March 5, 2026
Why experimentation is becoming an operating model for smart organizations
A conversation with Valentin Radu, founder of Omniconvert, on experimentation as an operating model, AI and sustainable digital growth. Read more
Lately, we have been bombarded with articles full of tips about the new legislation surrounding data processing and collection: the General Data Protection Regulation (AVG). In English, the AVG is called General Data Protection Regulation or the GDPR.
The most important question: what will change for me? Unfortunately, this answer is far from simple and the practical consequences are not as clear as often desired. For this reason, Online Dialogue organized the 26th Dialogue Thursday last Thursday, February 15, with the theme: “GDPR, but nice.”.
Three speakers shared their knowledge from various fields in order to create more clarity together on the implications of the GDPR for online optimization. The afternoon was introduced by lawyer Esther Schnepper with her knowledge about the legal side of the GDPR. Esther was followed up by Convert's CEO, Dennis van der Heijden, who shared how his organization is doing everything possible to make their A/B testing tool GDPR-proof. To dive even deeper into practice, Michel Vennema was last asked to take the stage for his experience with Google Analytics and Google Tag Manager in line with the GDPR.
Read summaries of all the presentations here and watch the after movie below.
To get the facts straight for everyone before we started thinking about the practical application of the new legislation at all, Esther went over the main changes brought about by the GDPR and what the law change stands for. In a nutshell:
GDPR's three main goals:
Three different roles:
What will change in terms of content?
What changes around data subjects' rights?
What is changing organizationally?
Because the new legislation may seem scary, Esther's final tip was, ‘Be prepared, not scared! Translating legislation into practice is always complicated. But don't let this put you off. In any case, make sure you can demonstrate that you take privacy seriously.
Ever since the announcement of the new legislation, they at the A/B testing tool Convert have been hard at work getting the tool ready for May 25, 2018. So on their site, you'll find a 20-page GDPR roadmap showing exactly what they've already done and what they still need to do to make the tool GDPR-proof.
Convert is A/B testing without ‘personal data’
Not knowing that his tool for 90% had already finished preparing, Dennis lay for nights mulling over how an A/B testing tool could ever be GDPR compliant. After all, what can a tool like Convert do to prepare for May 25? How do you best protect the privacy of data subjects? By throwing out all possible personal data that a tool might store or combine?
Privacy by design!
Convert is one of the cheaper A/B testing tools because they hardly store any data. This was mainly seen as a disadvantage of the tool because it is not possible for users to segment and search back through the data endlessly after an A/B test is completed. But it does cost less money. Now it turns out that this type of cost savings actually ensures that the tool is largely already GDPR compliant! After all, without personal data, people can't request or change it either.
But what is personal data?
“A lot,” says Dennis van der Heijden. A combination of a number of data points very quickly becomes personal data, without you even realizing it. With as little as three or four data points, you can zoom in on a person. And in an A/B testing tool, this can quickly cause problems. You want to make deeper and deeper analyses so you start segmenting further and further. Groups get smaller and before you know it, you can trace the data back to a person. To protect users of the tool from this, they have built in a warning that alerts users when groups are getting too small.
Worry when they say “don't worry we will be GDPR compliant”
Like Esther, Dennis' tip is that, as a company, the most important thing you should do is show that you take the new legislation seriously and that you are working hard to understand and implement the new regulations. Show that you care about your visitor's privacy. And if you think the GDPR is scary, wait for the cookie law's replacement: the ePrivacy Regulations. Unfortunately, this one is still a while away so the old cookie regulations will be in place at the same time as the new GDPR.
In his work for many different organizations, Michel has been practicing the new privacy legislation for some time. From this experience, he shared 9 practical tips and tricks for Google Analytics and Google Tag Manager during Dialogue Thursday.
Tip 1: Think like a citizen
Do you just give your friend's contact information to a stranger? Would you like to have the choice to be remarketed? Would you rather be aware of what someone is doing with your data before you agree? And would you like to have the option to opt out of your filter bubble?
Tip #2: Be cautious about giving them access to your data.
You probably agree that you shouldn't give just anyone access to your data. But often we forget afterwards to whom we granted this access (old colleagues?). To avoid this in the future, you can create an ‘Organization’ in Google Analytics. Set clear rules for access and periodically check the list of users.
Tip 3: Remove parameters from Google Analytics
Or even better, remove personal information from URLs at all and keep checking that everything on the site is going well (for example, via a simple IFTTT trigger).
Tip 4: Take full advantage of Google Tag Manager
Don't block Google Tag Manager. Instead, use smart triggers so that only the right tags are fired.
Tip 5: Find out if someone is using an Ad Blocker and/or the Do Not Track feature.
And yes, you still have to ask explicit consent, even if the read the DNT option off.
Tip 6: Turn on remarketing options and demographics once you have permission.
In fact, you can configure Google Analytics flexibly to deal with these choices
Tip 7: Hash the personally identifiable information
Hashing is a form of pseudonymization. You can convert a mail address to a string of characters that makes the mail address untraceable, but can still be used as a unique identifier. How necessary is it to have PII information in GA? If you want to do it just right, hash transaction IDs and customer numbers as well.
Tip 8: Be like Google & Facebook
It's still your site so you decide what you do, but remember to share in advance what you are collecting the data for and always make sure you have provable consent.
Tip 9: Check by legal!
The day ended with a panel discussion where all unanswered questions from the audience were answered. The panel consisted of all three speakers and Simon Vreeman, who, with his practical knowledge as Senior CRO Analyst at fietsenwinkel.nl, was a great addition to the whole.
Nederlands
English