Configuration Guide

Optimizely Web Experimentation is an A/B testing, multivariate testing, and personalisation platform that deploys a JavaScript snippet on the customer's website to assign visitors to experiment variations, track behavioural events, and deliver personalised content experiences. Depending on configuration, Optimizely can operate as a purely anonymous split-testing tool or as a full individual-level personalisation platform drawing on CRM and CDP data via its Dynamic Customer Profiles (DCP) feature. Optimizely is owned by Episerver Group AB, headquartered in Stockholm, Sweden, but operates significant infrastructure and personnel in the United States. Under Optimizely's Data Processing Agreement (DPA), the customer acts as Controller and Optimizely acts as Processor. The configurations below cover the most privacy-relevant settings and their corresponding mappings in the Consenter Manager.

---

Step 1 — Optimizely Configuration

---

Configuration A — Low Risk

Use this configuration when Optimizely is used solely for anonymous A/B or multivariate testing, without behavioural audience segmentation, personalisation, or any linkage to known customer identities. The Optimizely snippet is blocked from loading until the user grants explicit consent, implemented either via the optOut API (called with isOptOut: true before the snippet loads) or by conditionally loading the snippet through a tag manager. No cookies or data are written to the visitor's browser before consent. Upon consent, Optimizely assigns the visitor a random pseudonymous identifier (optimizelyEndUserId), a combination of a timestamp and a random number that contains no personal information in itself, and allocates them to an experiment variation. Audience targeting is limited to non-personal URL or device-type conditions. The visitor cookie is set to a 30-day expiry. No CRM data, external identifiers, or personalisation campaigns are in use. Experiment result data is retained on Optimizely's servers for 18 months (platform policy). Where EU data hosting is selected, data is stored on EU infrastructure; however, as Optimizely operates significant US-based infrastructure and personnel, data may remain potentially subject to access by US government authorities under the CLOUD Act. This should be disclosed as a potential US data transfer in the consent banner. Optimizely acts as Processor under its DPA; a DPA is available at optimizely.com/trust-center.

Configuration B — Medium Risk

Use this configuration when Optimizely is used for A/B or multivariate testing with behavioural audience segmentation. The snippet is blocked until explicit consent. Upon consent, the visitor receives a pseudonymous optimizelyEndUserId cookie and is targeted to experiments or variation groups based on in-session behavioural attributes — such as pages previously visited in the current or prior sessions, referral source, geolocation (derived from IP address), device type, or query parameters. These attributes allow visitors to be grouped and served different experiences based on their observed browsing behaviour across the website, building a behavioural profile scoped to the visitor ID. No CRM data or external customer identifiers are linked to the visitor record. The visitor cookie is set to the platform default of 6 months. EU data hosting is available; CLOUD Act risk applies as above. Optimizely acts as Processor under its DPA.

Configuration C — Higher Risk

Use this configuration when Optimizely is used for individual-level personalisation powered by Dynamic Customer Profiles (DCP), which combines Optimizely's behavioural visitor data with first-party customer attributes imported from a CRM, data warehouse, or customer data platform. The snippet is blocked until explicit consent. Upon consent, the visitor's Optimizely pseudonymous ID is aliased to a known customer identifier — such as an authenticated user ID, loyalty account number, or hashed email — enabling Optimizely to retrieve that visitor's DCP record, which may include purchase history, loyalty tier, product preferences, lifetime value scores, or other CRM attributes. Personalisation campaigns are active, delivering individually tailored content, product recommendations, or messaging based on this profile. The visitor cookie is set to 6 months and may be extended. DCP data is stored on Optimizely's servers and linked to the visitor ID for the duration of the experiment or personalisation campaign. Experiment result and event data are retained for 18 months. EU data hosting is available; however, CLOUD Act risk applies in all cases and must be disclosed. Optimizely acts as Processor under its DPA.

---

Step 2 — Mapping in the Consenter Manager

Using the Optimizely configurations defined in Step 1, apply the following mappings in the Consenter Manager to ensure the consent banner correctly reflects the data processing activities.

2.1 Configuration A — Low Risk

2.2 Configuration B — Medium Risk

Note on geolocation: In Configuration B, audience targeting conditions may include geolocation derived from the visitor's IP address (e.g. targeting by country or region). Although the IP address itself is not persistently stored as a data point by Optimizely, the use of IP-derived location as a targeting attribute warrants the inclusion of Non-precise location data in the data categories.

2.3 Configuration C — Higher Risk

Note on DCP and authentication-derived identifiers: In Configuration C, the visitor's pseudonymous Optimizely ID is aliased to a known customer identifier — typically an authenticated user ID or similar derived value — enabling Optimizely to retrieve and apply individual customer profile attributes for personalisation. This aliasing constitutes the use of an authentication-derived identifier and must be reflected in both the identifier and data category selections above. The User-provided data category is included because DCP profiles are populated with data the customer has actively provided to the operator (e.g. via account registration, purchase history, or loyalty programme enrolment) and which is subsequently imported into Optimizely for targeting purposes. Optimizely acts as Processor throughout; the advertiser as Controller is responsible for ensuring that the DCP data imported into Optimizely has been lawfully collected and that appropriate consent or other legal basis exists for its use in personalisation.