Skip to main content


Optimizely Knowledge Base

Enable opt-in options for Optimizely cookies and local storage

  • Handle opt-in options for cookies and local storage
  • Comply with electronic privacy laws in your region

Optimizely is used by customers around the world to analyze and personalize their web traffic. In some regions, websites may be required to offer visitors the option to opt into certain types of browser storage, such as cookies and local storage.

For example, upcoming Europe ePrivacy Regulation and the national laws of certain European countries require you to allow visitors to actively opt into cookies and local storage objects. Note that some countries allow for exceptions when cookies are used for website analytics.

We recommend that you review the data protection laws applicable to your site and business. Below, we provide ways to handle opt-in options for cookies and local storage set by Optimizely. For information on how Optimizely works with Intelligent Tracking Prevention (ITP), see Intelligent Tracking Prevention and Optimizely.

Use Optimizely X Web without a tag manager

If you don't use a Tag Manager on your site, you can instruct Optimizely not to track a site visitor by setting a cookie called optimizelyOptOut to "true." Optimizely checks for the presence of the optimizelyOptOut cookie before executing the contents of the JavaScript snippet.  It is important to use the officially supported optOut API rather than setting the cookie directly.

Below, we provide an example of how to use the optOut API. Add the code above the Optimizely snippet on your page. Otherwise, the Javascript snippet will run and set the tracking cookie(s) and storage items on your visitor. 

window["optimizely"] = window["optimizely"] || [];
 "type": "optOut",
 "isOptOut": true
<script src=”{project_id].js”></script>

If a visitor opts into cookie tracking, you can re-enable tracking of that visitor by rewriting the optimizelyOptOut cookie value to "false".  For example, if you display a cookie banner (an overlay element asking for visitor tracking consent), you might rewrite the optOut cookie value to false upon obtaining consent with the following code.

More technically, include the API below in the logic executed when the visitor agrees to tracking.  

window["optimizely"] = window["optimizely"] || [];
 "type": "optOut",
 "isOptOut": false

Use Optimizely X Web with a tag manager

If you use a tag manager on your site, you can use conditional logic in the tag manager to load the Optimizely JavaScript snippet only if a visitor has provided consent.

Helpful tips

Since a cookie opt-in option isn't required in all regions or for all cookies, Optimizely doesn't set the optimizelyOptOut cookie by default. If you're the the site owner, you're responsible for determining whether you need to do this, and for using one of the methods above where required.

If you set the optimizelyOptOut to “‘true’” by default as indicated above, the Optimizely snippet will run “normally” (i.e. to be able to track the visitors on your site) only when the optOut API is called with a value of "false".  

With the opt-in solutions above, the Optimizely Javascript snippet will activate on the page reload after a visitor has opted-in, since it is deactivated on the initial pageload.

Optimizely X Full Stack

Full Stack does not rely on cookies in order to conduct experiments, so the cookie-related requirements of the upcoming EU ePrivacy Regulation will not impact this product.

Nevertheless, Fullstack users in the EU should ensure that they are fulfilling their obligations under the General Data Protection Regulation (GDPR), which requires that companies have a proper legal basis for processing personal data gathered from the EU. It is your responsibility as the data controller to ensure that you have a proper legal basis for processing, such as consent, before including their any of this personal data in an Optimizely Full Stack experiment. 

We suggest that you make explicit to your website visitors that your experiments involve first party efforts to improve user experience and that your data is not shared with third parties (e.g. advertising partners), if that’s the case.

As the data controller, you should also exclude users from Full Stack experiments if they withdraw consent.