Changelog/Web Experiment: Cookie consent management
ExperimentAug 25, 2026

Web Experiment: Cookie consent management

The Web Experiment script now supports cookie consent gating. Customers can defer all device storage and third-party requests until a visitor consents — while still running experiments flicker-free while consent is pending.

What it is

Description: The Web Experiment script now supports cookie consent gating. Customers can defer all device storage and third-party requests until a visitor consents — while still running experiments flicker-free while consent is pending.

Why: EU customers (and others with CMP banners) need to run web experiments without writing cookies, localStorage, or sessionStorage — or firing impressions to third-party origins — before consent. Previously the only safe option was blocking the script entirely, which meant no experiments and visible flicker when consent arrived. This gives a compliant default that still delivers the test experience.

What’s new:consentOptions on window.experimentConfig — opt in with consentRequired: truewindow.webExperiment.setConsentStatus() — wire your CMP callback ('granted'/'denied') • Script behavior ◦ While pending: experiments evaluate and variants apply with no flicker; cookie/storage writes, impression events, and the RTBT relay iframe stay in memory only ◦ On grant: buffered identity, storage, and impressions flush to the device; relay loads ◦ On deny: client doesn’t start (or erases prior-session data on revocation); nothing persists from the pending buffer

Available in EUDC: Yes

When: Now!

Docs: amplitude.com/docs/web-experiment/cookies-and-consent-management

Implementation snippet:

<script>
  window.experimentConfig = {
    consentOptions: { consentRequired: true },
  };
</script>
<!-- Web Experiment script tag -->
// CMP callback
window.webExperiment?.setConsentStatus('granted'); // or 'denied'

Notes: • This gates Web Experiment only. Analytics consent is separate — pair with Browser SDK cookies & consent if they use both. • Works with the anti-flicker snippet and cross-subdomain identity/RTBT.