Google Analytics alternative that runs without a consent banner

Can a Google Analytics alternative run without a consent banner?

An analytics setup can avoid a consent banner only if it meets the conditions in CNIL sheet 16, and most large offerings, including Google Analytics 4, do not meet them regardless of how they are configured. CNIL's guidance says that most large audience measurement offerings fall outside the consent exemption whatever the settings. The exemption is narrow: the tracker must be limited to audience measurement and A/B testing, serve a single publisher, avoid cross-checking with other processing, truncate the last byte of the IP address, and keep its lifetime to 13 months at most. Teams that use GA4 for Google Ads audiences, remarketing or cross-product linking should assume a consent flow remains necessary.

CNIL points publishers toward open-source software they can configure themselves, and it names Matomo as an example. Self-hosted Matomo, licensed under GPLv3, is the option that fits this model, but that is a conditional answer, not a guarantee. The exemption depends on the exact configuration: disabling marketing purposes, anonymizing IP addresses, setting the cookie lifetime, and avoiding features such as User ID, heatmaps or session recordings, which Matomo's ePrivacy FAQ says remove the exemption. The configuration must also be applied on every site and in every tag, and it must be checked again after upgrades or plugin changes. Confirm the current interpretation with your supervisory authority or legal counsel before you drop the banner.

DeployOpen can plan the Matomo configuration, document the settings that match CNIL's conditions, and prepare the evidence your legal and privacy team will ask for. DeployOpen does not issue legal opinions, certifications or audit reports, so the decision on whether your setup qualifies stays with your data protection officer, counsel and, where relevant, the CNIL itself. Ask any implementation partner to put the configuration baseline, the list of excluded features and the change-control process for future upgrades into the written scope.

What the CNIL exemption requires

The CNIL exemption is conditional, and every condition has to hold at the same time. The cards below cover the five configuration conditions and the features that remove the exemption, so you can check a deployment against the sheet before you drop the banner.

Purposes limited to measurement

The tracker may only serve audience measurement and A/B testing. Performance and traffic reporting qualify, but marketing measurement, retargeting and ad attribution do not. For Google Analytics alternative that can run without a consent banner, list every report and tag your team uses today and confirm that each one serves one of those two purposes.

Single publisher scope

The data must stay within one publisher's own site or app. Cross-site tracking, shared audiences and data pooled across brands fall outside the exemption. If your group runs several domains, decide whether each one gets its own instance or its own clearly separated site, and confirm that no report combines them.

No cross-checking with other processing

The analytics data may not be matched against CRM records, customer files, advertising profiles or other datasets. This includes joining visitor IDs to logged-in accounts. Review the integrations and exports that feed your analytics instance, because a single nightly join to a customer table can remove the exemption even when the tracker itself is configured correctly.

Last byte of IP truncated

The collected IP address must have its last byte removed before storage, so that the address cannot single out one device. This is a setting you verify, not assume. Check the IP anonymization option in your Matomo configuration, and check any reverse proxy, CDN or log pipeline in front of the server, since raw IPs can be written to access logs before the application ever sees them.

Tracker lifetime of 13 months

The cookie or identifier used for measurement may last at most 13 months. Longer retention of visitor identifiers breaks the exemption. Set the visitor-ID lifetime explicitly in the tracker configuration and confirm the value with your DPO, since defaults in other tools can be longer.

Features that break the exemption

Matomo's ePrivacy FAQ states that adding User ID, heatmaps or session recordings removes the exemption. Once any of these is enabled, the banner and consent flow apply to that tracking. Decide before rollout whether your team needs those features, because the Heatmap and Session Recording plugin is a separate paid product and not part of the free core.

Exemption covers the tracker only

The consent exemption applies to the tracker's storage and reading of data on the device. It does not remove the other obligations on the processing, such as a lawful basis, transparency to visitors, retention limits, security and rules on transfers outside the EU. Your privacy notice and any hosting or support provider still need to be assessed separately.

Where GA4 and other large offerings fall outside the exemption

The most important point for this section is that CNIL does not treat the consent exemption as something a configuration can unlock for large audience measurement offerings. CNIL's analytics guidance says that most large audience measurement offerings fall outside the exemption regardless of how they are set up. For a team running Google Analytics 4, that means the practical answer is a consent flow for the tag, not a settings change inside the property. Before deciding, confirm the current CNIL position on the specific product and version you run, and check it against the conditions in CNIL sheet 16, since the guidance is the reference point your data protection officer will use.

Many teams are now reviewing their analytics setup for reasons that have little to do with consent. Google states that standard Universal Analytics properties stopped processing data on July 1, 2023, and that access to Universal Analytics data, the interface and the API ended the week of July 1, 2024, after which unexported data was permanently deleted. That history is useful context: it is a reason to inventory which tags, properties and exports your organization depends on, and to record who approved each one. It does not change the consent analysis for GA4 itself, so treat the migration timeline and the consent decision as separate workstreams with separate owners.

A practical check is to list every GA4 tag on each site and app, the events and parameters each one sends, and whether any of them are used for advertising or cross-site profiling. Then ask your legal and privacy team to confirm, in writing, whether the GA4 deployment needs a consent banner under the rules that apply to your organization. If the answer is yes, the options are to keep the banner and its consent management tooling, or to move audience measurement to a self-hosted tool such as Matomo configured to the exemption conditions. Either path should be documented before the next release, so that the consent record matches what the tags actually do.

Which self-hosted options can meet the exemption conditions

This table compares the four self-hosted options most often considered for consent-exempt analytics against the conditions in CNIL sheet 16. Read each row as a question to confirm in your own configuration, because the exemption depends on how a tool is set up, not only on its license. Matomo On-Premise is the option CNIL guidance names, but any premium plugin or extra feature can remove the exemption.

Option	License and cost	Fit with the exemption conditions	Trade-offs and what to confirm
Matomo On-Premise	GPLv3 core, free to self-host; premium plugins are paid	Named in CNIL guidance as configurable by the publisher; configure for audience measurement only, truncated IP and a tracker lifetime of at most 13 months	Heatmap and Session Recording plugin is paid and removes the exemption; Google Analytics Importer brings only aggregated data, so Visitor Log and segments will not cover imported history
Plausible Community Edition	AGPLv3, free to self-host; operator carries upgrades, backups and security patches	Designed without cookies, but CNIL exemption status must be confirmed against sheet 16 for your specific purposes and configuration	Cloud-only features such as funnels, user journeys and revenue goals are absent; security fixes arrive only when the operator applies a release
Umami	MIT license, free to self-host	Cookieless by design; confirm each condition in sheet 16, including purpose limits and IP handling, for your deployment	Reporting depth is narrower than Matomo for larger marketing teams; confirm the retention and lifetime settings you need
PostHog (self-hosted)	MIT except the ee directory, which needs a paid license for premium features	Session replay and heatmaps fall outside the exemption, and product analytics scope usually goes beyond audience measurement	Use only for consent-exempt measurement if features are restricted to the exempt purposes; otherwise a consent flow is required

How Matomo is configured to meet CNIL conditions

The CNIL conditions require the last byte of the IP address to be truncated before the analytics data is stored or used. In Matomo, IP anonymization is set in the privacy settings of the instance and must apply to every tracked site. Check that the setting covers all sites, including staging or secondary domains that send data to the same instance, and that no tracker sends a full address through another route.

Last-byte truncation: Enable IP anonymization with the last byte masked on every site, not only the main production domain.
Tracker parameters: Check whether your tag or JavaScript configuration passes an explicit IP value that could override the server setting.
Web server logs: Web server access logs still record full IP addresses. Document their retention separately, because the exemption concerns the analytics data itself.
Test before launch: Send a visit from a known address and confirm that the stored visit shows the truncated value.

Confirm the exact anonymization options against the current CNIL sheet and your Matomo version before you rely on them.

Deploying a consent-exempt Matomo in your own infrastructure

This sequence takes a Matomo instance from a legal purpose decision to a documented, tested configuration that stays inside the limits of the CNIL exemption for audience measurement.

Confirm the processing purpose with counsel
Your legal or privacy team, with the DPO if you have one, confirms in writing that the analytics purpose is limited to audience measurement or A/B testing and excludes marketing measurement and cross-checking with other processing. This is the decision the rest of the configuration depends on. Ask counsel to check the CNIL sheet n°16 conditions against your intended use. You know this step is done when the purpose statement is signed off and stored with your records of processing.
Size the server for expected pageviews
Your infrastructure or platform team estimates monthly pageviews from current analytics data and matches them to Matomo's sizing guidance. Matomo's requirements FAQ lists a single server with at least 4 CPUs, 8 GB of RAM and 250 GB of SSD for up to 1 million pageviews a month, and recommends separate app and database servers with 8 CPUs and 16 GB of RAM each for up to 10 million pageviews a month. Confirm the figures against the current FAQ before you order hardware or instances. You know this step is done when a sizing note records the pageview estimate and the chosen topology.
Install Matomo on supported runtimes
Your platform team installs Matomo in your own cloud account, data center or private network, behind a supported web server such as Apache or Nginx. Matomo 6.0.0 needs PHP 8.1 or newer and MySQL 8.0 or newer or MariaDB 10.6 or newer. Matomo 6.0.0 is currently in beta, so for production choose the stable 5.x line and confirm its runtime requirements on the requirements FAQ. You know this step is done when the admin login works, the database is reachable only from the app tier, and the version is recorded.
Apply the CNIL-aligned configuration
Your Matomo administrator sets the site to the CNIL conditions: truncate the last byte of the IP address, set the tracker cookie lifetime to 13 months or less, keep the scope to one publisher site, and avoid combining the data with other processing. Document each setting with the exact value used. Matomo's ePrivacy guidance describes the CNIL configuration as the reference point for these settings. You know this step is done when a settings export or screenshot record shows each value, and the change log names the person who applied it.
Disable features that break the exemption
Your administrator turns off features that remove the exemption, including User ID tracking, heatmaps and session recordings. Heatmaps and session recording are sold as a paid premium plugin under the InnoCraft EULA, so confirm they are not installed or enabled. Review enabled plugins and tracking code for any other custom dimensions that would add identifiers. You know this step is done when a plugin inventory shows no excluded features and the tracker code contains no User ID calls.
Validate tracker behavior on a test site
Your QA or platform engineer creates a separate Matomo test site, loads it in a browser with the tracker, and inspects the outgoing requests and cookies with developer tools. Check that IP handling, cookie lifetime and absence of cross-site identifiers match the documented settings. Repeat the check after each Matomo upgrade. You know this step is done when a dated test record shows the observed requests, cookies and IP values against each documented setting.
Document the configuration and cutover
Your team writes a configuration record that lists the purpose, server sizing, Matomo version, runtime versions, CNIL settings, disabled features and test results, then gives it to legal for review. Ask your auditors or certification bodies what evidence they expect, since DeployOpen prepares this evidence but does not issue assessments. Plan the upgrade path from the stable line, and schedule reviews when Matomo releases changes. You know this step is done when legal has approved the record and it is stored where your compliance team can retrieve it.

Why hosting location still matters for EU analytics

Self-hosting moves analytics data into your own infrastructure, but where that infrastructure runs, and who can reach it, still determines whether a transfer or third-country access issue arises. The four risks below are the ones EU teams most often ask about before deciding whether a consent exemption is worth pursuing.

Adequacy covers listed companies only

The Commission's adequacy decision 2023/1795 for the EU-US Data Privacy Framework finds adequate protection only for US organizations on the Data Privacy Framework List, not for every US company or every US-hosted service. An appeal against the General Court's September 2025 judgment is pending as Case C-703/25 P. Before relying on the framework for any analytics vendor, check whether that vendor is listed and whether the appeal changes the position. Ask your legal counsel to confirm the current status.

Remote access counts as a transfer

EDPB Guidelines 05/2021 treat remote access from a third country as a transfer, even when a person only views data on a screen for support or administration. Storage in a cloud outside the EEA also counts. If an offshore support engineer or an external administrator can open your analytics database, that access must be assessed under Chapter V of the GDPR. Map every administrative path, not just where the data is stored.

CLOUD Act reaches US providers

The CLOUD Act provision at 18 U.S.C. 2713, added on 23 March 2018, requires US electronic communication and remote computing service providers to preserve or disclose data in their possession, custody or control, wherever that data is located. An EU region of a US cloud or a US-owned managed service can therefore still fall within reach. Check who controls the hosting account and its keys, and whether your provider has a documented process for handling such requests.

Third-country orders need a treaty

GDPR Article 48 allows a third-country court judgment or administrative decision requiring disclosure of personal data to be recognized or enforced only when it rests on an international agreement, such as a mutual legal assistance treaty, in force with the Union or a Member State. A foreign order alone does not make disclosure lawful in the EU. This limits enforcement, but it does not remove the provider's own obligations, so a contract should say how requests are handled. Confirm the position with counsel for your sector.

Questions buyers ask about consent-exempt analytics

Can Google Analytics 4 be configured so it does not need a consent banner?

No, not according to CNIL. Its analytics guidance states that most large audience measurement offerings fall outside the consent exemption regardless of how they are configured, and GA4 is one of the offerings it has in mind. The exemption depends on the tool meeting CNIL's conditions, such as limiting purposes to audience measurement and A/B testing, keeping a single publisher scope, truncating the last byte of the IP address and keeping tracker lifetime at 13 months or less. Confirm the current CNIL position and your own legal reading before you drop a banner.

What does it cost to self-host Matomo for consent-exempt analytics?

The Matomo On-Premise Community edition is free to download and use under the GPLv3, so the license itself carries no cost. The spend sits in the components around it: servers sized to your monthly pageviews, the database, backups, monitoring, the initial configuration of the exemption settings, and the people who upgrade and maintain it. Matomo's requirements FAQ sizes a single server with at least 4 CPUs, 8 GB of RAM and 250 GB of SSD for up to 1 million pageviews a month. Paid plugins such as the Heatmap and Session Recording plugin fall outside the exemption and carry their own license. Ask any implementation partner for a fixed-scope quote that lists each component separately.

How long does it take to set up consent-exempt Matomo?

The duration depends on the scope you agree in writing, so no fixed figure applies. The main variables are how many sites and subdomains you run, whether a Tag Manager is in use, how many events and goals you need, whether you import historical Google Analytics data, and how quickly your legal team confirms the configuration. Infrastructure provisioning, hardening and the documented exemption settings are separate work items, and each should appear as a deliverable in the scope. Ask for a timeline tied to those deliverables and to the sign-off steps on your side.

Do Italy, the Netherlands and Spain follow the CNIL approach?

Matomo's ePrivacy FAQ names France, Italy, the Netherlands and Spain as authorities that exempt certain privacy-focused analytics from consent when their criteria are met, and it suggests following the CNIL configuration for Italy, the Netherlands and Spain. That is the vendor's reading, not a regulator's statement for your case. Each national authority sets its own criteria, and they can change, so have local counsel confirm the rules that apply to each country where your visitors are located before you rely on the exemption outside France.

What features break the consent exemption in Matomo?

Several common features move analytics outside the exemption. According to Matomo's ePrivacy FAQ, adding User ID, heatmaps or session recordings removes the exemption, and so does any use for marketing measurement or any cross-checking with other processing. Your configuration must also keep the IP truncation and the tracker lifetime within CNIL's conditions. Review every plugin, tag and custom dimension before go-live, because one added feature can change the legal position of the whole setup. Record the configuration as evidence so a reviewer can see what was enabled and why.

Does self-hosting remove the need for a legal review?

No. Self-hosting keeps analytics data on servers you control, but it does not decide whether a consent banner is required. That decision rests on the purposes you pursue, the data you collect and the conditions your regulator sets. Matomo's configuration can meet those conditions, yet your privacy or legal team still has to confirm the purposes, the retention period and the scope of the processing. DeployOpen prepares systems, controls and evidence for compliance assessments, but it does not issue audit reports, attestations or certifications, and independent auditors or certification bodies do that work.

What does my team need to provide for a consent-exempt Matomo project?

Four inputs carry most of the weight. First, written legal sign-off on the purposes and the exemption conditions. Second, access to the target cloud account, data center or network, along with the DNS, TLS and tag management details the deployment needs. Third, a named owner for upgrades, security fixes and backups, because the Community edition depends on the operator applying each release. Fourth, a decision on which features stay disabled. Ask the implementation partner to list these inputs in the written scope so that responsibilities are clear from the first day.

Can my own team run a consent-exempt Matomo setup without outside help?

Possibly, if your team already operates PHP and MySQL or MariaDB services, keeps a patch schedule, and has someone who can read the CNIL conditions and test the configuration. Matomo 6.0.0 needs PHP 8.1 or newer and MySQL 8.0 or newer or MariaDB 10.6 or newer, so confirm which version you will run. The harder part is ongoing: upgrades, backups, capacity planning and evidence records continue after go-live. Many teams weigh an in-house build against a fixed-scope engagement plus a retainer for upgrades and support, and compare the internal hours with the written quote.

How DeployOpen works on this

DeployOpen plans, implements, configures and documents self-hosted open-source analytics inside your own cloud account, data center or air-gapped network. For a consent-exempt setup, the work centers on configuring Matomo to the CNIL conditions, proving the configuration in writing, and keeping features that break the exemption out of the production site.

How we scope

Written scope lists the sites, the single publisher domain, and each measurement purpose before any configuration begins.
We map each planned feature, such as User ID, heatmaps or session recordings, against the CNIL exemption conditions and flag any that remove it.
Engagements are fixed-scope, with deliverables and timelines agreed in writing. Ongoing support is available as a retainer.

How we build

We install Matomo On-Premise in your environment and configure IP truncation of the last byte and a tracker lifetime of at most 13 months.
We disable cross-checking with other processing and confirm that the tracker runs only for audience measurement and A/B testing.
We test the deployed configuration against the CNIL conditions and record the results, so the evidence matches what is live on the site.

How we hand over

You receive written documentation of the configuration, the exemption checklist, and the data flows from browser to your Matomo server.
We document which Google Analytics features are not carried over, such as the Visitor Log and segmentation on imported history, so stakeholders know what changes.
Runbooks cover upgrades, backups and the process for reviewing any new feature request against the exemption before it ships.

How we support

Retainers cover upgrades to new Matomo releases, which we test against the consent configuration before rollout.
We re-run the exemption checks after any tag manager, script or plugin change so the consent position stays current.
DeployOpen prepares systems and evidence for compliance assessments, while independent auditors and regulators make the final judgment.

Google Analytics alternative that can run without a consent banner