title: How Cookies law/gdpr effect Rectaptcha and A/B test?
body: <p>I have been looking around the last few days for cookies and gdpr law, and I have been busy getting OneTrust and GoogleTagManager up and running on our current website and it works just fine!</p>
  <p>On our Cookie consent banner, we have a &quot;Reject all Cookies&quot; button and then we do not load our tracking and other 3rd party scripts.
  We have also added a list of all cookies etc. we use on the site that we receive automatically from onetrust. Necessary cookies for the site to work are loaded even if the user clicks Reject all cookies.</p>
  <p>So some problems I have today:</p>
  <p>Rectaptcha:</p>
  <p><a href="https://measuredcollective.com/gdpr-recaptcha-how-to-stay-compliant-with-gdpr/" rel="nofollow noreferrer">https://measuredcollective.com/gdpr-recaptcha-how-to-stay-compliant-with-gdpr/</a>
  <a href="https://www.imy.se/en/verksamhet/data-protection/this-applies-accordning-to-gdpr/transfer-of-data-to-a-third-country/" rel="nofollow noreferrer">https://www.imy.se/en/verksamhet/data-protection/this-applies-accordning-to-gdpr/transfer-of-data-to-a-third-country/</a></p>
  <p>According to these links, we send sensitive information such as IP address to another country. as well as puts cookies on google's own domain google.com</p>
  <p>If we decide that the user must ask for consent before using Google ReCaptcha cookies and then a spam/bot allows the possibility to deny these cookies. Then you have to ask if there is any point in using Google ReCaptcha in the first place?</p>
  <ol>
  <li>I interpret this as meaning that we cannot use Google Recaptcha and have to change to another Recaptcha solution like hcaptcha.com?</li>
  </ol>
  <p><strong>A / B test.</strong></p>
  <p><a href="https://help.optimizely.com/Account_Settings/Enable_opt-in_options_for_Optimizely_cookies_and_local_storage" rel="nofollow noreferrer">https://help.optimizely.com/Account_Settings/Enable_opt-in_options_for_Optimizely_cookies_and_local_storage</a></p>
  <p>In recent months, we have prepared some things to be A/B tested on the website. We already do not have that many users on the site and have to run our a/b tests for a slightly longer period for better results. Of course, an a/b test uses cookies and these cookies are counted as analytics cookies.</p>
  <p>But now that we have &quot;Reject all cookies&quot; or &quot;deny analytics cookies&quot;, we lose quite a lot of visitors and it becomes almost impossible to a / b test.</p>
  <ol start="2">
  <li>Is a/b test dead for smaller websites in EU?</li>
  </ol>
  <p><strong>Local storage</strong></p>
  <p>We save personal data when the user orders a service from us, in LocalStorage.</p>
  <ol start="3">
  <li><p>Does the website have to tell users, what and why we save it in LocalStorage?</p>
  </li>
  <li><p>When a user has clicked &quot;X&quot; on a popup, we save it in LocalStorage so that the user does not have to see the popup every time they come into the page. This is not necessary but improves the user experience. So are it considered necessary cookies or do we have to have the user consent to it?</p>
  </li>
  </ol>