A/B testing tools set cookies and fingerprint visitors to assign variants. Whether that needs consent depends on what the tool stores and where your visitors are, and most teams have never asked the question.
Cookie audits hunt for the usual suspects: analytics, ads, chat. Experimentation tools slip past because they arrive through the product team, not marketing, and their cookies carry innocent-looking names. The legal analysis does not care which team installed the tool. It cares what the tool stores, reads, and shares.
What experimentation tools actually do
At minimum, a testing tool must remember which variant a visitor saw, or the experiment corrupts itself. That memory lives in a cookie or local storage and persists across sessions for the length of the test. Many tools go further: device fingerprinting to hold assignment steady, event tracking tied to the variant, and integrations that push the assignment into analytics and personalization systems.
Each step up that ladder changes the consent analysis. A bare assignment cookie is the strongest case for an exemption. A variant ID synced into an analytics profile is analytics by any definition, and a fingerprint is an identifier however the vendor describes it.
How regulators draw the line
European guidance starts from a simple rule: storing or reading information on a visitor's device needs consent unless it is strictly necessary for a service the visitor asked for. A visitor did not ask for your experiment. Some national regulators, notably in France, have carved narrow exemptions for audience measurement under strict conditions, and experimentation sometimes argues its way into that logic.
In the US, the frame differs: state laws focus on sale, sharing, and profiling opt-outs rather than cookie consent as such. A testing tool that shares identifiers with third parties can create opt-out obligations even where no banner is required. The same tool, the same cookie, two different legal questions depending on the visitor.
The practical failure mode is timing
Where consent is required, the experiment cannot start before it. Most tools are installed to load as early as possible, deliberately, because late loading causes variant flicker. That design goal and consent law point in opposite directions, and many sites resolve the conflict by simply not noticing it.
The workable compromise is a consent-aware setup: the tool loads in a blocked or cookieless mode until consent, accepting assignment from the consent moment onward. Flicker management techniques exist for this pattern. What does not work is collecting first and calling the banner retroactive permission.
An audit you can run this week
List your testing tools, read what each stores (vendor documentation usually discloses cookie names, purposes, and lifetimes), and check identifiers against your consent platform's blocking list. The question per tool is narrow: does it store or share anything beyond variant assignment, and does it fire before consent on your current setup?
Document the analysis either way. 'We reviewed it and here is the reasoning' is a defensible position in a way 'we never thought about it' never is. Experimentation joins analytics and ads in the consent inventory, or it becomes the finding in someone else's audit of you.
Related reading
These earlier guides go deeper on connected questions: Consent and Video Embeds: What Loads Before a Visitor Agrees Embedded videos often load trackers, cookies, and fingerprinting scripts before any consent choice. This guide covers two click solutions, facades, and what a compliant embed looks like., Consent and Social Login: What the Buttons Collect Before Sign In Social login buttons phone home before a visitor clicks them, loading trackers from the network on a page the visitor may never use to sign in. This guide covers what loads and how to gate it., and Newsletter Signup Tracking and Consent: What Fires Before the Form Is Sent Newsletter forms carry analytics, anti spam tools, and advertising pixels that can fire on page load or keystroke. Consent should govern those tools, not just the email subscription itself..
Frequently asked questions
Do A/B testing cookies need consent in the EU?
Often, yes. The default rule is consent for storing or reading device information unless strictly necessary. Narrow national exemptions exist for some measurement under strict conditions, but profiling, fingerprinting, or sharing assignment data with analytics pushes a tool firmly into consent territory.
What makes an experimentation cookie 'strictly necessary'?
Very little, in most readings. Keeping a shopping cart working is necessary; remembering an experiment variant serves the site's goals, not a service the visitor requested. Some regulators accept limited first-party measurement exemptions, but they are conditional and narrow.
How do we run experiments without breaking consent rules?
Load the tool in a blocked or cookieless mode until consent, then start assignment. Accept that pre-consent visitors are not in the experiment. Consent-mode integrations from major vendors formalize this pattern.
Does the US require consent for testing cookies?
Not as a banner matter in most states, but state privacy laws create opt-out rights around sale, sharing, and targeted advertising. If a testing tool shares identifiers with third parties, those duties can apply even without a banner.