# Testing Your Cookie Banner Without Breaking the Law: What You Can A/B Test Source: https://cookiecitadel.com/blog/2026-11-10-cookie-banner-ab-test-legal-limits.html [Home](../index.md) / [Blog](index.md) / Testing Your Cookie Banner Without Breaking the Law: What You Can A/B Test Published 2026-11-10 A site owner wanted to test two banner designs and asked the only question that matters: which parts are safe to test. The answer is most of them, and the exception is the part that decides whether the choice is real. You can test the words, the layout, and the timing. You cannot test whether the reject button exists, how hard it is to find, or whether the banner makes one choice easier than the other. The line is not between testing and not testing. It is between testing the presentation and testing the choice itself. A/B testing a consent banner is normal optimisation, and the testing guides treat it that way. SecurePrivacy's guide to A/B testing consent banners lists copy, placement, timing, and design as the things worth testing, and it treats the test as a way to learn what visitors understand, not just what they click. Cookie-Script's guide says the same thing: the test should measure informed choices, not raw acceptances. A test that only counts accepts is measuring compliance theater, not consent. ## What you can test Copy is the safest thing to test, and the most valuable. Change the first sentence, change the description of what data is collected, change the label on the customize button. Run each variant for two weeks on real traffic and compare the accept rate and the reject rate together. A variant that raises acceptances while the reject rate stays healthy is better copy. A variant that raises acceptances by collapsing the reject rate is a design that hides the choice. Timing is worth testing too. A banner that appears immediately and a banner that appears after a short delay behave differently, and the delay can help or hurt depending on the site. Placement is testable as well: a bottom banner, a modal, and a corner panel each produce different engagement, and the difference is real. What you are measuring in each case is how many visitors read the banner and made a choice, not just how many clicked accept. ## What you cannot test You cannot test whether the reject button exists. A variant without a reject option is not a test, it is a banner that offers no choice, and it fails the most basic requirement in every jurisdiction that matters. You cannot test button sizes or colors that make accept visibly easier than reject. The two buttons have to be the same size, the same weight, and next to each other. A test that makes one button bigger is testing whether visitors can be steered, and the answer is yes, which is exactly why it is not allowed. You cannot test pre-ticked boxes, or a banner that defaults to accept if the visitor ignores it. Consent has to be a clear affirmative action, and a default is not an action. You cannot test a banner that records consent when the visitor closes it without choosing. Closing a banner is not consent, it is the absence of a choice, and recording it as consent is a fabrication in the record. ## What the record has to show Keep the test record with the consent records. It should show which variants ran, when they ran, what the accept and reject rates were for each, and what changed as a result. If a regulator asks why the accept rate jumped in a given month, the test record is the answer. Without it, the jump looks like a banner that got more persuasive, and the regulator will want to know how. Test one change at a time. A test that changes the copy, the timing, and the placement together tells you nothing about which change mattered, and it leaves you unable to defend any of them. The discipline of single-variable testing is not just good statistics. It is the evidence that the banner was optimised for understanding, not for steering. Keep reading: [when consent or pay is a real choice](https://cookiecitadel.com/blog/2026-09-30-consent-or-pay-publisher-rules.md), [why reject-all parity matters when you test a banner](https://cookiecitadel.com/blog/2026-11-02-reject-all-button-parity.md), and [what the TCF v2.3 cutover changed for consent](https://cookiecitadel.com/blog/2026-11-08-tcf-v23-cutover-cmp.md) cover the nearby cases in this series. ## Frequently asked questions ### Can I A/B test my cookie banner at all? Yes. Copy, placement, timing, and design are all safe to test, and the testing guides treat banner testing as normal optimisation. What you are measuring is how many visitors read the banner and made an informed choice, not just how many clicked accept. ### What banner tests are not allowed? Anything that changes whether the choice is real. You cannot test a variant without a reject button, buttons of different sizes or weights that steer toward accept, pre-ticked boxes, or a banner that records consent when the visitor closes it without choosing. Closing a banner is not consent. ### How long should a banner test run? Two weeks on real traffic is a reasonable minimum for one change. Compare the accept rate and the reject rate together. A variant that raises acceptances while the reject rate collapses to near zero is hiding the choice, not explaining it. ### What should the test record contain? Which variants ran, when they ran, the accept and reject rates for each, and what changed as a result. Keep it with the consent records. If a regulator asks why the accept rate jumped in a given month, the test record is the answer.