# Privacy & Consent

Opt-in consent mode, automatic consent-banner detection, IP anonymisation, and data retention windows.

Run experiments under GDPR and CCPA. Opt-in consent mode keeps the SDK dormant until the visitor agrees, and Otter detects the common consent banners for you.

By default Otter runs unless it is told not to. That suits sites operating on a lawful basis that does not require prior consent, and it stays the default for every existing project. Where you do need consent first, switch the project to **opt-in** and the SDK holds everything back: no variant is applied, no visitor cookie is written, and no SDK, configuration, assignment, or tracking request reaches Otter until the visitor agrees. A returning visitor who denies may send only the erasure request needed to remove their prior server record.

The page is revealed immediately either way. A visitor who ignores your banner sees your site normally — they simply are not in any test. Whether consent is required at all is a decision for you and your legal advice; Otter's job is to make either answer work properly.

## Turn on consent mode

1. **Open Project → Privacy.** Edit the project and switch to the **Privacy** tab. Set **Consent mode** to *Wait for consent before running*.
2. **Choose who needs to consent.** *Every visitor*, or only *visitors in the EEA and UK*. The browser makes a fail-closed timezone check before loading the SDK. For an outside-region exemption, the server confirms the country from the transient IP before creating a visitor, assignment, or tracking data. Anyone it cannot place is asked for consent.
3. **Reinstall your tracking snippet.** This step is not optional. The opt-in snippet carries the mode and an inline pre-consent loader, so the browser does not download the Otter SDK until consent is granted. Copy the updated snippet from the project's install screen.
4. **Verify with your banner.** Load your site in a private window. Before you accept, the network tab should show no SDK, configuration, assignment, or tracking requests to Otter. Accept, and initialisation should follow within a moment. A returning visitor who denies may send only the erasure request needed to remove their prior server record.

## Consent banners Otter detects

- **IAB TCF v2.2** — detected and treated as authoritative, but currently remains unresolved and dormant because Otter does not yet have an IAB Global Vendor List ID. Until registration is complete, bridge your TCF banner with `optimo.grantConsent(true)` after its Otter/vendor choice is granted.
- **Google Consent Mode v2** — read from `analytics_storage`, including updates pushed after page load.
- **Cookiebot, OneTrust, Usercentrics, CookieYes, Complianz, Iubenda** — detected directly, using each vendor's own analytics or statistics category.
- **Anything else** — call `optimo.grantConsent(true)` when your banner is accepted. An explicit call always wins over a detected banner.

Otter never resolves consent optimistically. If a banner is present but has not been answered, the SDK stays dormant rather than guessing — which means a misconfigured banner shows up as no data, not as data you were not allowed to collect.

## Withdrawing consent

```javascript
// Wire this to your banner's reject or withdraw control.
optimo.grantConsent(false)

// Otter immediately:
//   - stops applying variants and tracking goals
//   - deletes the optimo_uuid cookie
//   - clears cached variants and any queued events
//   - asks the server to delete that visitor's record
```

## IP addresses and data retention

- **Otter never stores a visitor IP.** It is read in-request only, to resolve a country and region for geo targeting, and is never written to the database.
- **IP anonymisation** masks it even for that transient use — IPv4 to the /24, IPv6 to the /48 — which still identifies the country targeting needs.
- **Retention windows** anonymise visitors that have not been seen for the number of days you set and delete their identifying fields, sessions, and events. Anonymous assignment and conversion facts remain so experiment totals do not change. The purge runs nightly and cuts at the start of the day, so 30 days means whole days.
- **Experiment totals are unaffected.** Running and concluded assignment, conversion, and revenue totals keep their historical statistical facts after visitor identity is removed.

## FAQ

### What does opt-in consent mode actually do?

It keeps the SDK completely dormant until the visitor agrees. No variant is applied, no visitor cookie is written, and no SDK, configuration, assignment, or tracking request is made to Otter. The page is revealed immediately so a visitor who never answers the banner is not left staring at a hidden page. A returning visitor who denies may send only the erasure request needed to remove their prior server record. The moment consent arrives, Otter initialises and the visitor enters tests normally.

### Which consent banners does Otter detect automatically?

Google Consent Mode v2, Cookiebot, OneTrust, Usercentrics, CookieYes, Complianz, and Iubenda. IAB TCF v2.2 is detected but remains unresolved and dormant until Otter has a registered Global Vendor List ID; use `optimo.grantConsent(true)` as the temporary bridge after your banner grants Otter/vendor consent. The same manual call supports any other banner.

### Why do I have to reinstall the snippet after switching to opt-in?

Because consent mode has to be known before the first request, and that request is the thing being held back. The opt-in snippet includes a small inline loader that reads your consent signal before it appends the remote SDK. A stale snippet can only learn the setting after making a request, so reinstall it.

### Can I require consent only from EU and UK visitors?

Yes. Set "Who needs to consent" to visitors in the EEA and UK. The browser makes a fail-closed timezone check before loading the SDK. If it believes the visitor is outside the region, the server confirms that exemption from the transient IP before creating a visitor, session, assignment, or tracking data. A mismatch or unknown country is rejected and waits for consent. A returning visitor who denies may send only the erasure request needed to remove their prior record.

### What happens if a visitor withdraws consent mid-session?

Otter stops immediately, removes the visitor cookie, clears every cached variant and pending event from the browser, tears down goal tracking, and asks the server to erase identifying visitor, session, event, assignment, and conversion detail. Anonymous assignment and conversion facts remain so experiment totals are not rewritten.

### Does Otter store visitor IP addresses?

No. An IP is read in-request only, to resolve a country and region for geo targeting, and is never written to the database. Turning on IP anonymisation masks it even for that transient use — IPv4 to the /24 and IPv6 to the /48 — which still identifies the country that targeting needs.

### How do data retention windows work?

Set a number of days and Otter anonymises visitors that have not been seen for that long, removing identifying fields, sessions, and events. Anonymous assignment and conversion facts remain so running and concluded experiment totals do not change. It runs nightly and cuts at the start of the day, so "30 days" means whole days. Leave it blank to keep visitor data indefinitely.

### How does a visitor exercise their right to erasure?

Their visitor id is in the `optimo_uuid` cookie. POST it to `/sdk/clear-visitor` with your project key and Otter irreversibly anonymises their visitor record and removes identifying session, event, assignment, and conversion detail. Calling `optimo.grantConsent(false)` in the browser does the same thing, which is the simplest route if you can add it to your own privacy controls.

### Is opt-out mode still available?

Yes, and it stays the default for existing projects so nothing changes for anyone until they choose it. In opt-out mode the SDK runs unless it has been told not to, which is appropriate where you have a lawful basis that does not require prior consent. Choosing between them is a decision for you and your legal advice, not something Otter should make for you.

## Frequently asked questions

### What does opt-in consent mode actually do?

It keeps the SDK completely dormant until the visitor agrees. No variant is applied, no visitor cookie is written, and no SDK, configuration, assignment, or tracking request is made to Otter. The page is revealed immediately so a visitor who never answers the banner is not left staring at a hidden page. A returning visitor who denies may send only the erasure request needed to remove their prior server record. The moment consent arrives, Otter initialises and the visitor enters tests normally.

### Which consent banners does Otter detect automatically?

Google Consent Mode v2, Cookiebot, OneTrust, Usercentrics, CookieYes, Complianz, and Iubenda. IAB TCF v2.2 is detected but remains unresolved and dormant until Otter has a registered Global Vendor List ID; use optimo.grantConsent(true) as the temporary bridge after your banner grants Otter/vendor consent. The same manual call supports any other banner.

### Why do I have to reinstall the snippet after switching to opt-in?

Because consent mode has to be known before the first request, and that request is the thing being held back. The opt-in snippet includes a small inline loader that reads your consent signal before it appends the remote SDK. A stale snippet can only learn the setting after making a request, so reinstall it.

### Can I require consent only from EU and UK visitors?

Yes. Set "Who needs to consent" to visitors in the EEA and UK. The browser makes a fail-closed timezone check before loading the SDK. If it believes the visitor is outside the region, the server confirms that exemption from the transient IP before creating a visitor, session, assignment, or tracking data. A mismatch or unknown country is rejected and waits for consent. A returning visitor who denies may send only the erasure request needed to remove their prior record.

### What happens if a visitor withdraws consent mid-session?

Otter stops immediately, removes the visitor cookie, clears every cached variant and pending event from the browser, tears down goal tracking, and asks the server to erase identifying visitor, session, event, assignment, and conversion detail. Anonymous assignment and conversion facts remain so experiment totals are not rewritten.

### Does Otter store visitor IP addresses?

No. An IP is read in-request only, to resolve a country and region for geo targeting, and is never written to the database. Turning on IP anonymisation masks it even for that transient use — IPv4 to the /24 and IPv6 to the /48 — which still identifies the country that targeting needs.

### How do data retention windows work?

Set a number of days and Otter anonymises visitors that have not been seen for that long, removing identifying fields, sessions, events, assignment context, and conversion metadata. Anonymous assignment and conversion facts remain so running and concluded experiment totals do not change. It runs nightly and cuts at the start of the day, so "30 days" means whole days. Leave it blank to keep visitor data indefinitely.

### How does a visitor exercise their right to erasure?

Their visitor id is in the optimo_uuid cookie. POST it to /sdk/clear-visitor with your project key and Otter irreversibly anonymises their visitor record and removes identifying session, event, assignment, and conversion detail. Calling optimo.grantConsent(false) in the browser does the same thing, which is the simplest route if you can add it to your own privacy controls.

### Is opt-out mode still available?

Yes, and it stays the default for existing projects so nothing changes for anyone until they choose it. In opt-out mode the SDK runs unless it has been told not to, which is appropriate where you have a lawful basis that does not require prior consent. Choosing between them is a decision for you and your legal advice, not something Otter should make for you.

---

Canonical page: https://www.otterab.com/docs/getting-started/privacy-and-consent