Matomo

Overview

Matomo (formerly Piwik) is an open-source web analytics platform that organizations self-host as a privacy-respecting alternative to Google Analytics. It tracks page views, events, goals, conversions, and funnels while keeping all data under the site owner's direct control.

What This Script Does

The Matomo tracking script (matomo.js or piwik.js) operates differently depending on configuration:

Standard mode (with cookies):

• Sets first-party cookies to identify returning visitors, track session duration, and attribute conversions across visits. The default cookie prefix is _pk_ with configurable expiration (typically 13 months for the visitor cookie, 30 minutes for the session cookie).
• Records page views (URL, page title, referrer), site search queries, outbound link clicks, and file downloads.
• Sends tracking requests to the site owner's Matomo server (self-hosted) or Matomo Cloud instance on each page event.
• Supports custom event tracking, goal conversions, and e-commerce transaction logging.

Cookieless mode:

• When configured with disableCookies(), Matomo tracks without setting any cookies. It uses a combination of IP address and user agent to generate a daily-rotating visitor hash for basic visit counting.
• In this mode, returning visitor recognition is limited (visitors are treated as new each day), but page view and event tracking still functions.
• This mode significantly reduces ePrivacy compliance requirements.

Data stays on your server (self-hosted):

• Unlike Google Analytics, self-hosted Matomo does not share data with any third party. All analytics data is stored on infrastructure the site owner controls.
• Matomo Cloud is hosted by Matomo's company (InnoCraft) on EU-based servers, with a DPA available.

IP anonymization:

• Matomo supports IP anonymization (masking 1-3 octets) which can be enabled in the admin panel. When fully anonymized, the stored data does not contain complete IP addresses.

Do Not Track:

• Matomo can be configured to respect the browser's Do Not Track (DNT) header, skipping tracking entirely for users who have enabled it.

Consent & Compliance

Matomo is an analytics tool, but its compliance posture varies significantly by configuration:

Under GDPR:

• Self-hosted + cookieless + IP anonymization: Several European data protection authorities (including CNIL in France) have confirmed that Matomo can be used without consent when configured with cookieless tracking, IP anonymization, and self-hosting. In this configuration, Matomo qualifies for the "strictly necessary" or "legitimate interest" exemption because no personal data leaves the site owner's control and no cookies are set.
• Standard mode with cookies: Requires consent under GDPR/ePrivacy because it sets non-essential cookies for analytics purposes.
• Matomo Cloud: Requires a DPA with InnoCraft. May still qualify for consent-free use if cookieless mode is enabled and the CNIL-approved configuration is followed.

Under ePrivacy:

• Cookieless mode avoids the cookie consent requirement entirely.
• Standard mode with cookies requires consent for setting the analytics cookies.

Under CCPA:

• Self-hosted Matomo does not share data with third parties, simplifying CCPA compliance. Disclosure in the privacy policy is still required.

Should You Block This Without Consent?

Conditional. If Matomo is self-hosted with cookieless tracking and IP anonymization enabled, it can run without consent — this is one of the few analytics tools that can legitimately operate consent-free. If using standard cookie-based tracking, it should be blocked until analytics consent is granted. Check your specific Matomo configuration before deciding.