Hold back cookies, experiments, or both until your visitor agrees. And keep the proof. Run the experimentation program your privacy team approves.
Delay cookies, or block everything till consent is captured
DNTDo Not Track and GPCGlobal Privacy Control, scoped EU / EEA / worldwide
On by default for new projects
On by default, cites GDPR Art. 25
Stop cookies and let the experiment run, and your visitor still sees a variation they never agreed to. Convert Experiences gives you two setups.
Your experiences run at once. Cookie writing waits for consent. No flicker, and you lose some data if consent never comes.
Cookies and experiences both wait. You collect nothing and show nothing until your visitor agrees. Your page may show a content flash when it reloads after consent.
Either setup can blur the page background until your visitor decides. The blur draws attention to your consent modal and lifts the moment consent arrives.
Your CMP stays the authority on what your visitor decides. Convert Experiences reads that decision. Any platform that fires a JavaScript event on acceptance can drive the handshake.
15 days, full features, no credit card
Your banner is one source of consent. Your visitor's browser is another, and Convert Experiences reads two of its signals.
When a browser sends the header, Convert Experiences skips its scripts and runs no tests for that visitor. Find it under Respect Do Not Track Browser Settings.
California gave this signal legal weight. You pick the scope: EU only, EEA only, or worldwide.
Convert publishes an opt-out page that sets a cookie telling the Convert Experiences script to leave that visitor alone. Point your privacy notice at it and your visitors get a route out that does not depend on your banner.
GDPR Article 25 asks for privacy by design and by default. Convert Experiences does both. You can access these in settings.
Show privacy warnings sits in your Project Configuration. It is on by default, and the docs name Article 25 as the reason. Convert Experiences warns you in four cases:
Deployments warn you when a segment could drop under 100 visitors. Small segments can identify people.
You can switch the warnings off. But they start on.
Convert Experiences swaps your test, variation, segment, and goal names for IDs in the JavaScript it serves. Your test names stay out of public source code. On by default for every new project.
Convert Experiences uses them. The cross-domain cookie is off by default.
Convert Experiences stores none by default. You can add it through custom JavaScript and customer IDs. That is what the warnings above catch.
15 days, full features, no credit card
Your privacy team will ask for four documents. Convert publishes all four.
Free, signed online, no negotiation. It names Convert as processor and you as controller. Convert signs it back within five business days.
A DPIA weighs the privacy risk of what you plan to do. Convert gives you a template with the screening questions filled in. The judgment stays yours: which pages you test, which identifiers you use, which tools receive data, and what legal basis applies.
A published template, for when your lawful basis is legitimate interest.
A published procedure and form for access, correction, and deletion requests.
A mutual NDA is free on request.
Turn on two-factor authentication. A stolen password alone will not reach your tests, your audiences, or your reports.
Your experiment data sits in the EU by default. Testing in Europe does not start with a transfer problem.
Data that leaves the EEA travels under the EU Standard Contractual Clauses. The EU-US and Swiss-US Data Privacy Frameworks cover the rest.
Convert employs legal and compliance staff who review features before release.
Convert Experiences was built to GDPR requirements before the May 2018 deadline, on Privacy by Design principles.
Convert Experiences is CCPA compliant: consumer rights, data deletion, data retention, and pseudonymization.
Convert Experiences supports LGPD duties for Brazilian customers.
Convert Experiences is HIPAA compliant. Convert publishes setup guidance.
Convert is SOC 2 Type 2 attested.
Convert is ISO 27001 certified by InterCert.
Convert is Climate Neutral Certified and has planted over 94,035 trees as of August 2026.
Privacy law keeps arriving. Convert maintains a map of global privacy laws so you can check what applies where you sell.
On 6 October 2015, Europe's top court struck down the EU-US Safe Harbor deal. Convert spent January 2016 moving every server out of the US and into the EU. Dennis van der Heijden wrote up why in March 2016 (Privacy First: Convert Infrastructure Moved to E.U.).
Convert held no personal data by default even then. It moved because customers could then use its ecommerce tagging to personalize.
Ten years on, that instinct is still the design. Privacy by design.
In December 2017, eighteen months before the deadline, Convert published its GDPR homework (Convert GDPR roadmap). Every article, from 1 to 99. What the law asked, what Convert was doing, and a progress marker on each row.
It is still up. Article 7 covers consent records. Article 25 puts privacy into the build process: training, design, coding, testing, and a review before each release.
Almost no vendor published a roadmap while the work was unfinished. You can check the promises against the product you work with today.
Consent has not held still since 2018. Regulators redefined it, reversed themselves, then redefined it again. Convert stayed with the plot twists. Dennis van der Heijden argued about it in public while the answers were still ambiguous.
Regulatory event. 6 October 2015
Europe's top court strikes down the EU-US data transfer deal.
Convert milestone. January 2016
Convert moves every server out of the US. (Why)
Regulatory event. April 2016
The EU Parliament adopts the regulation. Enforcement is set for 2018.
Convert milestone. December 2017
A public roadmap, article by article, from 1 to 99. See the roadmap.
Convert milestone. 31 December 2017
Dennis maps the three lawful routes for moving EU data to a US company. Enforcement is still 17 months away. LinkedIn.
Convert milestone. 1 February 2018
Dennis opens by saying no compliant A/B testing tool exists. His own included. He then hands buyers a checklist to test any vendor with. LinkedIn.
Convert milestone. 15 February 2018
Dennis cites GDPR Recital 30 on unique IDs. He expects Convert to drop a fifth of its own 72 software tools over privacy. Read it.
Convert milestone. February 2018
Convert Experiences stops loading for visitors who send the header.
Regulatory event. 25 May 2018
Fines reach 4 percent of global turnover, or 20 million euros.
Regulatory event. July 2019
The CNIL and the ICO rule that analytics cookies need active opt-in. A/B testing is named. Default settings stop counting.
Regulatory event. 1 January 2020
Convert's GDPR work already covers most of it.
Regulatory event. 19 February 2020
A/B testing and audience measurement are exempted, under conditions.
Convert milestone. 14 May 2020
Dennis tracks how the ICO and the CNIL read one directive in opposite ways, and what the February exemption changed. LinkedIn.
Regulatory event. July 2020
Europe's top court strikes down the second EU-US transfer deal in five years.
Regulatory event. August 2020
A third regime. The same design holds.
Convert milestone. 2026
Convert Experiences gates consent, reads DNT and GPC, and applies consent rules by region.
Two transfer frameworks collapsed in five years. Convert's answer both times was to keep your data in Europe.
How Convert builds
Convert Experiences uses first-party cookies only and stores experiment data on servers in Frankfurt, Germany. Compliance is built into the development lifecycle, not bolted on after launch.
Convert Experiences publishes its pricing in full on a single pricing page, with flat-rate plans and no per-module add-on charges. Every paid Convert Experiences customer can self-serve from day one.
Convert Experiences is an experimentation platform. Not a CMS, not a personalization-only product, not an analytics suite. Convert ships what experimentation needs and stops there.
Convert Experiences is operated by a Climate Neutral Certified business. Convert runs on carbon-neutral servers in Frankfurt, donates 1% of revenue to Stripe Climate and 1% to conservation initiatives, and uses 8% of every plan fee to plant trees through TIST, totaling over 94,035 trees planted as of August 2026.
FAQ
Does Convert Experiences need consent before it runs?
That depends on how you set it up and where your visitors are. Convert Experiences ships two consent setups. One delays cookie writing while your experiences keep running. One holds back both until your visitor agrees. You choose.
How does Convert Experiences differ from Google Consent Mode?
Google Consent Mode is Google’s signaling framework for Google tags. Convert Consent Capabilities is a separate mechanism inside Convert Experiences that gates Convert’s own cookies and experiments through a consentRequired and consentGiven handshake. Most sites run both.
Does Convert Experiences collect personal data?
Convert Experiences stores no personal data under default settings. You can add it through custom JavaScript conditions, customer IDs, and page tagging. Convert Experiences raises an in-app privacy warning when you build an audience that way.
Does Convert Experiences honor Do Not Track and Global Privacy Control?
Convert Experiences supports both. Do Not Track stops Convert Experiences loading its scripts or running tests for that visitor. You can scope Global Privacy Control to the EU, the EEA, or worldwide.
Which consent platforms work with Convert Experiences?
Any consent platform that fires a JavaScript event on acceptance can drive the Convert Experiences handshake. Convert publishes listener code for OneTrust, Cookiebot, and Cookie Information, and a nine-step walkthrough for Cookiebot.
Can I get a Data Processing Agreement from Convert?
Convert provides a DPA free of charge. You sign it online, Convert signs it back, and you get the executed copy by email within five business days. The DPA names Convert as processor and your organization as controller.
Where does Convert Experiences store my experiment data?
Convert Experiences stores your experiment data in the EU. EU Standard Contractual Clauses and Data Privacy Framework certification cover transfers out of the EEA.
Set up consent and earn your legal team's approval. Start experimenting today.
Convert Experiences waits for consent. No cookie, no test, until your visitor agrees. Convert Experiences reads Do Not Track and Global Privacy Control. Convert Experiences hides your test names by default. And Convert Experiences flags privacy risk in the app, citing GDPR Article 25. Convert moved its servers to the EU in 2016, and published a GDPR roadmap in 2017. Convert Experiences is a privacy-first platform for A/B testing and personalization. Convert Insights Inc. has run it since 2009.
Editorial DisclosureConvert Experiences is our product. Statements about regulations reference the published text of those regulations and the guidance of the relevant authorities. Product behavior verified against Convert documentation as of August 2026. Written by Uwem Usa. Reviewed by Carmen Apostu and Trina Moitra.
