DEEN
Book an intro call

Privacy

Privacy check for Matomo: auditing a running Matomo

Privacy settings are quickly set. What a Matomo has actually stored after a few years, who accesses it and what sits on the server next to it only shows in a check. Here is what matters, where to look in Matomo and which ISO 27001 controls fit.

By Peter Boehlke

Updated: 11 min read

The GDPR settings, from IP masking to the deletion period, are on the page Matomo and privacy. This check goes further: it looks at what a Matomo actually collects in operation, at the people with access and at everything outside the database. Personal data hides where nobody looks anymore.

Where personal data sits around Matomo: in the raw data in the database, with the users who have access, in outbound connections, in the web server's logs and in the backups.

First look at what arrives

Settings say what Matomo should store. What it has stored is shown by the data itself. Open the visits log for a few days and the reports on pages, events and site search:

  • Page titles and addresses: profile pages with names, order pages with order numbers, newsletter links with email addresses. Discard what does not belong there through excluded parameters or overwrite it in the tracking code.
  • Events: names and values into which someone wrote a form field or a customer number.
  • Site search: it is on by default for every website, and search terms often contain names or postcodes.
  • Custom dimensions: Matomo itself gives the example of a health website storing diagnoses.
  • User ID: according to Matomo it is inherently personal, even as a pseudonym. If there should be none, the Visitors > User IDs report must be empty.
  • Premium features: in heatmaps and session recordings, inputs are masked by default and keystrokes are off; check where someone has unmasked fields. According to Matomo, recordings require consent. Error messages from Crash Analytics can contain personal details.

Visits log and visitor profile. The profile combines up to 100 visits of one visitor, with IP address, visitor ID, locations, search terms and revenue. Matomo’s own GDPR guide counts profiles of individual visitors among the things that need consent. If you use neither, switch them off under Administration > System > General settings (“Turn off Visits log and Visitor profiles”), for all or for individual websites. Tracking continues, and so do the reports.

Clean up what is already stored through Anonymize previously tracked raw data and the GDPR tools, described in Matomo and privacy.

Who has access: clean up permissions

Every user with access to the visits log sees raw data. That is why the user list belongs in every check:

  • Super users: as few as possible. Risky actions such as installing plugins can also be locked for super users in the configuration.
  • Anonymous access: by default there is none. If someone has given the anonymous user view access, the reports are public, and unless the visits log is off, anyone also sees individual visits, just without IP and visitor ID.
  • Inactive accounts: on request, Matomo sends a monthly security email listing users who have not signed in for more than 180 days. It is off by default.
  • Email domains: Matomo can restrict sign-ins to the company’s domains, so nobody hands out access to private addresses.
  • Two-factor authentication for everyone, and tokens only with the rights a tool needs. How that works is covered in API, MCP and OAuth.

Permissions stay clean most reliably when Matomo does not manage the users itself at all: sign-in through the company’s identity provider, joiners and leavers via SCIM. Whoever leaves the company loses access to Matomo at the same moment as to everything else.

If you need to record who changed what and when, Matomo’s premium Activity Log plugin keeps a log of sign-ins, permission changes and changed privacy settings.

What goes out

  • Update check and Marketplace: Matomo checks for updates every eight hours and sends versions, its own address and the time zone. The Marketplace receives the number of users and websites and the list of installed plugins. Visitor data is not included. enable_internet_features = 0 in the configuration turns these connections off; then there are no more update notices, and you need another way to learn about updates.
  • Tag Manager: a container can load tags for ad networks besides Matomo, such as Meta, Google Ads or LinkedIn, plus custom HTML. Check which tags are published and whether they wait for consent. By default, only admins may create custom templates with code.
  • Location via the server module: if the web server determines the location, Matomo’s own note says IP masking in Matomo does not apply to the location data.
  • AI assistants: if the MCP server is on, queries go to the assistant’s provider. More in API, MCP and OAuth.

Don’t forget the server

Matomo masks the IP address before storing. The web server in front of it, however, logs every tracking request with the full IP and all request parameters, including the visited address and the visitor ID. Matomo itself writes: if the full IP still sits in the web server’s logs, the data is not anonymised to the standard the GDPR requires.

  • Web server logs: mask IP addresses when writing them and delete the logs after a fixed period, for example with logrotate. That period belongs in the privacy policy. Elsewhere, Matomo recommends keeping logs longer so tracking data can be replayed later; that is a trade-off you should make deliberately.
  • Matomo’s own logs and tables: Matomo keeps failed tracking requests for two days, blocked sign-in attempts with IP address, and the Activity Log without expiry.
  • Backups: a database backup contains all raw data. Deleted data and fulfilled erasure requests remain in it until the backup expires. Matomo names 30 days for daily backups; set a period and write it down.
  • Directories: config and tmp must not be reachable from outside. How that works for Apache and nginx is covered in Installing and setting up Matomo.

For nginx, a map masks the IP address in the log before it is written:

# In the http block: remove the last byte (IPv4) or the trailing groups (IPv6)
map $remote_addr $remote_addr_anon {
    ~(?P<ip>\d+\.\d+\.\d+)\.    $ip.0;
    ~(?P<ip>[^:]+:[^:]+):       $ip::;
    default                     0.0.0.0;
}

log_format anonym '$remote_addr_anon - $remote_user [$time_local] "$request" '
                  '$status $body_bytes_sent "$http_referer" "$http_user_agent"';

# In Matomo's server block
access_log /var/log/nginx/matomo.access.log anonym;

Documentation and people

  • GDPR overview in Matomo: under Administration > Privacy > GDPR Overview, Matomo itself guides you through the points: data processing agreement, rights of data subjects, documentation, security procedures, retention.
  • Records of processing activities: Matomo has published a filled-in example. The web server logs and the backups with their periods belong in there too.
  • Privacy policy: Matomo provides its own as a template for the structure but advises against copying it. It must describe what your Matomo really does, including the periods for raw data and server logs.
  • Contracts: for Matomo Cloud there is a data processing agreement from Matomo; if you run it yourself, you need one with the host or service provider.
  • Processes: who gets access and who approves it, what happens when someone leaves, who may export data, what happens in a data breach. Session recordings or profiles may require a data protection impact assessment.
  • Training: anyone using Matomo should know why names do not belong in events and why exports from the visits log are not a working copy for Excel. Matomo’s guide starts with exactly this point: awareness in the team.

The CNIL check under Privacy > Compliance is a useful cross-check for the settings; Matomo itself stresses that it is for information only.

Matching ISO 27001 controls

If you run an information security management system under ISO/IEC 27001, it is best to check Matomo against the controls in Annex A of the 2022 edition. It contains 93 controls in four themes. These fit the points above:

No. Control What you show for Matomo
5.9 Inventory of information and other associated assets Matomo in the records of processing and in the system inventory
5.14 Information transfer outbound connections, Tag Manager tags, AI assistants
5.15, 5.16, 5.18 Access control, Identity management, Access rights roles per website, no anonymous access, regular user reviews, leavers via SCIM
5.17, 8.5 Authentication information, Secure authentication two-factor authentication, no tokens in addresses, protection against sign-in attempts
5.19, 5.20 Information security in supplier relationships, Addressing information security within supplier agreements host or service provider, data processing agreement, third-party plugins
5.34 Privacy and protection of PII IP masking, deletion periods, consent, visits log
6.3 Information security awareness, education and training training for Matomo users
8.2 Privileged access rights few super users, risky actions locked
8.8 Management of technical vulnerabilities updates to Matomo, PHP and server
8.10, 8.11 Information deletion, Data masking deletion periods for raw data, logs and backups, masked IP addresses, masked fields
8.13 Information backup backups with a defined period
8.15 Logging web server logs with masked IP and fixed retention, Activity Log

The mapping is my assessment; the text of the standard and your auditor are what count. For privacy itself, ISO/IEC 27701 in its 2025 edition is a separate standard for a privacy information management system. And if you work to the German BSI IT-Grundschutz, you will find the requirement there to delete log data by a defined process.

Repeat regularly

A check is a snapshot. New tags, new plugins, a relaunch or new forms change what arrives. Repeat it after each of these changes and in any case at least once a year.

A check that finds something

  • Look into the data Visits log, page titles, events, search terms, dimensions.
  • Permissions from one source Single sign-on and SCIM, no orphaned accounts.
  • Include the server Masked IP in the logs, fixed periods for backups too.
  • Written down Periods in the records and in the privacy policy.

What is often overlooked

  • Checking only settings The names are still in the page titles.
  • Old accounts Former employees and agencies still have access.
  • Full IP in the access log Matomo masks, the web server in front does not.
  • Once and never again The next relaunch brings new data.

Sources

As of 13 November 2026, Matomo 5.14 and 6.0.0-rc1

FAQ

Frequently asked questions

How often should I check Matomo for privacy?

After every major change: new tags in the Tag Manager, new plugins, a website relaunch, new users with access. Regardless of that, at least once a year, because page titles, events and search terms change with the website.

Is the CNIL check in Matomo enough as a privacy check?

No. It compares the settings with the conditions of the French regulator and, according to Matomo, is for information only. It does not check what is in page titles or events, who has access or what sits in the server's logs.

Does Matomo offer a data processing agreement?

For Matomo Cloud, yes. If you run Matomo yourself, you are responsible yourself and need no agreement with Matomo, but you do need one with the host or service provider running the server.

Do server logs belong in the privacy policy?

What the web server logs and for how long is part of the information about the processing. The simplest approach is a short, fixed period with masked IP addresses that is stated in the privacy policy. The legal assessment stays with your privacy advisers.

Questions about your setup?

In an intro call we'll look at your situation together.

Book an intro call

Newsletter

Matomo know-how, once a month.

Practical tips on tracking, privacy settings and performance, plus notes on important Matomo updates. No spam, unsubscribe any time.