2026 ranking, updated 2026-09-22

The 8 Best A/B Testing Tools for GDPR in 2026

We rank eight platforms on five data-protection criteria. Consent and contract come first, followed by minimisation, hosting and independent attestation. Our platform Apex ranks first, and we name where Varify and Kameleoon perform better.

See the ranking See if your shop is a fit

Ranking

The ranking

Drip Trading GmbH

Apex by DRIP

8.6/10

Our platform Apex by DRIP takes the top spot because it leads the two criteria this ranking weights heaviest. On consent it has the broadest coverage in the field: integrations for eight consent managers, Shopify’s Customer Privacy API read directly, Do Not Track honoured, and consent that can downgrade storage to memory only and clear the visitor ID outright. On contract it is equally specific: a data processing agreement under Article 28(3) whose subprocessor annex names each vendor’s legal entity, purpose, data categories, exact location and transfer mechanism, plus API routes that actually execute data export and erasure, a random 16-byte visitor ID with no fingerprinting anywhere in the SDK, no IP address column in the analytics schema at all, and a German vendor, Drip Trading GmbH in Traunstein, so the processor contract sits under German law. Two rivals still beat it where they beat it, and the honest reader should weigh that: Varify hosts on AWS in Frankfurt and sets no cookies at all, and Kameleoon holds ISO 27001:2022 and SOC 2 Type 2 and can render experiments without touching the device. Its compliance status is precise: program managed in Drata, SOC 2 / ISO 27001 audit package prepared, audit not yet begun. Two facts are the open items that would widen the gap: hosting is UK (London) and Ireland; DPA relies on the UK adequacy decision. The storage setting does not change those locations, and the first audit report remains open.

Best for: Shopify and ecommerce teams that need broad consent-manager coverage, a specific DPA and working erasure

Statistics: Mixed
Shopify: Shopify app
Hosting: UK/IE
Consent and cookies: Cookies or local storage
Server-side: PartialDecide API and deployable Cloudflare edge worker, but no server-side SDKs.
Personalization: PartialBackend, API, CLI and measurement are shipped; the dashboard is a labs feature and off by default.

Explore Apex

Varify Software GmbH

Varify.io

8.3/10

Varify is the clearest answer to the question a German buyer asks first, and it wins this ranking’s residency and minimisation criteria outright: the company is German, the hosting is AWS in Frankfurt, and by default no cookies are set at all, the variation is kept in local or sessionStorage. Varify states it processes no personal data other than the IP address, a data processing agreement including the technical and organisational measures is downloadable, and it is the only tool here that publishes Google Consent Mode V1 and V2 setup instructions. It places second rather than first only on the two heaviest criteria: consent-manager coverage is narrower than the eight-integration field leader, and independent attestation is absent, no SOC 2 and no ISO 27001, with the public roadmap putting SOC 2 at 54 percent.

Best for: German and Austrian teams whose first question is where the data is stored

Statistics: Mixed
Shopify: Snippet
Hosting: DE
Consent and cookies: Cookieless available
Server-side: Yes
Personalization: Yes

Kameleoon SAS

Kameleoon

8.2/10

Kameleoon has the best consent engineering in this field and the only fully attested compliance file among the European vendors: four documented consent modes, and Delayed Mode renders experiments while writing nothing to the device and sending nothing to a server until consent arrives. The infrastructure avoids US hyperscalers entirely, OVHcloud in France and Hetzner in Germany, and ISO 27001:2022, SOC 2 Type 2 and PCI DSS are independently attested, which no other tool in the top three can say. What holds it to third is the contract and minimisation column: no downloadable DPA could be verified on the public site, the EU region is a choice rather than the default, the standard visitor cookie runs 365 days, and IP truncation is documented nowhere.

Best for: Regulated industries that need consent modes and audit certificates from one vendor

Statistics: Mixed
Shopify: Shopify app
Hosting: EU
Consent and cookies: Cookies or local storage
Server-side: Yes
Personalization: Yes

Wingify (Everstone Capital)

VWO

7.6/10

VWO offers a real, documented EU data-residency option: visitor data can be pinned to GCP europe-west1 in Belgium, with US and India regions also available. Three documented consent modes, a DPA with standard contractual clauses, ISO 27001:2022 and SOC 2 Type II make a solid compliance file that clears procurement. It ranks fourth because the EU region is opt-in rather than the default and there is no cookieless client-side mode, VWO points to server-side testing as the workaround.

Best for: Teams that want EU residency inside one full analytics and testing suite

Statistics: Sequential
Shopify: Shopify app
Hosting: EU
Consent and cookies: Cookies or local storage
Server-side: Yes
Personalization: Yes

Conversion Expert GmbH

ABlyft

7.5/10

ABlyft has the strictest data-minimisation posture in this comparison, and it is stated flatly: no personal data on the platform at all, no IP address, no user ID, everything aggregated. Company and hosting are in Germany, localStorage replaces cookies by default, the snippet can be self-hosted, and a bring-your-own-tracker option means event data need never reach ABlyft. It wins the 20 percent minimisation criterion outright and still lands fifth, because this ranking puts 35 percent on contract and attestation and ABlyft has neither: no downloadable DPA on the public site, and no ISO 27001 or SOC 2.

Best for: Developer-led teams that want the smallest possible data footprint

Statistics: Mixed
Shopify: No app
Hosting: DE
Consent and cookies: Cookieless available
Server-side: No
Personalization: No

Optimizely (Insight Partners)

Optimizely Web Experimentation

7.1/10

Optimizely has the deepest certification list here, ISO 27001:2022, SOC 2 Type 2, PCI DSS and TISAX, plus a public DPA with standard contractual clauses and five consent options. The problem is the one fact a European buyer needs: EU Data Hosting is offered, but Optimizely states that some services are not in scope without naming them, so whether Web Experimentation is covered stays unverified. No cookieless mode is documented for Web Experimentation either, which costs it on the heaviest criterion.

Best for: Enterprises whose procurement scores certificates above hosting detail

Statistics: Sequential
Shopify: No app
Hosting: EU
Consent and cookies: Cookies or local storage
Server-side: Yes
Personalization: Yes

Wingify (Everstone Capital)

AB Tasty

6.6/10

AB Tasty reads well on paper: first-party cookies only with a 13-month lifetime, visitor IP addresses immediately deleted rather than stored, a localStorage alternative, three consent modes including Didomi support, a named data protection officer and its own ISO 27001 certificate. It ranks seventh because the residency answer is missing and the contract is thin: AB Tasty runs on GCP and AWS with the region following the client but names no EU region, its SOC 2 belongs to the cloud providers rather than to AB Tasty itself, and the DPA arrives on request through the DPO mailbox instead of as a download.

Best for: Existing customers who can accept an unnamed hosting region

Statistics: Bayesian
Shopify: Shopify app
Hosting: EU
Consent and cookies: Cookies or local storage
Server-side: Yes
Personalization: Yes

Convert Insights Inc.

Convert Experiences

6.3/10

Convert brings a SOC 2 attestation, ISO 27001 certification, documented penetration testing and a free DPA, which clears most enterprise security questionnaires on paper. On the criterion this ranking weights heaviest it is the weakest tool in the field: no cookieless delivery mode and no Google Consent Mode integration are documented anywhere on its public pages. Convert’s own pages also disagree on the hosting region, the security page says AWS eu-west-1 in Ireland while the AI information page says Frankfurt, and the public GDPR documentation is still written in the future tense about May 2018.

Best for: Agencies that need audit certificates more urgently than consent tooling

Statistics: Mixed
Shopify: Shopify app
Hosting: EU
Consent and cookies: Unverified
Server-side: Yes
Personalization: Yes

Comparison

All tools compared

Tool	Statistics engine	Ecommerce and Shopify path	Hosting	Consent and cookies	Pricing
#1 Apex by DRIP	MixedFrequentist engine with deliberately conservative defaults: fixed-horizon testing with Holm-Bonferroni correction and a sample-ratio-mismatch gate, plus optional always-valid (mSPRT) sequential analysis. Revenue significance is intentionally held back after internal certification measured 20%+ false-positive rates on naive revenue tests. On top: win-rate prediction from the 4.3M-test corpus lifts the average program win rate from 27% to 55%.	Shopify appShopify app that passed Shopify’s review (installs via OAuth from the dashboard; not App-Store-listed yet), plus WooCommerce, Shopware, Centra and custom storefronts. Unique in this index: real charged-price tests via Shopify Cart Transform, shipping-cost tests and post-purchase experiments.	UK/IE	Cookies or local storageUK (London) and Ireland; DPA relies on the UK adequacy decision. Cookie and localStorage visitor IDs last 365 days. Apex uses no fingerprinting, never stores visitor IPs, integrates with 8 consent managers and does not support IAB TCF.program managed in Drata, SOC 2 / ISO 27001 audit package prepared, audit not yet begun	Only inside DRIP. Book a call
#2 Varify.io	MixedOne-sided frequentist by default (all plans); two-sided tests and Bayesian with runtime forecast are Pro-only. No sequential/always-valid inference and no in-product sample-size planner.	SnippetStorefront testing via snippet (no app needed); Shopify order/revenue import into the dashboard. Checkout testing needs the separate "Varify: Checkout A/B Testing" app, $119/month extra and Shopify Plus only.	DE	Cookieless availableGerman company, AWS hosting in Germany (Frankfurt). No cookies by default (local/sessionStorage), no personal data beyond IP, DPA with TOMs, documented Google Consent Mode V1/V2 setups. Not SOC 2 certified (roadmap: 54%).	Growth €249/mo (€199 paid annually), Pro €349/mo (€249 annually), Enterprise from €499/mo, unlimited tracked users on every plan, but only 1 domain. 30-day free trial, no credit card.
#3 Kameleoon	MixedFrequentist, Bayesian AND sequential testing side by side, plus CUPED, multiple-testing correction and SRM detection, all included at the entry tier. Caution: the reported "reliability" metric is 1 − p-value, not the probability the variation wins.	Shopify appShopify app carries the "Built for Shopify" badge but has 0 reviews after 4+ years (listed June 2021). Checkout testing needs Shopify Plus plus a developer-built Checkout UI extension and cart-attribute plumbing, not point-and-click.	EU	Cookies or local storageEuropean infrastructure without US hyperscalers: subprocessors are OVHcloud (France) and Hetzner (Germany); EU and North America data regions exist (EU residency is a choice, not automatic). Four documented consent modes, Delayed Mode renders experiments while writing and transmitting nothing until consent. ISO 27001:2022, SOC 2 Type 2, PCI DSS.	PBX Starter from $495/month (10 experiments, 50,000 tracked users), the only enterprise-class tool here with a public entry price. Enterprise is custom. 30-day free trial (3 experiments, no credit card). Feature management, personalization and the dedicated code editor are Enterprise-only.
#4 VWO	SequentialBayesian engine with sequential analysis that handles peeking and multiple comparisons; MDE, ROPE, false-positive rate and power are user-settable; automatic SRM, outlier and Simpson’s-paradox checks. Note: "SmartStats" is now legacy branding for non-Data360 accounts.	Shopify appShopify app (free to install, launched Mar 2024), 0 reviews after ~2.5 years. It deploys tracking everywhere except checkout, post-purchase and order-status pages: VWO cannot A/B test the Shopify checkout. Available from the Growth plan.	EU	Cookies or local storageReal EU data-residency option: customers can pin visitor data to GCP europe-west1 (Belgium); US and India regions also exist. Three documented consent modes (Completely/Partially/Do Not Block), DPA with SCCs, ISO 27001:2022, SOC 2 Type II.	No published prices, plans (Growth/Pro/Enterprise) are quoted per module and billed on Monthly Tracked Users. 30-day free trial. Procurement data (Vendr, 102 purchases) puts the median annual contract at ~$16,300 (range ~$7,800–$35,800).
#5 ABlyft	MixedFrequentist and Bayesian, selectable per experiment, with a configurable certainty level (50–99.9%) and a minimum-conversions threshold. No sequential testing and no sample-size calculator.	No appNo Shopify App Store app. Integration is snippet plus documented tracking wiring: a server-side order webhook (immune to ad blockers and missing consent) and/or the Customer Event Pixel. No checkout-UI testing.	DE	Cookieless availableThe strictest privacy posture in this comparison: no personal data stored at all, no IP, no user ID. German hosting, localStorage instead of cookies, self-hostable snippet, bring-your-own-tracker option. No SOC 2 or ISO 27001 claimed.	A genuine free plan (no credit card, no sales call) plus a quoted paid plan billed by tested users. No public numbers.
#6 Optimizely Web Experimentation	SequentialStats Engine: frequentist sequential testing with always-valid inference (mSPRT) and tiered Benjamini-Hochberg false-discovery-rate control, academically published and genuinely differentiated. Fixed-horizon and Bayesian options exist in beta (documented for Feature Experimentation).	No appNo first-party Shopify app for Web Experimentation, install is a manual theme.liquid snippet edit or a $29/month third-party app. Optimizely’s own docs: the snippet does not load on Shopify checkout pages; checkout events need a custom pixel. Revenue tracking leans on the separate paid ODP product.	EU	Cookies or local storageEU Data Hosting offered, but Optimizely states "some services aren’t in scope" without listing them, whether Web Experimentation is covered is unverified. Strong cert list (ISO 27001:2022, SOC 2 Type 2, PCI DSS, TISAX), public DPA with SCCs. Five consent options; no cookieless mode for Web Experimentation.	"Every Optimizely plan is individually packaged", no prices, no trial, no free tier for Web Experimentation. Procurement data (Vendr, 126 purchases) reports a median annual contract of ~$81,000; third-party estimates put entry around $36–40k/year.
#7 AB Tasty	BayesianWell-documented Bayesian engine (beta-binomial priors, ~1M Monte Carlo samples, automatic Bonferroni) for rate metrics; Mann-Whitney U test for revenue metrics. Sequential Testing Alerts are loser-detection only, AB Tasty itself advises against calling winners early with them.	Shopify appShopify app (free to install, launched May 2024): 4.9/5 from only 4 reviews, a thin footprint for an enterprise vendor. Whether the Shopify checkout can be tested is not documented anywhere public.	EU	Cookies or local storageFirst-party cookies only (13-month lifetime), visitor IPs "immediately deleted", three consent modes incl. Didomi support, DPA via dpo@abtasty.com. Runs on GCP/AWS with region-follows-client but no named EU region. Holds its own ISO 27001; SOC 2 is attributed to its cloud providers, not itself.	"No fixed plans. Just a custom proposal." Annual contracts, no self-serve trial (a 1–2 week proof of concept instead). Procurement data (Vendr) puts the median around $66,500/year.
#8 Convert Experiences	MixedThe deepest stats in this comparison: t-tests with configurable tails, Bonferroni/Sidak corrections, Bayesian with explicit risk thresholds, and real sequential testing via Asymptotic Confidence Sequences (Pro+). SRM check on every plan.	Shopify appNative Shopify app (free to install, launched Oct 2024, still 0 reviews) that injects the script without theme edits and is compatible with checkout extensibility, for tracking, not checkout-UI editing. Price testing and multi-arm bandits included.	EU	UnverifiedEU-hosted on AWS (security page: eu-west-1 Ireland; AI info page: Frankfurt, Convert’s own pages disagree). SOC 2 attested and ISO 27001 certified, free DPA. No documented cookieless delivery mode or Google Consent Mode integration.	Growth $399/mo ($299 paid annually), Pro $599/mo ($420 annually), both capped at 100K tested users/month; overage from $399 per 100K. USD, tax-exclusive. 15-day free trial, no credit card.

Method

How we rate

We weight consent and contractual rights above hosting. A legal transfer mechanism can support a non-German location, but a location cannot repair a missing legal basis. We state audit status without implying certification.

30%

Consent handling and behaviour before consent

Consent-manager integrations, documented consent modes, Do Not Track, and whether the tool can run with no device storage at all until consent arrives. Weighted first because this is where European supervisory authorities enforce most often.

25%

Contract and data-subject rights

A data processing agreement under Article 28(3) you can read today, a subprocessor annex that names each vendor’s entity, location and transfer mechanism, and export and erasure paths that actually execute.

20%

Data minimisation and identifier hygiene

IP handling, fingerprinting, cookie versus localStorage, identifier lifetime, and whether a no-storage mode exists.

15%

Data residency and hosting transparency

Where visitor data is stored, whether the region is named and verifiable, and the transfer mechanism. Weighted below consent and contract because an adequacy decision or standard contractual clauses can make a non-German location lawful, while a missing legal basis is not cured by any location.

10%

Compliance program and independent attestation

A managed control program, and ISO 27001 or SOC 2 reports where they exist. Weighted last because a certificate evidences a process, not lawful processing of your visitors’ data.

Common questions

Which A/B testing tool is GDPR compliant?

In our ranking, our platform Apex by DRIP comes first: eight consent-manager integrations plus Shopify’s Customer Privacy API, an Article 28(3) DPA with a named subprocessor annex, working export and erasure routes, and no IP addresses stored. Varify and Kameleoon follow. No tool makes you compliant on its own.

Which A/B testing tools work without cookies?

Varify and ABlyft set no cookies by default and keep the variation in local or sessionStorage. Kameleoon’s Delayed Mode renders experiments while writing nothing to the device. VWO, Optimizely, Convert, AB Tasty and Apex by DRIP document no cookieless client-side mode.

Can you run A/B tests without a consent banner?

Only if the tool stores nothing that needs consent, and that call belongs to you as controller, not to the vendor. ABlyft stores no personal data at all, Varify sets no cookies by default, and Kameleoon’s Delayed Mode writes and sends nothing until consent arrives.

Which A/B testing tools host visitor data in the EU?

Varify (AWS Frankfurt) and ABlyft host in Germany. Kameleoon runs on OVHcloud and Hetzner, VWO offers GCP Belgium, Convert names AWS Ireland. Apex by DRIP runs in London and Ireland with Cloudflare edge delivery. Optimizely leaves its EU scope open, AB Tasty names no EU region.

Which A/B testing tool supports Google Consent Mode v2?

Varify is the only tool here that publishes Google Consent Mode V1 and V2 setup instructions. The others wire consent through consent managers: Apex by DRIP integrates eight of them plus Shopify’s Customer Privacy API, Kameleoon has four consent modes, VWO three, Optimizely five.

The math is the easy part.
Knowing what to test isn't.

Book a call and bring the numbers you just worked out. We'll look at where your shop stands and what testing could realistically add. If it doesn't add up for you, we'll tell you.

See if your shop is a fit

A free 30-minute call with the team. That's it.

The guarantee, in full

At least 10% more revenue in under six months, or month seven onward is free.

When you can predict what wins, you can promise the outcome. What counts as uplift, how it's measured, and what happens if we miss is written down in plain language.

We can promise it because we know our numbers: more than 50% of our A/B tests win, across 4,000+ documented experiments. That's when a guarantee stops being marketing and becomes underwriting.