Is Matomo GDPR Compliant?

The question involves two laws, and Matomo engages both

“GDPR compliant” is the phrase everyone uses, but GDPR alone never decides whether you need a cookie banner. Two instruments apply independently, and conflating them is where most vendor answers go wrong.

The ePrivacy Directive governs storing information on, or reading information from, a visitor’s device. Article 5(3) applies whether or not the stored value is personal data — a purely technical identifier still counts. GDPR governs the processing of personal data, wherever it came from. In its default installation Matomo engages both: it writes first-party cookies, and it processes IP addresses that are personal data until they are truncated.

So the honest form of the question is not “is Matomo compliant” but “under what configuration, in which member state, and at what cost to the numbers.”

The CNIL route: banner-free with cookies still on

This is the part that surprises people, including people who sell against Matomo. The French exemption does not require you to turn cookies off. It requires the cookies to be harmless in a specific, enumerated way. Since 2020 the CNIL has published criteria for audience measurement that is exempt from consent, and the July 2025 update refreshed the self-assessment behind them.

Six conditions have to hold together. The tool must serve audience measurement and nothing else — no advertising targeting, no profiling, no content personalisation. The data must not be cross-referenced with other processing. Nothing may be transmitted to third parties. IP addresses must be anonymised. Cookie lifetime is capped at 13 months, and raw data retention at 25. Fail one and consent becomes mandatory again for the whole deployment.

In practice, configuring Matomo for this means disabling device fingerprinting, disabling user profiles, disabling the Heatmaps and Session Recording plugins, truncating the last two octets of the IP, anonymising User ID and Order ID, and setting the retention windows explicitly. Matomo provides a CNIL compliance mode in the interface that applies most of it, which is more than most vendors in this category offer. The criterion-by-criterion breakdown of the CNIL exemption covers what each condition means for an implementation.

One structural change worth knowing: the CNIL retired its published list of exempt solutions on 1 January 2026. The criteria are unchanged — what disappeared is the official label. Suppliers now self-assess against the same requirements, which means the burden of evidencing the configuration sits with you and your vendor rather than with a badge on a regulator’s website.

What the exempt configuration costs you

Compliance is the part that gets discussed. The measurement bill is the part that arrives later.

With cookies constrained or disabled, Matomo identifies a visit using config_id, a hash of environmental attributes. Matomo is careful about this and deserves credit for it: config_id is deliberately built not to be permanent, not to recognise returning visitors and not to allow tracking across sites. It is a genuinely more privacy-protective design than the fingerprinting it is often mistaken for. But the same property that makes it defensible makes it short-sighted, literally: the default lookback window is around 30 minutes, and 24 hours at the outside.

The consequences are specific rather than general. Pageviews, events, downloads, outlinks and site search come through intact. What degrades is returning-visitor counts, visit frequency, multi-session campaign attribution, cohort analysis and multi-channel attribution reports. A visitor who arrives from a paid campaign in the morning and converts from an email in the afternoon is two unrelated visitors. For a content site that is a rounding error. For eCommerce with a considered purchase cycle, it is the difference between knowing which channel earns revenue and guessing.

This is the trade the compliance conversation usually skips, and it is worth putting a number on for your own site before you assume it is small. Our data loss calculator models the gap between traffic you receive and traffic your current setup actually attributes.

The exemption is French, not European

ePrivacy is a directive, not a regulation, which means each member state transposed it into national law and the national versions differ. This is the single most common error in analytics compliance claims — vendors and buyers alike treat a French answer as a European one.

Germany transposed Article 5(3) as §25 TDDDG (the act was renamed from TTDSG in May 2024; the section number is unchanged), and it recognises no audience-measurement carve-out equivalent to the CNIL’s. Consent is required for storing or reading anything on the device that is not strictly necessary for a service the user requested, and analytics is not strictly necessary. A Matomo configured exactly to the CNIL criteria, deployed on a German site, still needs a banner. The German DSK does accept that tools which set nothing on the device and process no personal data fall outside the requirement — but that is a different architecture, not a different configuration.

If you operate across the EU, the practical question is which of your markets you are configuring for, and whether you are prepared to run different consent postures per country.

What the Digital Omnibus would change

On 19 November 2025 the European Commission published COM(2025) 837, the Digital Omnibus. As drafted it would move the terminal-device rules out of ePrivacy and into the GDPR under a new Article 88a, and exempt first-party, aggregated audience measurement for the controller’s own use from consent across the Union.

If it is adopted broadly as written, a Matomo in exempt configuration would qualify everywhere rather than only in France — the French carve-out generalised rather than removed. That is a genuine improvement in Matomo’s position, and pretending otherwise would be dishonest. Two caveats belong with it. It is a proposal, not law: Parliament and Council have yet to agree a text, substantive amendments are likely, and adoption is realistically 2027–2028. And it changes nothing about the measurement cost above — a consent-exempt configuration still cannot recognise a returning visitor, whichever legal instrument blesses it.

The architectural alternative

There is a second route to the same place, and it is the one that does not depend on holding a configuration correct over time. If a tool writes nothing to the device and reads nothing from it, Article 5(3) is not engaged at all. If it processes no personal data, the GDPR consent question does not arise either. Compliance stops being a setting your team has to maintain and evidence, and becomes a property of how collection works.

That is the basis for consentless analytics, and it is why the coverage problem does not reappear: there is no banner to reject and no exempt configuration to trade features against. The limits are real and worth stating plainly — no individual-level analysis, no cross-session stitching, no audience activation, because those need precisely the identifiers that are not being collected. If you want the feature-level differences rather than the legal ones, the head-to-head comparison with Matomo covers hosting, operations and reporting parity.

So — is it compliant?

Yes, with conditions, and Matomo is one of the better-behaved tools in this category. It is open source, it is self-hostable, it does not sample your data, it publishes its configuration guidance, and its approach to visitor identification is more privacy-protective than the industry norm. If your site is content-driven, your market is France, and session-level measurement answers your questions, Matomo in exempt configuration is a reasonable choice.

The question that outlasts the compliance one is what the compliant configuration can still tell you. A tool that is lawful in one member state, needs a banner in another, and cannot connect a visit on Tuesday to the same person’s purchase on Thursday is answering a narrower question than most eCommerce teams think they are buying. That is not a flaw in Matomo. It is the cost of reaching compliance through configuration instead of through architecture.

This is an assessment of how the technology interacts with the regulation, not legal advice. Your DPO or counsel owns the conclusion for your deployment.