GDPR and A/B Testing Tools in 2026: What 15 Vendors Publish, and What to Ask

01Which A/B Testing Tools Publish the Facts a GDPR Review Needs?

A GDPR review of an A/B testing tool asks five things. Where is the data stored? What does the script put on the visitor’s device, and does it wait for consent? Is there a data processing agreement (DPA) and a subprocessor list? Which independent audit backs the security claims? Does data leave the EU, and under which contract? This page collects each vendor’s own answers and lists what to ask where a vendor publishes nothing.

1. ISO 27001 and SOC 2 Type 2 published: Convert Experiences, Kameleoon, Optimizely. SOC 2 Type II: GrowthBook, and Shopify for the platform that runs Rollouts.
2. In progress: Apex by DRIP (ISO 27001 and SOC 2), Varify.io (SOC 2 “SOON”), Visually.io (SOC 2 and GDPR programs “in the process”).
3. Hosting in Germany: Convert (Frankfurt), Varify.io (AWS Frankfurt plus Cloudflare), ABlyft. EU data centers: Optimizely. EU plus UK: Apex. EU region for event data, or self-hosting: GrowthBook.
4. Transfers outside Europe stated: Intelligems and Visually.io (including Canada and the United States), Shoplift (United States, under a DPA with EEA clauses). No region published: ABConvert, Elevate, Shopify Rollouts.

This page covers the compliance facts and the questions to ask. For the buying decision, with test types, shop systems and prices side by side, read our sister page on A/B testing tools for European shops. For capabilities and statistics, read the 15-tool deep dive on A/B testing tools for online shops.

02What Does GDPR Ask of an A/B Testing Tool?

An A/B testing tool assigns each visitor to a variant, remembers that assignment and records what the visitor does next. Each step touches data, and three sets of rules apply.

• Controller and processor. The shop is the controller; the testing vendor is usually a processor. Shoplift’s documentation says so, and ABConvert states that it “acts as data processor”. GDPR Article 28 requires a contract between the two, the DPA. The vendor’s own suppliers, such as its cloud host, are subprocessors, and the shop should know who they are.
• Device storage. Storing or reading information on a visitor’s device falls under the ePrivacy rules, in Germany the TDDDG (formerly TTDSG). They concern storage in general, not cookies alone, so a tool that uses localStorage still raises the consent question. Whether a test may run before consent is a legal judgement; what the script stores and when it starts are the facts behind it.
• Transfers. When data is handled outside the EU or EEA, GDPR requires a transfer mechanism, typically Standard Contractual Clauses (SCCs) in the DPA or an adequacy decision. A Frankfurt data center does not settle this on its own if a subprocessor, such as an AI provider, sits elsewhere: Kameleoon’s subprocessor list includes OpenAI and Mixpanel next to its hosts.

03How Do the 15 Tools Compare on GDPR Facts?

“None found” means we did not find the item on the vendor’s public pages in October 2026, not that the vendor lacks it. Some vendors share documents only on request or under NDA.

Three groups stand out. Convert, Kameleoon and Optimizely publish certifications and contracts. Varify.io and ABlyft publish hosting in Germany but no ISO 27001 or SOC 2 yet. The Shopify testing apps publish less: two state transfers to the United States and Canada, one processes in the United States under a DPA, and two name no hosting region. Apex: hosting in the EU plus UK, consent apps supported, ISO 27001 and SOC 2 in progress.

04What Does Each Vendor Publish About GDPR?

Each profile quotes the vendor’s own pages, read in October 2026. For shop systems, prices and capabilities, follow the link at the end of each profile.

Apex by DRIP: GDPR facts as DRIP states them

• Best for: shops whose tests keep coming back flat: the constraint is choosing which tests to run, not building them.
• Shop systems: installs as a Shopify app (two-click install via link, server-side tracking, first-party data).
• Data location: hosting in the EU plus UK.
• Cookies and consent: consent supported for most Shopify GDPR consent apps.
• DPA and subprocessors: GDPR in place; DPAs for US tools.
• Certifications: ISO 27001 and SOC 2 in progress. Apex holds no certification yet.
• Main strength: the memory of millions of observed tests behind every idea, so selection improves before anything is built.
• Main limitation: the price is not published; a card-free free tier for one store exists.

Apex by DRIP is an A/B testing platform for companies selling online that predicts which tests are likely to win before they go live, built on one of the largest A/B test databases in e-commerce. Apex scores each idea against 4.3 million observed A/B tests from 151,000 shops and shows how many tests back each score. The nearest published figure in this comparison is Kameleoon’s Ideate, trained on more than 20,000 experiments; Varify cites 10,000 or more test patterns; no other vendor in this comparison publishes a count of tests behind its recommendations (vendor pages checked October 2026).

Where Apex is not the right choice:

• A team that already picks winning tests well gets less from the prediction layer.
• A shop that cannot ship a test a week yet should build that habit on a lighter tool first; buying prediction before you can execute is the wrong order.
• Anyone who needs a published price list before a conversation.

What to ask DRIP: the hosting locations in the EU and UK, the US tools covered by DPAs, whether your consent app is supported, and the state of the ISO 27001 and SOC 2 work.

Convert Experiences: Frankfurt hosting, ISO 27001 and SOC 2 Type 2

• Best for: teams that want EU hosting, published certifications and a published price.
• Data location: “EU-based servers in Frankfurt by default”.
• Cookies and consent: “first-party cookies only”. Two consent modes: block cookies but show experiments before consent, or block both until consent. Works with Cookiebot, OneTrust and other consent tools. No named cookieless mode.
• DPA and subprocessors: free signed DPA with Standard Contractual Clauses at convert.com/gdpr/dpa. Subprocessor page: none found.
• Certifications: ISO 27001, SOC 2 Type 2, HIPAA, CCPA. Homepage: “GDPR, TTDSG, and BDSG Compliant”.
• Transfers outside the EU: “Convert Experiences does not know any cross-border data transfer from to or from outside EEA borders in its infrastructure.”
• Not the right choice for: teams that need a published subprocessor list before signing.

What to ask Convert: the subprocessor list, the scope of the ISO 27001 certificate and access to the SOC 2 report, and which consent mode fits your banner. Full comparison: Apex vs Convert.

Kameleoon: certifications, consent modes and a public subprocessor list

• Best for: enterprise teams that combine client-side tests with server-side feature flags.
• Data location: “dedicated servers to which only Kameleoon personnel have access”; subprocessors OVHcloud, Hetzner and Cloudflare. Region not stated on the pages we read.
• Cookies and consent: consent modes “not required”, “required” (tracking delayed until consent) and IAB TCF 2.3. With unknown consent: block, run only “Technical” experiments, or run without data collection. No named cookieless mode.
• DPA and subprocessors: subprocessors listed on the security portal, including OpenAI and Mixpanel. DPA not published on the pages read; contact dataprotection@kameleoon.com.
• Certifications: ISO/IEC 27001:2022, SOC 2 Type 2, PCI DSS, HIPAA, GDPR, CCPA, CyberVadis Platinum.
• Transfers outside the EU: not stated on the pages we read. A product-level CNIL certification statement: none found.
• Not the right choice for: Shopify stores not on Plus.

What to ask Kameleoon: the hosting region, the DPA, and which data reaches OpenAI, a listed subprocessor, under which contract. Full comparison: Apex vs Kameleoon.

Optimizely: EU data centers, DPA with SCCs, reports on request

• Best for: enterprise teams that test across web, backend, mobile and edge.
• Data location: “Your data will be stored in EU data centers”; “the majority” of products are in the EU Data Boundary.
• Cookies and consent: a documentation page “Configure cookie and local storage consent” exists; we did not open it. Cookieless mode: not checked.
• DPA and subprocessors: “EU/GDPR compliant Data Processing Agreement (DPA) with SCCs + UK & Swiss Addendums”; subprocessors at optimizely.com/legal/sub-processors.
• Certifications: ISO 27001:2022, ISO 27017, ISO 27018, “SOC 2 Type 2 Attestation”, PCI DSS; reports “available upon request”.
• Transfers outside the EU: the DPA includes SCCs; the services outside the EU Data Boundary are not named.
• Not the right choice for: Shopify checkout tests: the snippet cannot run in Shopify checkout.

What to ask Optimizely: which of the products you buy sit outside the EU Data Boundary, and the SOC 2 and ISO reports. Full comparison: Apex vs Optimizely.

Varify.io: AWS Frankfurt, no cookies in principle, SOC 2 announced

• Best for: no-code tests on any shop system at a flat price per domain.
• Data location: AWS, Frankfurt, plus Cloudflare.
• Cookies and consent: “In principle, no cookies are set”; local or session storage instead (the checkout app lists a “client ID cookie”). “Varify Consent Mode” exists; the consent decision is left to the customer’s legal review.
• DPA and subprocessors: DPA downloadable; AWS and Cloudflare named; no subprocessor page found.
• Certifications: SOC 2 marked “SOON”; ISO 27001: none found. Claims “GDPR, CCPA, HIPAA and revDSG”.
• Transfers outside the EU: no statement found. The vendor says it stores “no personal data other than the IP address”.
• Not the right choice for: buyers who require SOC 2 or ISO 27001 today.

What to ask Varify.io: the subprocessor list, how the IP address is processed and stored, the Cloudflare setup, and the SOC 2 audit date. Full comparison: Apex vs Varify.

ABlyft: hosting in Germany, no stored personal data, localStorage by default

• Best for: developer-led teams that want hosting in Germany and no stored personal data.
• Data location: “Hosting and Storage in Germany”; snippet delivered through the Amazon CloudFront CDN.
• Cookies and consent: “localStorage (default)”; cookies are off by default and can be switched on with a configurable lifetime. Works with the site’s consent flow, Usercentrics and a DoNotTrack setting.
• DPA and subprocessors: a DPA is mentioned for AI features (“a clear data processing agreement is in place”); no public DPA and no subprocessor page found.
• Certifications: not published. The data center is “certified according to the highest standards” without naming a standard. The security docs say: “It is not a compliance statement.”
• Transfers outside the EU: no statement found. “We do not store any personal data. Nothing.” “We do not store IP addresses.”
• Not the right choice for: buyers who need public ISO 27001 or SOC 2 evidence.

What to ask ABlyft: a signed DPA for the testing itself, the subprocessor list including the CDN, and which standard the data center holds. Full comparison: Apex vs ABlyft.

GrowthBook: self-hosting, an EU region for events, SOC 2 Type II

• Best for: teams with a data warehouse that want to self-host or keep raw data in their own infrastructure.
• Data location: self-hosted in your own infrastructure, or GrowthBook Cloud on AWS. Since September 11, 2026 an EU region (Ireland) stores event data “for every GrowthBook Cloud plan”; login, UI, configuration and computed experiment results stay in the US.
• Cookies and consent: not documented on the pages read. A third-party summary of the vendor docs says the Shopify script stores “a unique anonymous cookie ID”.
• DPA and subprocessors: DPA and Standard Contractual Clauses exist; trust center at trust.growthbook.io; subprocessor page: none found.
• Certifications: SOC 2 Type II; GDPR, COPPA and CCPA compliance stated; ISO 27001: none found.
• Transfers outside the EU: on Cloud, the application and computed results stay in the US. The vendor says “no PII ever leaves your data warehouse”.
• Not the right choice for: shops without a data warehouse or analytics engineering.

What to ask GrowthBook: whether the US-hosted application processes any personal data, which cookie the Shopify script sets, and the subprocessor list. Full comparison: Apex vs GrowthBook.

VWO and AB Tasty (Wingify): not covered by our research

• Best for: teams that want agents across the test lifecycle, with approval gates.
• Data location, consent, DPA, certifications, transfers: not part of our research of October 6, 2026. We do not fill these in from memory.
• Not the right choice for: teams that need price, offer or checkout tests today: none were live as of October 6, 2026.

What to ask Wingify: all five facts, and whether the DPA, hosting region and subprocessors changed with the merger for existing VWO or AB Tasty contracts. Full comparison: Apex vs VWO.

Shoplift: processing in the United States, DPA with EEA clauses

• Best for: Shopify shops that test themes and templates in the Shopify Theme Editor.
• Data location: data “is transferred to and processed in the United States”.
• Cookies and consent: consent through Shopify’s Customer Privacy API; if a visitor declines, “no visitor data is collected, logged, or stored”. Cookieless mode: not published.
• DPA and subprocessors: Shoplift is processor, the merchant controller; DPA with EEA SCC Module 2 and the UK IDTA; 30 days’ notice of new sub-processors. Subprocessor page: none found.
• Certifications: ISO 27001 and SOC 2: none found.
• Transfers outside the EU: yes, to the United States, under the SCCs in the DPA.
• Not the right choice for: buyers who need processing inside the EU, since data is processed in the United States.

What to ask Shoplift: the current subprocessor list, and whether any audit report exists. Its transfer and consent answers are already in writing. Full comparison: Apex vs Shoplift.

Intelligems: transfers outside Europe stated, no DPA found

• Best for: Shopify shops that test prices, shipping and offers and read results on profit.
• Data location: hosting region not published.
• Cookies and consent: cookieless mode and consent handling: none found.
• DPA and subprocessors: none found. European residents can request access or deletion under the privacy policy.
• Certifications: SOC 2 and ISO 27001: none found.
• Transfers outside the EU: data “will be transferred outside of Europe, including to Canada and the United States”.
• Not the right choice for: buyers who need SOC 2, a DPA or EU hosting documented up front.

What to ask Intelligems: a DPA with SCCs, the subprocessor list, the hosting region, and how the script behaves before consent. Full comparison: Apex vs Intelligems.

ABConvert: DPA on request, region not published

• Best for: Shopify shops that test prices, shipping, offers and checkout without a developer.
• Data location: “MongoDB Atlas, Linode and Google Cloud”; region not published.
• Cookies and consent: assignment stored in localStorage and cart attributes. “Your cookie notice is your responsibility, as it is for every app on your store.” Cookieless mode: none found.
• DPA and subprocessors: acts as data processor; DPA with “EU standard contractual clauses where they apply”, countersigned on request to privacy@abconvert.io. Subprocessors come with the DPA; no public page.
• Certifications: ISO 27001 and SOC 2: none found.
• Transfers outside the EU: not stated. The vendor does not collect “Shopper names, email addresses, phone numbers and street addresses”.
• Not the right choice for: buyers who require ISO 27001, SOC 2 or a stated EU hosting region.

What to ask ABConvert: the hosting regions of all three providers, and which transfers the SCCs cover. Full comparison: Apex vs ABConvert.

Visually.io: inactive until consent, SOC 2 and GDPR programs in progress

• Best for: Shopify shops that want testing, personalisation and upsells in one app.
• Data location: region not published; SDK on a Google CDN, raw export bucket on Google Cloud.
• Cookies and consent: uses Shopify’s Customer Privacy API; in opt-in mode “Visually remains completely inactive until consent is granted”. “Visually does not retain visitor IP addresses”, while the privacy policy lists the IP address among data collected.
• DPA and subprocessors: none found.
• Certifications: “Visually is currently in the process of completing formal compliance and audit programs for: SOC 2, GDPR”. ISO 27001: none found.
• Transfers outside the EU: data “will be transferred outside of Europe, including to Canada and the United States”.
• Not the right choice for: buyers who require a completed SOC 2 report or ISO 27001 today.

What to ask Visually.io: a DPA with SCCs, the subprocessor list, the date the SOC 2 program completes, and which IP statement applies. Full comparison: Apex vs Visually.

Elevate A/B Testing: no hosting region or DPA published

• Best for: Shopify shops that want price, shipping and checkout tests in one app.
• Data location: hosting region not published.
• Cookies and consent: assignment uses a visitor ID cookie and the ABTL cookie; the app “respects the visitor’s consent choice”. “Only anonymous behavioral data is collected.” Cookieless mode: none found.
• DPA and subprocessors: not published. GDPR is not mentioned in the privacy policy. Data is removed 48 hours after uninstall.
• Certifications: ISO 27001 and SOC 2: none found.
• Transfers outside the EU: not published.
• Not the right choice for: buyers who need a signed DPA, a subprocessors list, SOC 2 or ISO 27001 before purchase.

What to ask Elevate: all five facts. Start with the DPA and the hosting region, since neither is public. Elevate is covered in our 15-tool deep dive.

Shopify Rollouts: platform audits, experiment data not described

• Best for: Shopify shops on Grow or higher that want testing inside the admin, without an app.
• Data location: not published on Shopify’s security page.
• Cookies and consent: visitor assignment method, cookies and consent handling for experiments: not published.
• DPA and subprocessors: Shopify publishes GDPR and CCPA guidance pages; subprocessors on the security page: not published.
• Certifications: Shopify is “certified Level 1 PCI DSS compliant” and has “issued SOC 2 Type II and SOC 3 reports”. ISO 27001: not published.
• Transfers outside the EU: not published for experiments.
• Not the right choice for: headless or custom storefronts, which experiments do not cover.

What to ask Shopify: what Rollouts stores on the visitor’s device and whether experiments wait for consent. Full comparison: Apex vs Shopify Rollouts.

05What Should You Ask an A/B Testing Vendor Before You Sign?

Send these to every vendor on your shortlist, including the ones that publish a lot. Pages go out of date, and a written answer is what your data protection officer can file.

1. Location: In which countries, with which cloud providers, is our test data stored and processed?
2. Location: Does that region cover everything, including the application, login, configuration and computed results, and the CDN that delivers the script?
3. Device: What does the script store on the visitor’s device (cookies, localStorage, sessionStorage), under which names, and for how long?
4. Consent: Does the script run before a consent choice, and what happens when consent is declined or unknown?
5. Consent: Which consent tools or interfaces does it read: Shopify’s Customer Privacy API, IAB TCF, Cookiebot, Usercentrics, OneTrust?
6. Personal data: Do you store IP addresses or other personal data, and for how long?
7. Contract: Can we sign your DPA before the trial, and does it include Standard Contractual Clauses?
8. Subprocessors: Where is the current list, and how much notice do you give before adding one?
9. AI features: Do they send our data to an AI provider, and is that provider on the list?
10. Retention: How long do you keep our data, and what happens to it when we cancel or uninstall?
11. Audits: Is your ISO 27001 certificate current and what does its scope cover? Can we read the SOC 2 Type 2 report, under NDA if needed?
12. Transfers: Does any data leave the EU or EEA, to which countries, through which subprocessors, and on which basis: SCCs, an adequacy decision, or certification under the EU-US Data Privacy Framework?

06How Do You Read a Vendor’s GDPR Answers?

Answers come in three kinds. Statements are what a vendor says about itself, such as “GDPR, TTDSG, and BDSG Compliant” on Convert’s homepage. Documents are what you can sign or file: a DPA, a subprocessor list. Audits are what an outsider checked: an ISO 27001 certificate or a SOC 2 report. A strong answer has all three.

Check the scope. Optimizely puts “the majority” of its products in the EU Data Boundary without naming the rest. GrowthBook’s EU region covers event data, while the application and computed results stay in the US.

Follow up on contradictions. Visually.io says it “does not retain visitor IP addresses”, while its privacy policy lists the IP address among data collected. Varify.io says “In principle, no cookies are set”, while its separate checkout app lists a “client ID cookie”. Both may be consistent, but each is a question to put in writing.

Keep the date. GrowthBook added its EU region on September 11, 2026, and Varify.io marks SOC 2 as “SOON”. A review from last year may describe a different product.

07How Should the GDPR Facts Shape Your Choice of Tool?

If your review needs published ISO 27001 and SOC 2 Type 2 today, Convert Experiences, Kameleoon and Optimizely publish both, and Convert adds Frankfurt hosting and a free signed DPA. If hosting in Germany and little stored personal data decide it, Varify.io and ABlyft document both, without published ISO 27001 or SOC 2. If data must stay in your own infrastructure, GrowthBook can be self-hosted. Apex by DRIP states GDPR in place, hosting in the EU plus UK, DPAs for US tools and consent support for most Shopify GDPR apps, with ISO 27001 and SOC 2 in progress.

Among the Shopify testing apps, Shoplift documents more than the others: a DPA with EEA clauses, a consent integration and a plain statement that data is processed in the United States. Intelligems and Visually.io state transfers outside Europe, ABConvert offers a DPA on request, and Elevate and Shopify Rollouts publish little about experiment data.

Once several tools pass your review, the review stops deciding. Ronny Kohavi puts the industry baseline at 10 to 20 percent of experiments winning, so which tests you run tends to matter more than the remaining differences. To compare test types, shop systems and prices, read our sister page on A/B testing tools for European shops or the A/B testing tools guide.