Using Matomo in compliance with the GDPR

Matomo can be self-hosted or used as Matomo Cloud (servers in Germany). Whether consent is required depends on cookies, IP handling and hosting — not on the name of the tool.

Cookieless tracking without consent? Matomo offers an option that switches off tracking cookies ("disableCookies" in the tracking API, a setting of the Matomo configuration variable in Matomo Tag Manager). This removes part of the access to the device — but not necessarily all of it: reading browser characteristics for a visitor hash can also fall under § 25(1) TDDDG. Some German supervisory authorities consider this mode with immediate IP truncation acceptable without consent, others take a narrower view. If you want to run without a banner, document the configuration and check how your own authority classifies it.

Anonymisation in Matomo mainly means IP truncation (Privacy → Anonymize data: at least 2 bytes, e.g. 192.168.xxx.xxx), plus optionally "replace User ID with a pseudonym" and stripping referrer parameters. The truncation should apply before storage, not only in the reports. It is also worth enabling "regularly delete old raw data" — Matomo can remove raw logs automatically after a fixed period and keep only aggregated reports.

Matomo On-Premise or Matomo Cloud: when you self-host on your own server there is no processor for Matomo itself — but there is one for the host where the server runs. With Matomo Cloud, InnoCraft Ltd. (New Zealand, hosting in Germany) is the processor; the data processing agreement (DPA) is provided in the customer account. The EU Commission has an adequacy decision for New Zealand.

Matomo needs its own section in the privacy policy: purpose (audience measurement), operating mode (self-hosted or cloud, server location), whether cookies are set, the extent of IP truncation, the legal basis (consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG — or, for cookieless operation, your own reasoned assessment), the retention period for raw data and a note on the right to object. A template only provides the framework; the actual settings must match it.

If you deliver Matomo via Matomo Tag Manager or Google Tag Manager, consent has to be enforced there: the Matomo tag may only fire after consent, or Matomo runs in the cookieless configuration and is cleared for cookies after consent via "rememberConsentGiven" or "setCookieConsentGiven". Matomo has no consent mode like Google's — control runs through these consent functions of the tracking API.

Is this a risk?

If Matomo sets cookies or reads other identifiers from the device, § 25 (1) TDDDG applies and prior consent is required. Some supervisory authorities consider a cookieless setup with immediate IP truncation and no cross-device merging defensible without consent, others are more cautious — there is no nationwide uniform clearance. With Matomo Cloud, a data processing agreement with InnoCraft is also needed.

What you can do

• Enable cookieless tracking and truncate the IP address immediately by at least two bytes.
• Respect “Do Not Track”, limit data retention and raw logs to the necessary minimum.
• If cookies are used or with Matomo Cloud: add Matomo to the consent tool and load it only after consent.
• In the privacy policy, name the purpose (reach measurement), hosting location, legal basis and, where applicable, the processing agreement.

Häufige Fragen

Does Matomo without cookies need consent?

Not necessarily, but it is no blanket clearance. Without cookies and with immediate IP truncation, some supervisory authorities consider operation without consent acceptable; if information is still read from the device, § 25 TDDDG may apply. Document your assessment.

Do I need a data processing agreement for Matomo?

With Matomo Cloud, yes — with InnoCraft. When self-hosting, not for Matomo itself, but for the hosting provider whose server stores the data.

Does Matomo have to be in the privacy policy?

Yes, always — also in cookieless operation. Name the purpose, operating mode, server location, IP truncation, legal basis and retention period.

Does Matomo have a consent mode like Google?

No. Matomo controls consent through its own tracking API functions (e.g. requireConsent / setConsentGiven or requireCookieConsent / setCookieConsentGiven), which the consent tool calls after consent is given.

How consentglass helps

The free scan checks the delivered HTML and shows which services are embedded, whether a cookie banner is detected and whether privacy-policy and legal-notice links are present — with context for each finding. It is not a substitute for legal advice.