Privacy and Consent

Privacy is built into both the HTML and Shopify scripts, but the surface differs. This guide covers what’s collected, what’s automatically respected, and how to integrate with a cookie-consent banner if your region requires one.

What Gets Collected

Split Test Pro records, per visitor:

• A visitor identifier (random UUID, generated on first visit, stored in cookie + localStorage). Used as the seed for deterministic variant assignment. No PII.
• An experiment-variant assignment (which experiment(s) the visitor is in, which variant of each). Stored in cookie.
• Conversion events (each time a tracked goal fires). HTML: via SplitTestPro.trackConversion. Shopify: via the Web Pixel.
• Engagement events on Shopify (scroll depth, click counts, funnel-stage events). Captured by the Web Pixel.

Split Test Pro does not collect:

• Personally identifiable information (name, email, address).
• Customer IDs from your platform.
• Payment information.
• Session recordings or screenshots of visitor screens.
• Cross-site tracking data (we don’t follow visitors across other sites).

HTML Platform: Built-In Privacy Behavior

The HTML script (extensions/html-experiment/experiment.js) respects three privacy signals out of the box:

1. Do Not Track (DNT)

If the visitor’s browser sends navigator.doNotTrack === "1", the script skips analytics events.

2. Global Privacy Control (GPC)

If the visitor’s browser sends navigator.globalPrivacyControl === true (a newer signal, e.g., via the GPC browser extension or some browser settings), the script skips analytics events.

3. Explicit consent state

A localStorage key (stp_consent) stores the visitor’s explicit consent:

• "in" — user has explicitly opted in. Overrides DNT and GPC; analytics will fire.
• "out" — user has explicitly opted out. Always blocks analytics.
• Missing — defaults to “respect DNT/GPC.”

Important nuance: When tracking is blocked (DNT, GPC, or explicit opt-out), the script still:

• Sets the visitor identifier cookie.
• Assigns the visitor to a variant.
• Applies the variant CSS/JS.

What’s blocked is the analytics POST (no events sent to the Split Test Pro backend) and the GA4 event (no impression sent to GA4).

If your privacy policy requires no cookies at all without consent, you’ll need to gate the script load itself — see “Gated load pattern” below.

The Public API

The script exposes consent controls on window.SplitTestPro:

// User opts in (overrides DNT/GPC):
window.SplitTestPro.optIn();

// User opts out (always blocks):
window.SplitTestPro.optOut();

// Check current state programmatically:
window.SplitTestPro.isTrackingAllowed();
// → returns true / false based on consent + DNT/GPC + opt-in/opt-out

These calls are non-destructive: switching from opt-in to opt-out (or vice versa) takes effect immediately for the next analytics event.

Disabling DNT/GPC Respect

By default, the script respects DNT and GPC. If your jurisdiction allows you to ignore these signals (or you’re collecting only with explicit consent and want full data from those who opted in), add data-respect-dnt="false" to the script tag:

<script
  src="https://app.splittestpro.com/experiment.js"
  data-api-key="YOUR_API_KEY"
  data-respect-dnt="false"
  async
></script>

This disables the DNT and GPC checks. The stp_consent localStorage key still controls explicit opt-in / opt-out.

Shopify Platform: Customer Privacy API

On Shopify, consent is governed at the platform level by Shopify’s Customer Privacy API. The Split Test Pro Web Pixel is configured to require analytics: true consent and explicitly does not request marketing, preferences, or sale_of_data scopes.

This means:

• For stores without a regional consent banner (most US stores): analytics consent is implicit; the pixel runs for every visitor.
• For stores with Shopify’s customer-privacy banner (most EU stores, plus stores serving California etc.): the pixel only fires for visitors who’ve granted analytics consent.

Visitors who decline are not assigned to or counted in any experiment. This is enforced by Shopify, not by Split Test Pro — there’s nothing to wire up on your end.

The variant CSS/JS injection (handled by the Theme App Extension, separate from the Web Pixel) is not gated on customer-privacy consent — variants apply for everyone, only event tracking is gated. If you want stricter behavior on Shopify, you’d need to gate the Theme App Extension in your theme code, which isn’t an out-of-the-box flow.

Patterns for Cookie-Consent Banners

If you’re using a cookie-consent banner (OneTrust, Cookiebot, Klaviyo, custom), there are two integration patterns.

Pattern A: Default-respect, opt-out-via-API

Load the script as normal. When the user declines consent in your banner, call:

window.SplitTestPro.optOut();

When they accept:

window.SplitTestPro.optIn();

This is the simplest pattern. The script loads, may set the cookie, and respects DNT/GPC by default. Explicit opt-out via the banner takes precedence.

Caveat: the cookie is set even before the user has interacted with the banner. If your jurisdiction requires no cookies before consent, use Pattern B.

Pattern B: Gated load

Don’t load the script until the user has accepted consent. In your tag manager or banner callback:

// On consent acceptance:
const script = document.createElement("script");
script.src = "https://app.splittestpro.com/experiment.js";
script.dataset.apiKey = "YOUR_API_KEY";
script.async = true;
document.head.appendChild(script);

This guarantees no Split Test Pro cookies are set unless the user has opted in. The trade-off: you lose data from any session where the user accepts consent partway through (they’ll arrive at the next page already bucketed, but the current page won’t have variant data).

Pattern C: Hybrid

Load the script, but call optOut() immediately on init unless consent is already accepted:

<script>
  if (!localStorage.getItem("user_consent")) {
    window.addEventListener("DOMContentLoaded", () => {
      window.SplitTestPro?.optOut();
    });
  }
</script>

This gives you the script loaded and ready, but no events fire until the user accepts. Less strict than Pattern B but more responsive than Pattern A.

What’s Stored Where

A reference for the cookies and localStorage keys Split Test Pro uses:

Key	Storage	Purpose	Lifetime
splittestpro-experiment	Cookie	Variant assignments per experiment	365 days
splittestpro-visitor	Cookie + localStorage	Anonymous visitor identifier	365 days
splittestpro-preview	Cookie	Preview-mode override (set during pre-launch QA only)	Session
stp_consent	localStorage	Explicit opt-in / opt-out state	Persistent
stp_session_id	localStorage	Session identifier (HTML platform)	Persistent

All values are short, non-PII identifiers. None of them link to external profiles.

GDPR / CCPA Considerations

Split Test Pro is designed to work within most major privacy frameworks, but compliance is your responsibility — the docs don’t constitute legal advice.

A typical GDPR-compliant setup:

• EU visitors see your consent banner.
• Banner sets stp_consent: "out" for declines, stp_consent: "in" for acceptances.
• DNT and GPC are respected by default for visitors who don’t interact with the banner.
• Cookies set by the script are categorized as Statistics / Analytics in your cookie policy.
• Your privacy policy mentions Split Test Pro as a sub-processor.

For CCPA / California-specific compliance:

• GPC is the primary signal — already respected by default.
• A “Do Not Sell My Personal Information” link can call SplitTestPro.optOut().

For HIPAA, COPPA, or other specialized frameworks: consult legal advice. Split Test Pro doesn’t have specific tooling for these.

Disconnecting Visitors From Future Tracking

To wipe a visitor’s tracking state on demand (e.g., a “Reset preferences” button):

document.cookie = "splittestpro-experiment=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/;";
document.cookie = "splittestpro-visitor=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/;";
localStorage.removeItem("splittestpro-visitor");
localStorage.removeItem("stp_session_id");
localStorage.setItem("stp_consent", "out");

The next pageview will not fire any analytics events and will not assign the visitor to a variant.

Common Mistakes

• Disabling DNT respect without realizing it. The default behavior is privacy-respectful. Only disable if you have a clear reason and legal cover.
• Treating the cookie as PII. It’s a random UUID with no link to identity. Treat it as analytics-only.
• Forgetting to wire the consent banner to optOut(). Without this, declining consent in the banner has no effect on Split Test Pro tracking.
• Loading the script with async in a way that misses early optOut() calls. If you’re using Pattern C, make sure your optOut() call runs after the script has had a chance to expose window.SplitTestPro. Wrap in DOMContentLoaded or check for the global before calling.

Next Steps

• Confirm Shopify-side consent integration: Shopify Web Pixel.
• See how to install the script for HTML: Installing on an HTML Site.
• Read the FAQ for more privacy-related questions: Frequently Asked Questions.