- Server location is crucial for GDPR: Data processed in Germany remains under EU jurisdiction without SCCs
- Varify.io: The application runs on AWS in Frankfurt. Delivery runs through Cloudflare's global network. All sub-processors and transfer bases are listed in Annex 5 of our DPA.
- Cookie-free architecture: Varify sets no cookies. A consent option is built in; whether you need it is up to your legal review.
- Most US-based tools (VWO, Optimizely, Crazy Egg) require DPAs + SCCs for GDPR compliance
For European companies, GDPR compliance in A/B testing isn't just a checkbox — it's an architecture question. Where is your data processed? Does the tool use cookies that require consent? Is there transatlantic data transfer to US servers? Varify.io answers all three: The application runs on AWS in Frankfurt. Delivery runs through Cloudflare's global network. All sub-processors and transfer bases are listed in Annex 5 of our DPA. The architecture is cookie-free: Varify sets no cookies. A consent option is built in; whether you need it is up to your legal review.
Most popular A/B testing tools are US-based (VWO, Optimizely, Crazy Egg) and require Data Processing Agreements, Standard Contractual Clauses, and careful consent management for GDPR compliance. European alternatives like Varify and Kameleoon offer native compliance — but with different architectures and price points. For a broader comparison, see our best A/B testing tools for European SMBs.
Why server location matters in A/B testing
Data residency determines which legal framework applies to your testing data. When an A/B testing tool processes visitor data on US servers, that data falls under the US CLOUD Act — regardless of what the DPA says. EU-hosted tools keep data exclusively under GDPR jurisdiction.
Consent requirements depend on tool architecture. Cookie-based tools trigger ePrivacy requirements and need consent banners. Cookie-free tools like Varify use localStorage instead — which under current ePrivacy guidance doesn't require consent. The practical effect: Cookie-based tools only test the 60-70% of visitors who accept cookies. Varify tests 100%.
Data Processing Agreements with US vendors require Standard Contractual Clauses (SCCs) and often Transfer Impact Assessments. With an EU-hosted tool, this entire compliance layer disappears. Fewer legal documents, less risk, faster setup.
EU-hosted vs. US-hosted A/B testing tools
| Criteria | Varify.io | Kameleoon | Convert | VWO | Optimizely |
|---|---|---|---|---|---|
| Server location | Frankfurt, DE | France, EU | EU option | US/India | US |
| Cookie-free | Optional | ||||
| Consent banner needed | Up to your legal review | Yes | Depends | Yes | Yes |
| DPA + SCCs required | All sub-processors and transfer bases are listed in Annex 5 of our DPA. | DPA only | DPA + SCCs | DPA + SCCs | DPA + SCCs |
| US CLOUD Act risk | None | None | Possible | Yes | Yes |
| Price | from €199/mo | Custom quote | from $99/mo | from $299/mo | from $1,298/mo |
Source: Claude Research, May 1, 2026
Varify and Kameleoon are both EU-native. The main difference: Varify is cookie-free (no consent required) with flat-rate pricing from €199/month. Kameleoon uses cookies and targets enterprise with custom pricing. Convert offers an EU hosting option but is primarily US-based. VWO and Optimizely require full SCC compliance stacks.
How Varify achieves GDPR compliance by design
1. Hosting in Frankfurt
The application runs on AWS in Frankfurt. Delivery runs through Cloudflare's global network. All sub-processors and transfer bases are listed in Annex 5 of our DPA.
2. Cookie-free architecture
Varify uses localStorage instead of cookies for variation assignment. Varify sets no cookies. A consent option is built in; whether you need it is up to your legal review.
3. No proprietary tracking required
On the analytics path, Varify doesn't build parallel tracking. It integrates with your existing analytics (GA4, BigQuery, Matomo, Piwik Pro). No additional data collection, no extra cookies, no additional consent scope.
4. Minimal data footprint
The Varify snippet (11.5 KB) delivers experiment variations. It doesn't collect behavioral data, doesn't do visitor fingerprinting, and doesn't create user profiles. On the analytics path, measurement happens entirely in your analytics tool.
A/B testing that's GDPR compliant by architecture, not by configuration.
The application runs on AWS in Frankfurt. Varify sets no cookies. A consent option is built in; whether you need it is up to your legal review. From €199/month.
GDPR compliance checklist for A/B testing
Use this checklist when evaluating any A/B testing tool for GDPR compliance:
- Where is data processed? EU servers eliminate transatlantic transfer risks. Check the vendor's actual infrastructure, not just the DPA.
- Does the tool use cookies? If yes, you need a consent banner and lose 30-40% of visitors who decline. Cookie-free tools avoid this entirely.
- Is a DPA available? Any data processor needs one. EU-based tools need simpler DPAs without SCCs.
- What data is collected? Minimize scope. Tools that build user profiles or behavioral tracking collect more data than pure A/B testing requires.
- Can you run the tool without a consent banner? This is the practical acid test. If the tool works without consent, it's architecturally GDPR-friendly.
Varify passes all five. See pricing and plans for details.
