Without cookies, Matomo cannot recognise a visitor over days. Everything else remains: page views, entry pages, channels, campaigns, events and goals within a visit. For many websites that is exactly the right amount of data, and it takes only a few lines to set up.
The two calls
Matomo’s tracking code needs two additional lines for this, before trackPageView:
_paq.push(['requireCookieConsent']);
_paq.push(['disableBrowserFeatureDetection']);With requireCookieConsent, Matomo sets no cookies as long as there is no consent. That is more flexible than the better-known disableCookies: if a visitor consents later, for example through a consent tool, Matomo uses cookies from then on without you rebuilding the tracking code. If you never want to set cookies, stay with disableCookies.
| Call | Without consent | After consent |
|---|---|---|
disableCookies |
no cookies | still no cookies |
requireCookieConsent |
no cookies | cookies as soon as the consent tool calls rememberCookieConsentGiven |
Why feature detection should be off
The second call is often forgotten and is at least as important. By default, Matomo uses browser feature detection to determine, for example, the screen resolution and supported browser features, and in newer versions it requests additional device information through client hints. That is an access to information on the device, and in Germany § 25 TDDDG applies to it just as it does to cookies. Why that is so and which second question the GDPR asks is described under Matomo and privacy.
Without feature detection, details such as screen resolution and browser plugins are missing from the reports. Browser, operating system and device type remain, because Matomo derives them from the user agent the browser sends with every request anyway.
In Matomo Tag Manager
If you use Matomo Tag Manager, set the same in the Matomo Configuration variable of your container:
- Require cookie consent corresponds to
requireCookieConsent. - Disable cookies corresponds to
disableCookies. - Disable Browser Feature Detection corresponds to
disableBrowserFeatureDetection.
The change only takes effect once you publish a new version of the container. A screenshot of these settings is on Matomo cookies, how preview and versions work under Matomo Tag Manager. Also check whether tags in the container store anything in the browser: the fire limit “Once per 24 hours”, for example, uses local storage.
Enforcing it for all websites
If you have many websites or old tracking codes you cannot access, there is a global switch: Administration > Privacy > Anonymize data > Force tracking without cookies. According to Matomo, it changes the file matomo.js so that the tracker sets no cookies, and Matomo additionally ignores tracking cookies on the server. That applies even if a tracking code reports consent. Using cookies with consent is then no longer possible.
This switch does not turn off feature detection. For that you still need disableBrowserFeatureDetection in the tracking code or in Tag Manager.
Adding cookies with consent
If you use a consent tool anyway, you can also run Matomo with cookies after consent. That is exactly what requireCookieConsent is for: without consent, Matomo measures cookieless and without feature detection; after consent, the consent tool calls rememberCookieConsentGiven, and Matomo sets cookies from then on. The basic numbers stay complete, and whoever consents is recognised across visits.
With consent, Matomo also turns feature detection back on; that is how the tracker is written. Whoever consents is therefore measured with cookies and with device properties. Without consent, both stay off.
What is missing without cookies
| Stays reliable | Becomes less precise | Missing |
|---|---|---|
| Visits and page views | Unique visitors over weeks and months | Recognition over days |
| Entry pages, channels, campaigns | Returning visitors | Cohorts |
| Events and goals within the same visit | Days to conversion | Attribution across several visits |
| Bounce rate and visit duration | Visits per visitor | Screen resolution and plugin reports |
You notice it most with campaigns: if someone comes through a newsletter, leaves and buys two hours later, the purchase counts for direct entry. How Matomo recognises visitors without a cookie and why the number of unique visitors then comes close to the number of visits is described under Unique visitors.
Without cookies, but not without an identifier
To keep the page views of a visit together, Matomo creates a hash on the server without a cookie, the config_id. It is built from attributes such as operating system, browser and version, IP address and language, contains a value that changes every day, and by default Matomo only looks back 30 minutes with it. With feature detection off, no plugin details go into it, because the browser does not send them in the first place.
If even that is too much for you, switch on Randomize config_ID for enhanced privacy under Anonymize data. Matomo then creates a new identifier for every request, and every action counts as a visit of its own. Visits, bounce rate and visit duration lose their meaning.
Checking in the browser
Settings are one thing, what the browser actually does is another. Here is how to check it in a few minutes:
- Open a private window and visit the website without clicking anything in the consent tool.
- Look at the cookies: in the developer tools under Application or Storage, there must be no cookies starting with
_pk_. - Look at local storage: nothing from Matomo or Tag Manager should be there.
- Look at the tracking request: in the network view, find the request to
matomo.php, or tojs/depending on the setup. With feature detection off, the parametersresfor the screen resolution,uadatafor client hints and plugin flags such aspdfare missing. - Repeat with consent if you use a consent tool: the
_pk_cookies may only appear after consent.
Whether the website already sends data to third parties before consent is also shown by the free website check.
Technology is not law
This page describes the technical side. Whether your setup is permissible without consent is for your data protection or legal adviser to answer. I take care of a clean implementation and documentation that makes this assessment possible, described under cookieless & privacy settings.
Read on at feinwerk.io: Cookieless Matomo: settings, opt-out and limits
Sources
As of 11 November 2026
- Matomo: How do I use Matomo Analytics without consent or cookie banner?
- Matomo for developers: Tracking and cookie consent
- Matomo: When cookies are disabled, how does it impact Matomo reports accuracy?
- § 25 TDDDG: protection of privacy in terminal equipment (German)
- Matomo on GitHub: JavaScript tracker with feature detection and consent
- Matomo on GitHub: identifier without a cookie (config_id)