Matomo without cookies: what it takes technically

Matomo can measure without cookies. Two additional calls in the tracking code are enough:

_paq.push(['requireCookieConsent']);
_paq.push(['disableBrowserFeatureDetection']);

With requireCookieConsent, Matomo sets no cookies as long as there is no consent. This is more flexible than the better known disableCookies: if a visitor consents later, for example via a consent tool, Matomo can use cookies from then on without you changing the tracking code. If you never want to set cookies, you can stay with disableCookies. The second call is often forgotten, but it matters at least as much if you want to measure without consent. Why is explained below. You should also know what changes in the reports and check Matomo’s other privacy settings at the same time.

What changes in the reports

Without a cookie, Matomo can no longer recognise returning visitors by a stored identifier. Instead, visits are grouped by technical attributes. This has consequences:

• Metrics such as “returning visitors” become less precise.
• Visits across several days are harder to attribute to one person.
• Campaign attribution over longer periods gets weaker.

For most websites, pageviews, entry pages, campaigns and goals within a visit can still be analysed well.

Cookieless does not automatically mean consent-free

In Germany, whether you need consent is decided first by § 25 TDDDG (the German Telecommunications Digital Services Data Protection Act, formerly TTDSG), which implements Article 5(3) of the EU ePrivacy Directive. The rule does not only apply to cookies. In principle, consent is required for any storing of information on the device and for any access to information already stored there, unless it is strictly necessary for the service the user has requested. Web analytics is generally not considered strictly necessary.

This also covers reading device properties. By default, Matomo uses its so-called browser feature detection to determine, for example, the screen resolution and supported browser features, and in newer versions it requests additional device information via client hints. That is access to information on the device. If you want to do without consent, you should therefore switch detection off:

_paq.push(['disableBrowserFeatureDetection']);

The reports will then lack details such as screen resolution and browser plugins. Matomo still derives browser, operating system and device type from the identifier (user agent) that the browser sends with every page request anyway. Also check whether plugins, your own scripts or the Tag Manager store or read anything else in the browser, for example in local storage.

Once § 25 TDDDG is satisfied, the question is not fully answered yet: the subsequent processing of personal data needs a legal basis under the GDPR, usually legitimate interest. A shortened IP address, short retention periods and an easy way to object fit with that.

And with consent?

If you use a consent tool anyway, you can run Matomo with cookies after consent. That is exactly what requireCookieConsent is for: without consent, Matomo measures cookieless and without feature detection; after consent, the consent tool calls rememberCookieConsentGiven, and Matomo sets cookies from then on. The basic numbers stay complete, and people who consent are recognised across several visits.

The settings that belong to it

1. Cookies only after consent, feature detection off. requireCookieConsent and disableBrowserFeatureDetection, as described above.
2. Shorten IP addresses. In Matomo’s privacy settings you can define how many bytes of the IP address are removed.
3. Delete old raw data. Matomo can remove raw data automatically after a fixed period. The aggregated reports are kept.
4. Clean up URL parameters. Parameters containing personal data, such as email addresses in newsletter links, should be excluded.
5. Offer an opt-out. Matomo comes with an opt-out that can be embedded in the privacy policy.
6. Document it. Write down what is configured. That helps your data protection adviser and your IT team.

Technology is not law

This article describes the technical side. Whether your setup is permitted without consent is answered by your data protection or legal adviser. I take care of a clean implementation and documentation that makes this assessment possible.

You can see how this website measures on the Transparency page. If you want to tackle this for your own website, see Cookieless & privacy settings.