category. VWO publishes an opt out token (window.VWO.push(["setOptOutCookie"])) that suspends every campaign on a per visitor basis. Configure the masking rules for session recordings to cover every form field that may carry personal data (email, phone, address, payment).
Wingify is an Indian company. By default VWO data is processed in AWS US East. EU customers can opt for AWS Frankfurt or Belgium residency at sign up. Standard Contractual Clauses are part of the VWO DPA. India is not the subject of an EU adequacy decision so the SCC must be paired with a Transfer Impact Assessment if any India routed processing remains in the architecture.
Choose AWS Frankfurt or Belgium residency at sign up. Sign the VWO DPA and complete a Transfer Impact Assessment that covers the SCC fallback. Wire the SmartCode to your CMP so it loads only after consent. Apply the masking rules to every personal data field. Complete a DPIA when session recording is enabled. Document VWO in your Article 30 register and expose a permanent Cookie preferences link in the footer.
Websites using VWO must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is recommended because VWO combines experimentation, personalisation, session replay and surveys, which together amount to large scale systematic monitoring of visitor behaviour (Art. 35(3)(c) GDPR). Document the EU residency choice, the masking strategy for session replay, the retention period and the legitimate interest balancing test.
Sample consent text
We use VWO to run A/B tests, personalise content and analyse user behaviour through heatmaps and session recordings. Form fields and personal identifiers are masked. You can refuse and we will not load the VWO SmartCode. Your consent can be withdrawn at any time via the Cookie preferences link in the footer.
Third-party domains contacted
vwo.comdev.visualwebsiteoptimizer.comdev.visualwebsiteoptimizer.comvwo.comeu01.dev.visualwebsiteoptimizer.comapp.vwo.comvisualwebsiteoptimizer.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| _vwo_uuid | first_party | 10 years | Persistent visitor identifier used to attribute the visitor to a consistent experiment variant. |
| _vwo_uuid_v2 | first_party | 1 year | Unique visitor identifier used to assign test variations consistently. |
| _vwo_uuid_v2 | first_party | 1 year | Newer visitor identifier used by VWO Insights and the consent aware deployment. |
| _vwo_ds | first_party | 90 days | Stores test variation history and visitor segmentation data. |
| _vwo_sn | first_party | 30 minutes | Stores session level interactions. |
| _vwo_sn | first_party | session | Session counter used to compute funnel and goal conversions. |
| _vis_opt_test_cookie | first_party | session | Records exposure to a specific A/B test variation. |
VWO collects user analytics data — you legally need a consent banner. Try FlowConsent free.
First party cookies _vwo_uuid_v2, _vwo_uuid, _vwo_ds, _vwo_sn store visitor, test variation and session identifiers.
VWO sets four first party cookies: _vwo_uuid (visitor identifier, 10 years), _vwo_uuid_v2 (newer identifier, 1 year), _vwo_sn (session counter, session) and _vis_opt_test_cookie (test exposure, session). Heatmap and session replay add transient client side identifiers.
Yes. A/B testing, heatmaps and session replay are not strictly necessary.
Yes. A/B testing, personalisation, heatmaps and session replay are non essential and require prior consent under Art. 5(3) ePrivacy and Art. 6(1)(a) GDPR. The CNIL reaffirmed in 2024 that A/B testing tools that store a persistent identifier do not benefit from the analytics consent exemption.
Consent under Article 6(1)(a) GDPR and Article 5(3) ePrivacy.
Consent (Art. 6(1)(a) GDPR + Art. 5(3) ePrivacy) for every VWO module. Legitimate interest is not appropriate because the persistent _vwo_uuid identifier and the systematic capture of behaviour create a high risk to data subject rights.
Yes by default. Enable EU Data Residency to keep data in AWS Frankfurt. Transfers to India for support rely on SCCs.
By default VWO data is processed on AWS US East and managed by Wingify (India). EU customers can opt for AWS Frankfurt or Belgium residency at sign up. Standard Contractual Clauses are part of the DPA. Always pair the SCC with a Transfer Impact Assessment.
Recommended due to the combination of testing, replay and segmentation.
Yes when session replay or full Insights are enabled, because they amount to systematic monitoring of visitor behaviour at scale (Art. 35(3)(c) GDPR). For simple A/B testing without recording, a DPIA is recommended but not always mandatory.
Enable EU Data Residency, gate the snippet behind a CMP, mask sensitive fields, sign the DPA with SCCs and disable replay on sensitive pages.
Choose AWS Frankfurt or Belgium residency at sign up, sign the DPA, complete a TIA, wire SmartCode to your CMP so it loads only after consent, configure masking for session replay and document VWO in your Article 30 register.
Other experimentation platforms include Optimizely (US), Adobe Target (US), AB Tasty (France, EU hosted), Kameleoon (France, EU hosted), Convert (US), GrowthBook (open source) and Statsig. AB Tasty and Kameleoon are usually preferred for EU only deployments.
AB Tasty, Kameleoon, Optimizely, Convert.com, Google Optimize replacement Convert. EU based vendors simplify transfers.
Document _vwo_* cookies, their purpose and duration and the data residency choice.
List _vwo_uuid, _vwo_uuid_v2, _vwo_sn and _vis_opt_test_cookie with their lifetime and purpose. Mention Wingify and the AWS region you selected. Re scan after every new VWO module activation (heatmap, session replay, surveys) and update the policy when new cookies appear.