CRO Partner Network
About Varify.io
Contact Varify.io
Blog
Webinars Live
Success Stories
Card set
Varify.io
FunctionsPricingFor agenciesTry for free
Get a demo

Cookieless A/B Testing — How to Run Experiments Without Cookies

Niko Kerter
Niko Kerter
·Updated May 2026
Zero cookies set
No consent banner needed
Works with GA4 + BigQuery
EU-hosted in Frankfurt
Key Takeaways
  • Browser cookie restrictions and privacy regulations are making cookie-based A/B testing increasingly unreliable
  • Varify.io is architecturally cookieless — uses localStorage, not workarounds or first-party cookie fallbacks
  • No consent banner needed, 100% of visitors tested, no tracking blocked by Safari ITP or Firefox ETP
  • Native integration with GA4, BigQuery, Matomo — no parallel tracking, no data discrepancies

The cookie era in web experimentation is ending. Safari's Intelligent Tracking Prevention (ITP) caps first-party cookies at 7 days. Firefox Enhanced Tracking Protection blocks many tracking cookies by default. Chrome's Privacy Sandbox is reshaping how third-party data works. For A/B testing tools that rely on cookies for visitor recognition, this means shorter attribution windows, incomplete data, and growing compliance complexity.

Varify.io was built for this reality. It's architecturally cookieless — not as a workaround or fallback mode, but as a core design decision. Varify uses localStorage for variant assignment, never sets a single cookie, and delegates all measurement to your existing analytics (GA4, BigQuery, Matomo). The result: no consent banner needed, no ITP restrictions, 100% of visitors tested.

Browser restrictions are tightening

Safari ITP: First-party cookies set via JavaScript are capped at 7 days. A visitor who returns after 8 days gets a new cookie — your A/B test sees them as a new user. This inflates unique visitor counts and dilutes test results.

Firefox ETP: Blocks third-party cookies by default and restricts some first-party cookie behaviors. Testing tools that rely on cross-domain cookies or tracking pixels are affected.

Chrome Privacy Sandbox: While Chrome hasn't fully eliminated third-party cookies, the Privacy Sandbox APIs are replacing traditional cookie-based tracking with new mechanisms. Tools built on cookie architectures face ongoing adaptation.

Consent rates are declining

As privacy awareness grows, cookie consent rates in Europe are dropping — some sites report below 50% acceptance. Cookie-based A/B tests lose half their data before the experiment even starts. See our GDPR compliance guide for the full picture.

Three approaches to cookieless A/B testing

1. True cookieless (Varify's approach)

No cookies at all. Variant assignment via localStorage. No consent banner needed. 100% of visitors tested. Trade-off: localStorage doesn't persist across browsers or in incognito — statistically negligible for most tests.

2. First-party cookie fallbacks (Convert, VWO)

Some tools offer "cookieless modes" that actually use first-party cookies with various workarounds (server-side cookie setting, reduced scope). These still trigger ePrivacy consent requirements and are still subject to ITP restrictions. It's better than third-party cookies but not truly cookieless.

3. Server-side identification (GrowthBook, custom)

Assign variants server-side using hashed user IDs or session tokens. Truly cookieless and powerful, but requires developer resources for implementation. Not suitable for teams that need visual editors and marketer-friendly workflows.

Cookieless capabilities compared

FeatureVarify.ioConvertPostHogVWO
Cookieless modeDefault (always)OptionalConfigurableNot available
TechnologylocalStorage1st-party cookiesConfigurableCookies only
Consent neededNoYesConfigurableYes
ITP affectedNoYes (7-day cap)DependsYes
Visual editor
Pricefrom €149/mofrom $99/moFree (self-host)from $299/mo

Source: Claude Research, May 1, 2026

Cookieless A/B testing. Not a workaround — an architecture.

Varify never sets cookies. No consent issues, no ITP blocking, no tracking gaps. From €149/month.

Start your free trialFree 30-day trial

The future is cookieless — prepare now

The trajectory is clear: browser vendors are restricting cookies further, regulators are tightening consent requirements, and users are becoming more privacy-aware. A/B testing tools built on cookie architectures will face increasing friction — shorter attribution windows, smaller sample sizes, more compliance overhead.

Tools built on cookieless architectures (like Varify) are already prepared. No adaptation needed when the next browser update drops, no scramble when ePrivacy Regulation passes, no consent rate to worry about.

For teams evaluating A/B testing tools today, choosing a cookieless-native tool isn't just a privacy decision — it's a future-proofing decision. Compare your options in our European SMB tools guide.


Niko Kerter
Niko Kerter
CRO Expert at Varify.io
Share article!

Frequently asked questions about cookieless A/B testing

What's the difference between 'cookieless' and 'cookie-free'?

In practice, they mean the same thing: the tool doesn't set any cookies. Be cautious with tools that claim 'cookieless mode' — some use first-party cookies but call them 'cookieless' because they avoid third-party cookies. Varify is fully cookie-free: zero cookies of any kind.

Does localStorage work as reliably as cookies for A/B testing?

For the purpose of variant assignment (showing the same visitor the same variant consistently), yes. localStorage persists until explicitly cleared — unlike ITP-restricted cookies that expire after 7 days. The one limitation: localStorage is browser-specific and clears in incognito. For most sites this affects <5% of sessions.

Will cookieless A/B testing work if users clear their browser data?

If a user clears all browser data (including localStorage), they'll get a fresh variant assignment on their next visit — same as with cookies. This is statistically expected and doesn't affect test validity at normal traffic levels.

Can I run cookieless A/B tests on a Single Page Application (SPA)?

Yes. Varify supports SPAs with URL change detection and manual activation via JavaScript API. The cookieless architecture (localStorage) works identically on SPAs and traditional multi-page sites.

Wait — It's time for Uplift

Receive our powerful CRO Insights free of charge every month.

No spam. Unsubscribe anytime. We respect your privacy.