Matomo vs Plausible cookie consent and GDPR

Matomo can run without a consent banner only if the install stays inside the narrow scope that French and some other EU authorities accept. France's CNIL recognizes certain audience measurement trackers as exempt from consent when they are limited to purposes such as performance measurement, collect only anonymous statistics and exclude marketing measurement. Matomo's own ePrivacy FAQ names France, Italy, the Netherlands and Spain as authorities that exempt certain privacy-focused analytics when their criteria are met, and it suggests following the CNIL configuration for Italy, the Netherlands and Spain. Treat that suggestion as a starting point for your legal review, not as a determination by those regulators. Confirm with counsel whether each country where you have visitors accepts the CNIL configuration, and record the decision, the settings used and the date you last checked the rules.

Two features remove the exemption entirely: User ID and the heatmap and session recording tools. Matomo's FAQ states that adding User ID, heatmaps or session recordings takes the tracker outside the exemption, so a team that turns on any of them must plan for a consent mechanism on those pages. The Heatmap and Session Recording plugin is a paid premium plugin sold per number of users under the InnoCraft EULA rather than under the GPL, and it comes with a 30-day free trial according to its marketplace listing. Because that plugin is the most common reason an otherwise compliant install loses its exemption, make the decision on it a formal change: a named owner, a privacy review and a written sign-off before anyone installs it on a production site.

Plan the settings review as a control, not a one-time setup. On a self-hosted Matomo, the exemption depends on the tracking code, the consent-related settings and any plugin enabled on the site, so each change should be checked against the CNIL criteria before release. Ask whether any tag manager, custom dimension or ecommerce tracking sends identifiers that would count as User ID, and confirm with your privacy team how Matomo's tracking settings should be configured for each jurisdiction in scope. Keeping a dated record of this review also helps when a regulator or auditor asks how the exemption was justified.

Self-hosting moves the transfer question onto your own infrastructure. When you run Matomo or Plausible Community Edition in your own cloud account or data center, the personal data sits where you put it, and the Chapter V question becomes a question about where the server physically runs and who can reach it remotely. The EDPB's Guidelines 05/2021 (version 2.0) are explicit that remote access from a third country counts as a transfer even when someone only views data on a screen for support or administration, and that storage in a cloud outside the EEA does too. Map every administrator, vendor engineer and backup location to a country before you assume a self-hosted install stays inside the EEA. Your implementation partner's remote support sessions and any offsite backup target belong in that map.

Hosted options change the picture without removing it. Matomo Cloud stores data in Frankfurt, Germany, and Plausible says its service is made and hosted in the EU. Those facts answer where data rests, not who can reach it. Ask each vendor, in writing, which legal entity operates the service, where its support staff work, whether any sub-processor sits outside the EEA, and how it handles access requests. A non-EU operator, a non-EU sub-processor or support access from a third country can each create a transfer even when the data center is in Europe.

Some third-country laws deserve an exposure assessment, not a conclusion about either vendor. The US CLOUD Act (18 U.S.C. 2713) can reach data in a provider's possession, custody or control wherever it is stored, and GDPR Article 48 limits recognition of foreign disclosure orders to those based on an international agreement in force. Under EDPB Recommendations 01/2020, if a provider must access data in the clear and the destination's authority powers exceed what is necessary and proportionate, no effective technical supplementary measure may exist. Document the question, ask each vendor whether it has received such requests and how it responds, and record your decision with your data protection officer. Self-hosting shifts much of this control to you, but it does not remove the need to document it.

Consent should decide the choice only when the site needs basic traffic metrics and nothing else. If the goal is pageviews, referrers and top pages, and the team will not add marketing measurement, heatmaps or session recordings, both platforms can run without a cookie banner for that purpose. Matomo's exemption depends on configuration. Its ePrivacy FAQ says the CNIL recognizes some audience measurement trackers as exempt when they are limited to performance measurement, collect only anonymous statistics and exclude marketing measurement. Plausible's position is simpler: its homepage says it uses no cookies, so no cookie banner is required. Your legal team still has to confirm the reading for each jurisdiction where you operate.

The decision changes once marketing or behavioral features enter the plan. Matomo's FAQ states that adding User ID, heatmaps or session recordings removes the CNIL exemption, so a site that later enables the Heatmap and Session Recording plugin must treat itself as needing consent again. Plausible's Community Edition has no heatmaps or session recording to add, but it also lacks marketing funnels and user journeys, so a team that needs those will look elsewhere regardless of consent. Check each feature against the consent rules before you turn it on, and record that check as part of your change process.

Before you commit, confirm three things with your privacy counsel and your own configuration: which EU authority applies to your visitors, whether your Matomo settings match the exemption criteria that authority publishes, and whether any tag, plugin or import in your stack sets cookies or stores identifiers that the exemption does not cover. Matomo's ePrivacy FAQ names France, Italy, the Netherlands and Spain and suggests following the CNIL configuration for the last three, which is a starting point, not a legal opinion. Self-hosting does not change the cookie analysis by itself, but it does put you in control of the settings, so the configuration review is yours to own.