---
title: "Name the lawful basis for every experiment · Agent Wranglers"
url: https://agentwranglers.se/playbook/analytics/experiments/experiment-lawful-basis
id: ANA-17
level: Required
applies: eu-users
region: EU
risk: law
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1146
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Name the lawful basis for every experiment

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Experiments](https://agentwranglers.se/playbook/analytics/experiments.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: ANA-17
- Level: Required
- Chapter: [Experiments](https://agentwranglers.se/playbook/analytics/experiments.md)
- Rule: Record the GDPR lawful basis for each experiment before it starts, and ask for consent before storing an experiment ID on the device. Screen tests that change prices, credit, health or content for children for a data protection impact assessment.
- Check: Every experiment in the registry has a lawful basis and, for legitimate interest, a link to its balancing test. A browser test with a fresh profile and no consent finds no experiment ID in cookies or storage.
- Risk: A law broken
- Applies when: The project has users in the EU.
- Region: European Union (EU). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds.
- How: Assignment and exposure logs tie a variant to a person, so an experiment processes personal data. Most product tests rely on legitimate interest, which needs a written balancing test, as [Weigh every legitimate interest in writing](https://agentwranglers.se/playbook/compliance/records-and-data-map/legitimate-interests-assessment.md) describes. Storing or reading an assignment ID in a cookie or local storage also falls under ePrivacy Article 5(3). Without a yes, assign signed-in users on the server by account ID, and show signed-out visitors the control. Tests with larger effects on people go through [Screen every new feature for a DPIA](https://agentwranglers.se/playbook/compliance/records-and-data-map/dpia-screening.md). List the experiment store in the [data map](https://agentwranglers.se/playbook/compliance/records-and-data-map/data-map.md).

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
export function variantForVisitor(experiment, { accountId, consent }) {
  if (accountId) return variantFor(experiment.name, accountId);
  if (!consent.analytics) return 'control';
  return variantFor(experiment.name, consent.analyticsId);
}
```

### Python example

```python
def variant_for_visitor(experiment, account_id: str | None, consent) -> str:
    if account_id:
        return variant_for(experiment.name, account_id)
    if not consent.analytics:
        return "control"
    return variant_for(experiment.name, consent.analytics_id)
```

## Sources

- [GDPR Article 6 on lawfulness of processing](https://eur-lex.europa.eu/eli/reg/2016/679/oj)
- [EDPB Guidelines 2/2023 on Article 5(3) ePrivacy](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-22023-technical-scope-art-53-eprivacy-directive_en)

## Related rules

- ANA-11 [Write the experiment plan before it starts](https://agentwranglers.se/playbook/analytics/experiments/experiment-plan.md) in Product analytics and experiments
- CMP-12 [Weigh every legitimate interest in writing](https://agentwranglers.se/playbook/compliance/records-and-data-map/legitimate-interests-assessment.md) in Compliance and governance
- CMP-10 [Screen every new feature for a DPIA](https://agentwranglers.se/playbook/compliance/records-and-data-map/dpia-screening.md) in Compliance and governance
- CMP-7 [Map every store that holds personal data](https://agentwranglers.se/playbook/compliance/records-and-data-map/data-map.md) in Compliance and governance

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/analytics/experiments/experiment-lawful-basis">Agent Wranglers product analytics and experiments playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Keep a holdout group to measure the sum of changes](https://agentwranglers.se/playbook/analytics/experiments/holdout-groups.md)
- Next: [Testing prices or targeting vulnerable people in experiments](https://agentwranglers.se/playbook/analytics/experiments/no-price-or-vulnerable-tests.md)
- [Experiments](https://agentwranglers.se/playbook/analytics/experiments.md)