Configure Privacy Settings in Matomo

This guide explains the privacy implications of tracking your visitors’ web analytics data, and how Matomo can easily be configured to ensure that your users’ privacy is respected.

Matomo ensures the privacy of your users and analytics data. When using Matomo, YOU keep control of your data, nobody else does. Your data is stored in your own MySQL database, and logs or report data will never be sent to other servers by Matomo. Learn more about Privacy.

To ensure further security, after you have installed Matomo, we recommend that you:

  1. make your Matomo server more secure by undertaking a few extra security checks
  2. follow the guide below to enable important Privacy features

By design, Matomo ensures that your analytics data is only accessible to the Matomo administrator, meaning it is completely secure. This guide will explain how to easily make your favourite web analytics tool « privacy compliant ».

The majority of privacy settings within Matomo can be found by clicking the cog icon Settings Cog Icon within the top menu while logged in as Super User, which takes you to the Settings page. On this page, there is a Privacy menu available in the main navigation along the left-hand side of the page.

Matomo Privacy Menu

Step 1) Automatically Anonymise Visitor IPs and replace User IDs

By default, IP Anonymisation is enabled in Matomo. This means Matomo stores in the database each new visitor IP address (ipv4 or ipv6 format) with the last components removed to protect user’s privacy. IP anonymisation is a good way to protect users with static IP address as otherwise their browsing history would be easily tracked across several days and even across websites tracked within the same Matomo server. IP addresses also identify the specific network a user comes from which can also reveal geographic data, often down to the level of a single individual.

To ensure that you do not store the visitor IP, which is Personally Identifiable Information (PII), please go to Administration > Privacy > Anonimyze data, to enable IP anonymization, and check you have 2 bytes or 3 bytes masked from the IP address. You can do this through the following steps:

  1. Click Anonymize data within the Privacy menu on the Matomo Settings page.
  2. Click Anonymize Visitors’ IP addresses so a green tick is shown.
  3. Select how many bytes of the visitor’ IPs should be masked by clicking the option you want so that a green bullet is shown. Some countries may also regulate the number of bytes you need to remove before an IP is considered anonymised. If you are interested in knowing where your users are, review the geolocation considerations below, otherwise, you should typically select the default 2 byte(s).
  4. The next step is to select whether the anonymised IP address or the full IP address is used for Geolocation. If you select No for this setting, make sure you let users know this within your privacy policy, and provide a link to the privacy policy of any third parties that you use to process data.
  5. Click the big green Save button to update your settings.

The steps above will anonymise all IP addresses from the moment you enable those settings. If you have already been using Matomo for any length of time, there is a chance you have existing PII such as visitors IP addresses or User IDs stored. In this case, you should also anonymise your existing data. There is a guide to anonymising past data with Matomo here.

Geolocation Considerations when IP masking

IP addresses are used by Matomo for identifying where users come from. If you are not interested in finding out where your users are visiting from, you can safely anonymise 3 byte(s) in the process above which provides the most privacy. However, if you are interested in a visitor’s location you have two options:

  • Privacy Prioritised Geolocation: Set the number of bytes to 1 bytes(s) (more accurate geolocation) or 2 byte(s) (less accurate geolocation) and then select Yes (Recommended for privacy) to use the anonymised IP address for enriching visits. Your settings should look like this:
    IP Masking with Location Matching

  • Accuracy Prioritised Geolocation: Select any number of byte masking options to anonymise the IP address within your database, but select No on the option to use anonymised IP addresses when enriching visits. Your settings should look something like this:
    IP Masking Settings

Does IP Anonymisation work with IPv6?

Yes! While the examples above are shown in IPv4 format, it is worth noting that IP anonymisation works with newer IPv6 addresses too.

Replace User ID with a pseudonym
While you are masking IP addresses, there is another setting within this section that allows you to « Replace User ID with a pseudonym » if you are using Matomo’s User ID feature. The Matomo User ID feature can be a very powerful tool if users log in to your website. It can track their activity across devices and visits by tracking a unique user ID while visitors are logged in.

When you enable the option to to “Replace User ID with a pseudonym”, the User ID will be replaced by a pseudonym to avoid directly storing and displaying personally identifiable information such as an email address. In technical terms: given your User ID, Matomo will process the User ID pseudonym using a salted hash function. Replacing a User ID with a pseudonym is not the same as anonymisation. In GDPR terms: the User ID pseudonym still counts as personal data. The original User ID could still be identified if certain additional information is available (which only Matomo and your data processor has access to).

User IDs are inherently PII, and therefore you will likely require consent. This is true even if you replace them with a pseudonym. Therefore, the biggest benefit to pseudonymisation of User IDs is that it provides a level of privacy to website users when analytics data is reviewed. Below is a screenshot of the same visitor in the visit log before and after pseudonymisation.

Visit Log Before Pseudonymisation
User ID

Visit Log After Pseudonymisation
User ID Pseudonym

If you would like to respect your user’s privacy while reviewing your website analytics, then there are three simple steps to enable this feature:

  1. Click Anonymize data within the Privacy menu on the Matomo Settings page.
  2. Click Replace User ID with a pseudonym so a green tick is shown.
  3. Click the big green Save button.

Step 2) Regularly delete old raw visitor data

In Administration > Privacy > Anonymize data, under the section « Regularly delete old raw data » you can configure Matomo to automatically delete your old raw data (old visitor logs) from the database. For privacy reasons, we highly recommend that you keep the detailed Matomo logs for only 3 to 6 months and delete older log data.

Deleting old raw data also has one other important advantage: it will free database space which will, in turn, slightly increase performance.

If you run the automatic script as explained in the FAQ, it is safe to delete your old log data and still access all historical reports in Matomo.

Step 3) Include a Web Analytics Opt-Out Feature on Your Site

On your website, in your existing privacy policy page or in the ‘Legal’ page, you can actually add a way for your visitors to « opt-out » of being tracked by your Matomo server. By default, all of your website visitors are tracked, but if they opt-out by clicking on the opt-out checkbox, a cookie ‘piwik_ignore’ will be set. All visitors with a piwik_ignore cookie will not be tracked.

In Administration > Privacy > Users opt-out, you will be able to copy and paste the opt-out form code:

The opt-out form code solution is simple to use and recommended for almost every use. You can make the opt-out look great on your website by customising the Opt-out iframe colors and fonts (text color, background color, font size, and font family).

Here below is the example opt-out form for this website. You can opt out from being tracked on demo.matomo.cloud (You will need to disable any ad-blockers in order to see the example):

In cases where you need to customise more aspects of the opt-out form (for example change the opt-out text itself), you can implement a custom visitor opt-out form using JavaScript.

Step 4) Respect DoNotTrack preference

Do Not Track is a technology and policy proposal that enables users to opt-out of tracking by websites they do not visit, including analytics services, advertising networks, and social platforms. For more information about DoNotTrack, check out donottrack.us.

In Administration > Privacy > Users opt-out, under « Support Do Not Track preference » you can enable/disable Do Not Track support:

Note: tracking requests and cookies will still be created even for people who don’t want to be tracked. To prevent any requests and cookies when people don’t want to be tracked, add the following function in the JavaScript Tracking code: _paq.push(["setDoNotTrack", true]);

Finally, note that if your audience is widely using IE10, IE11, or Maxthon, then you will not track some of your audience because these older browsers have the DoNotTrack feature enabled by default for all users.

Step 5) Create a Privacy Policy page on your website(s)

A privacy policy is a statement or a legal document that discloses some or all of the ways a party gathers, uses, discloses, and manages a customer or client’s data. It fulfills a legal requirement to protect a customer or client’s privacy.

When you use Matomo to track your visitors, we recommend updating your Privacy Policy to explain how Matomo is used and what data it gathers. We provide a Privacy Policy template here for Matomo users that you can copy on your site.

Learn more about a GDPR compatible privacy policy in How to complete your privacy policy with Matomo analytics under GDPR.

Step 6) Learn about personal data regulations such as GDPR

To learn more about the privacy regulations and in particular the GDPR, please visit our GDPR User guide.

Or in Matomo go to Administration > Privacy > GDPR Overview to find details about awareness & documentation, individuals’ rights, security procedures, and data retention.

Step 7) Anonymising data that has already been tracked

When you have tracked data in the past and realised later you tracked maybe too much data or some personal data, you can easily anonymize the affected data using our tool to anonymize previously tracked raw data.

As part of privacy legislation worldwide including GDPR but also ePrivacy, it is often required to display a cookie banner informing users about cookies, or consent must be obtained before tracking visitors’ personal data. However there is a solution available: you can use Matomo Analytics without needing consent and without a cookie banner, by following all the steps listed in the FAQ at How do I use Matomo Analytics without consent or cookie banner?

Step 9) Anonymize Ecommerce Order ID

By default Matomo stores your Ecommerce Order IDs to allow for closer analysis and to help prevent tracking duplication. However, because an Order ID can be cross-referenced with another system, typically an eCommerce shop, the Order ID may count as personal information under the GDPR. If you prefer not to track personal data in Matomo, you may enable “Anonymize Order ID” to avoid storing the Ecommerce Order ID number. The steps to do this are:

  1. Click Anonymize data within the Privacy menu on the Matomo Settings page.
  2. Click Anonymize Order ID so a green tick is shown.
  3. Click the big green Save button.

When you enable this option, an Order ID will be automatically anonymised so no personal information will be tracked. It is important to note that if you enable this feature, in some cases duplicate orders may be counted if people refresh the order confirmation page as there is no way to distinguish unique orders.

Step 10) Optional Privacy Preferences

There is more you can consider when it comes to privacy: