Hi Sumo-lings,
Otter now runs properly under GDPR and CCPA. This was the most-asked-for thing in the Q&A, and it shipped this week.
Opt-in consent mode
Switch a project to opt-in and the SDK stays completely dormant until your visitor agrees. Not "loads but holds off on tracking" — nothing happens at all. No SDK download, no configuration request, no cookie, no variant applied. The install snippet carries a small inline loader that checks your consent signal before it ever fetches Otter.
Your page still reveals immediately. Someone who ignores the banner sees your site normally, they're just not in a test.
It reads your banner for you
Otter detects Google Consent Mode v2, Cookiebot, OneTrust, Usercentrics, CookieYes, Complianz and Iubenda automatically, using each vendor's own analytics category. For anything else, call optimo.grantConsent(true) when your banner is accepted.
One caveat you should hear from me rather than discover: IAB TCF v2.2 is detected but deliberately stays dormant, because we don't have an IAB Global Vendor List ID yet. Registration is underway. Until it lands, bridge TCF with the manual call.
Otter never resolves consent optimistically. If a banner is present but unanswered, the SDK stays asleep — so a misconfigured banner shows up as no data, rather than as data you weren't allowed to collect.
Only where you need it
Require consent from every visitor, or only from visitors in the EEA and UK. The region check fails closed: anyone we can't confidently place gets asked.
IPs and retention
Otter has never written a visitor IP to the database — it's read in-request only, to resolve a country for geo targeting. You can now mask it even for that transient use (IPv4 to /24, IPv6 to /48), and set a retention window per project. When a visitor ages out, their identifying fields, sessions and events are deleted.
Your experiment totals don't move. Assignment, conversion and revenue history survive an erasure as anonymous facts. A right-to-be-forgotten request should never quietly rewrite a test you already made a decision on.
Nothing changes unless you want it to
Opt-out stays the default on every existing project. If you do switch one to opt-in, reinstall your snippet — the new one carries the consent mode, and that has to be known before the first request, because that request is the thing being held back.
Setup guide: https://www.otterab.com/docs/getting-started/privacy-and-consent
Also shipped recently
Branded print-ready reports with a proper title page, faster results via grouped Bayesian bootstrapping and caching, a table view for the experiments list, and a fix for visual editor saves on sites that send COOP headers.