Running Matomo in a Privacy-Compliant Way: How to Do It Without a Cookie Banner

Matomo without cookies is possible. Matomo without a cookie banner requires a separate assessment. Actual data collection, device access and the legal basis matter more than the analytics product's name.

This guide explains a data-minimising setup, the difference between cookieless tracking and consent, and practical verification. It is intended for website owners, developers and privacy teams.

TL;DR: Run Matomo with privacy in mind

• Disable tracking cookies before the first tracking call, or use the corresponding Tag Manager or WordPress setting.
• Review browser feature detection separately: cookieless tracking does not automatically disable it.
• Minimise IP data, URLs, referrers, event contents and retention.
• For Germany, assess device access under section 25 TDDDG separately from personal-data processing under the GDPR.
• Test the outcome and document both configuration and assessment.

Reviewed on 13 October 2026. Screenshots show the German interface of a local Matomo 5.14.0 test installation. Labels can vary by version and hosting. Settings alone do not replace assessment of your deployment.

Does Matomo need a cookie banner?

Two questions should guide the decision:

Section 25 TDDDG addresses device storage and access, including exceptions. The law was formerly called TTDSG. The German DSK guidance for digital services supports assessment. A data-minimising configuration is not a universal consent exemption.

Matomo's documentation also distinguishes disabling cookies from qualifying for a consent exemption. An opt-out does not replace required prior consent.

France's CNIL describes conditions for certain audience measurements. They cannot simply be applied as a German exemption. This guide therefore makes no guarantee of banner-free operation.

Matomo cookieless: Disable tracking cookies

JavaScript integration

Add the following to your existing Matomo snippet before trackPageView. This shows ordering only; your tracker URL, site ID and loading of matomo.js remain part of the existing integration.

var _paq = window._paq = window._paq || [];

// Before the first tracking call:
_paq.push(['disableCookies']);
_paq.push(['trackPageView']);

Verify: Use a fresh browser profile, navigate between pages and inspect cookies for both your website and Matomo domain. Requests may still be sent without tracking cookies. Functional cookies, for example around opt-out, need separate assessment.

Matomo Tag Manager

Open the Matomo configuration variable used by the tracking tag and enable “Disable cookies”. Preview the container before publishing. Another tag or a second direct integration can still collect additional data or set cookies.

An instance-wide option also exists under Administration → Privacy → Anonymize data: “Force tracking without cookies”. Check all affected websites before using a global setting.

Random config_ID is a separate decision. Matomo explains that each request then creates a new visit. Visitor journeys and visit-based reports change. This does not switch off collection of all browser data.

Matomo for WordPress

Enable “Disable cookies” in the Matomo Analytics plugin settings, save and verify the public page. Where caching or optimisation plugins are used, check that visitors actually receive the updated tracking code.

Limit browser feature detection separately

From Matomo 4.7, disableBrowserFeatureDetection disables the relevant queries, including screen resolution and supported plugins. See Matomo's instructions.

// Relevant excerpt for a more data-minimising integration:
_paq.push(['disableCookies']);
_paq.push(['disableBrowserFeatureDetection']);
_paq.push(['trackPageView']);

This does not establish that no personal data is processed. URLs, event contents, identifiers, HTTP requests and other scripts remain part of the assessment.

Minimise IP addresses, URLs and event data

IP masking and geolocation

Configure IP masking under Administration → Privacy → Anonymize data. Our test view selects two masked bytes and use of the masked address for enrichment. Stronger masking may be appropriate; location reports become less precise.

The UI term “anonymisation” does not guarantee fully anonymous data. Partially masked addresses may still relate to a person when combined with other information. Matomo's privacy guidance explains this distinction.

Review referrers, parameters and events

Our practical checklist:

• Do URLs, titles or referrers contain email addresses, customer numbers or tokens?
• Which parameters are necessary, and which can be removed?
• Do events or custom dimensions transmit form contents, User IDs or order identifiers?
• Do integrations combine the data with CRM, advertising or other websites?

For a deployment aiming to avoid personal identifiers, do not collect a User ID. Hashing or pseudonymising an identifier does not automatically anonymise it. Hiding the visitor log does not remove already collected data either.

Configure retention and deletion

Determine how long detailed raw data is needed. Anonymize data offers regular deletion settings. Raw data and aggregated reports are configured separately. See Matomo's retention guide.

180 days is an example, not a statutory default. Assess the purpose and reports you need, then document the agreed retention and change owner. Existing data and backups require separate consideration.

Matomo consent: Tracking consent differs from cookie consent

Where consent is required, the integration must enforce it:

The developer documentation explains this distinction. Cookie consent alone does not block collection.

// Where tracking requires prior consent:
_paq.push(['requireConsent']);
_paq.push(['trackPageView']);

// Only inside your CMP's confirmed consent callback:
// _paq.push(['setConsentGiven']);

Run the commented release call only following actual consent. Test refusal, acceptance, withdrawal and subsequent page loads. If your CMP stores the decision, its integration must pass that decision to Matomo correctly.

Matomo privacy notice and opt-out

Describe your actual deployment rather than copying a universal policy:

Matomo offers an integration under Privacy → Users opt-out. Verify it on your website. Objection to processing and withdrawal of consent need to be distinguished according to the legal basis.

Special cases: Logs, CCM19 and content tracking

Server-side Matomo and log analytics

Matomo offers log analytics and can analyse server logs without running an analytics tracker in the browser. That reduces client-side tracking access but does not settle GDPR questions about IP addresses, URLs, retention or recipients. Server-side tracking is not synonymous with log analytics: it may still receive data initially collected in the browser.

Do I need CCM19 or another consent manager?

It depends on your services. Where consent is required, a CMP such as CCM19 must control tracking until approval. Other marketing pixels and services need their own assessment even when Matomo does not use cookies.

Matomo Tag Manager and GDPR

Hosting a container yourself does not automatically make its tags compliant. Review each tag, recipient and firing condition, including the published version.

Content tracking, heatmaps and session recording

These collect additional interactions. Assess the actual data and device access. Aggregated reports do not prove that initial collection was anonymous; forms and sensitive pages deserve particular attention.

Google Analytics without consent?

This requires a separate assessment of the actual integration. A consent mode is not a universal exemption. This article does not provide instructions for consent-free Google Analytics; Matomo's name alone should not be treated as proof of compliance either.

Final verification and evidence

Our worksheet for development and privacy teams:

1. Record version, websites, containers and relevant settings.
2. Use a fresh browser without prior consent decisions; inspect cookies, storage and network requests.
3. Inspect transmitted URLs, referrers, identifiers and event data. Sensitive test values must not appear in the payload.
4. Test navigation, forms and, where used, refusal, consent, withdrawal and opt-out.
5. Document data flows, legal basis, retention and remaining questions with an owner.
6. Reassess new tags, plugins and tracking features.

Finding no analytics cookies is useful evidence, but it is not a complete compliance assessment.

Keep implementation accountable in Kopexa

Register Matomo as an asset and document the deployment in your record of processing activities where applicable. Connect gaps with tasks and keep configuration, assessment and test evidence together.

Development and privacy teams can then see who reviewed what, which actions remain open and when another review is due. Kopexa supports that coordination; it does not automatically configure Matomo or decide the legal basis. This shared record also supports collaboration with external data protection officers.