Privacy and consent

Does A/B Testing Use Cookies?

★★★ Technical level 3 of 3

Written by Neil Webley · Last updated 7 August 2026

A/B testing commonly uses first-party cookies to remember which test version a visitor has been assigned. This provides a consistent visitor experience and allows the experiment to compare versions reliably.

Quick answer

Usually, yes. Most client-side A/B testing platforms use first-party cookies or similar browser storage to remember which version of a test a visitor has been assigned. Depending on how the website is configured and the laws that apply, consent may be required before those cookies or equivalent identifiers are created.

Why does A/B testing use cookies?

When creating an A/B test, eligible visitors are divided between a control and one or more alternative versions. A cookie can store that assignment so the visitor sees the same version on later pages and return visits. Without remembering the assignment, somebody could see different variants across pages or visits. That would create an inconsistent user experience and could make the experiment results less reliable.

Cookies can also help an experimentation system recognise whether a visitor has already entered a test, was excluded by traffic allocation or should not be evaluated again for a short period.

Does every A/B testing platform use cookies?

No. Cookies are common in client-side A/B testing, but implementations vary. Experimentation platforms include Optimizely, VWO, AB Tasty, Convert Experiences and FreeCROTool, but this does not mean they all use cookies in the same way. Depending on the platform and whether testing is client-side, server-side or otherwise configured, an implementation might use first-party cookies, browser storage, a server-side identifier or another method of maintaining an assignment. Check the behaviour and documentation of the platform you actually use.

What information do A/B testing cookies contain?

A typical experiment cookie contains a test identifier and the number or identifier of the assigned version. It may also contain an operational flag, such as whether the visitor was excluded from a test. It should not be used to store names, email addresses or other unnecessary visitor information.

Identifiers that do not contain a name or email address can still be relevant to privacy and cookie rules. Do not assume that a cookie is exempt from consent requirements merely because its value appears anonymous or pseudonymous.

Are A/B testing cookies first-party cookies?

Many client-side testing tools set first-party cookies on the website being tested. A first-party cookie is associated with the domain the visitor is using. This differs from a third-party cookie set in another organisation's domain, but being first-party does not by itself determine whether consent is required.

Are A/B testing cookies strictly necessary?

There is no universal classification for every A/B test. Depending on the purpose, configuration and applicable law, a website might classify experimentation under preferences, statistics or marketing. In some circumstances an organisation may consider particular cookies strictly necessary, but it should not assume that classification applies merely because the test needs a cookie to operate.

What happens when a visitor rejects or withdraws consent?

If your chosen category requires consent, the test should not begin and its cookies should not be created until that consent has been given. Rejection should leave the visitor outside the experiment. If consent is withdrawn, prevent testing on later page loads and configure the consent platform to remove the relevant cookies.

A variant may already have changed the current page before consent is withdrawn. Reloading the page may therefore be necessary to restore its normal state.

How long should A/B testing cookies last?

The duration should be long enough to maintain a consistent assignment for the relevant experiment, but no longer than necessary for its stated purpose. Record the actual duration in your cookie information and review obsolete experiment cookies when a test ends. The appropriate duration depends on the platform, experiment and applicable requirements.

What should your privacy information include?

Document the cookie name or naming pattern, provider, purpose, information stored, duration and category in your cookie policy or cookie declaration and privacy notice. Update your terms and conditions where appropriate. Explain how visitors can reject, change or withdraw consent.

Why FreeCROTool uses cookies

FreeCROTool records which version of a test a visitor has seen so they receive the same experience each time they return to the page. Its experiment cookies contain test identifiers, variant numbers and operational flags; they do not store a visitor's name or email address.

Cookies created by FreeCROTool

These are first-party cookies set on your website's domain with a site-wide path=/. The default duration may change if the tag configuration changes, so check your installed tag when maintaining your cookie declaration.

Choose the consent category for FreeCROTool

Whether testing starts automatically depends on the options selected when your project was created and any changes made to its settings since then. If your implementation requires consent before experiment cookies can be set, configure the project so that testing waits to be enabled. Only enable it after the visitor has accepted the cookie category you have assigned to experimentation.

Use the category and legal basis approved for your implementation. Add the relevant FreeCROTool cookie names, purposes, durations and provider information to your privacy documents and consent platform.

Where to add your cookie consent logic in FreeCROTool

1. Sign in to the FreeCROTool interface and open the project list.
2. Find the relevant project and select Settings.
3. Open the Initialisation tab.
4. Thoroughly review and test the logic before adding it. Confirm that it uses the consent category and events intended for your consent manager.
5. Add the appropriate code to the Initialisation script field. Paste JavaScript only; do not include opening or closing <script> tags.
6. Select Update, then publish the project tag so the new initialisation script is included on your website.

FreeCROTool Cookiebot integration

First check that your FreeCROTool project is configured to wait for testing to be enabled. Then load Cookiebot and the FreeCROTool tag before this integration. Set freeCROConsentCategory to the category approved for your implementation: preferences, statistics or marketing. Cookiebot's consent-ready event also handles consent saved during an earlier visit.

try {
  var freeCROConsentCategory = 'statistics'; // Change after legal review.
  var freeCROStarted = false;

  function startFreeCROTesting() {
    try {
      if (freeCROStarted || !window.cro_tests) return;
      if (typeof window.cro_tests.enableTesting !== 'function') return;

      freeCROStarted = true;
      window.cro_tests.enableTesting();
      window.cro_tests.evaluate();
    } catch (error) {
      console.error('FreeCROTool could not be enabled.', error);
    }
  }

  window.addEventListener('CookiebotOnConsentReady', function () {
    try {
      if (window.Cookiebot &&
          Cookiebot.consent[freeCROConsentCategory] === true) {
        startFreeCROTesting();
      }
    } catch (error) {
      console.error('FreeCROTool consent check failed.', error);
    }
  }, false);
} catch (error) {
  console.error('FreeCROTool consent logic could not be initialised.', error);
}

If consent is withdrawn after a variant has changed the current page, reload the page to restore its normal state. Configure Cookiebot to remove the FreeCROTool cookies on withdrawal and do not start testing on subsequent page loads.

FreeCROTool bespoke consent integration

First check that your FreeCROTool project is configured to wait for testing to be enabled. In a custom consent manager, call one function only when the visitor has accepted the category your organisation selected. Do not call it merely because the consent banner has closed.

try {
  var freeCROStarted = false;

  function enableTestingAfterConsent() {
    try {
      if (freeCROStarted || !window.cro_tests) return;
      if (typeof window.cro_tests.enableTesting !== 'function') return;

      freeCROStarted = true;
      window.cro_tests.enableTesting();
      window.cro_tests.evaluate();
    } catch (error) {
      console.error('FreeCROTool could not be enabled.', error);
    }
  }

  // Run this check when consent is loaded and whenever it changes.
  function applyConsent(consent) {
    try {
      if (consent.statistics === true) { // Use your approved category.
        enableTestingAfterConsent();
      }
    } catch (error) {
      console.error('FreeCROTool consent check failed.', error);
    }
  }

  yourConsentManager.onConsentReady(applyConsent);
  yourConsentManager.onConsentChanged(applyConsent);
} catch (error) {
  console.error('FreeCROTool consent logic could not be initialised.', error);
}

Wrapping the integration in try...catch helps prevent an unexpected consent-manager or FreeCROTool error from escaping into other JavaScript on the page. Keep error logging in place so failures can still be found and investigated.

Replace the example method names with those supplied by your consent platform. Make sure its consent-ready callback runs after the FreeCROTool tag has loaded, or arrange for the check to run again when the tag becomes available.

FreeCROTool consent testing checklist

• Confirm the cookie classification and legal basis with your legal or privacy adviser.
• Check whether the project starts testing automatically or waits to be enabled, and update the project setting if necessary.
• Thoroughly review the initialisation logic and protect it with try...catch before adding it.
• Update and publish the project tag after changing its initialisation script, then allow up to 30 minutes for the CDN cache to update.
• Update your cookie information, privacy notice and, where appropriate, terms and conditions.
• Verify that no _cro.* cookie is created before the required consent.
• Test new consent, saved consent, rejection and withdrawal.
• If you use GA4 event or conversion tracking, verify that its consent behaviour is also correct.
• Test the control and every variant in Staging on desktop and mobile.
• Repeat these checks whenever the tag, consent manager or cookie classification changes.