How to run consent-exempt analytics under CNIL rules
If you run a French or EU website and want to drop the consent banner for audience measurement, the honest answer is this: the exemption covers only narrowly scoped, anonymous statistics collected by a tool you host yourself, and any added feature can remove it. Matomo's ePrivacy FAQ describes the criteria France's CNIL applies: the tracker is limited to purposes such as performance measurement, collects only anonymous statistics, and excludes marketing measurement. The same FAQ names Italy, the Netherlands and Spain as authorities that apply comparable exemptions when their criteria are met, and suggests following the CNIL configuration in those countries. Treat that as a starting point for your own legal review, not as a guarantee that every regulator will accept your setup.
The exemption does not switch off the GDPR. Regulation (EU) 2016/679 still governs any personal data your analytics processes, including the security of the server under Article 32 and your duties as controller, and the ePrivacy rules on storing information on a visitor's device still apply to the tracker itself. The exemption is a regulator position with stated conditions, not a certificate, and the GDPR requires no certificate or attestation for this kind of processing. DeployOpen can prepare the configuration, the written settings baseline, the test evidence and the change records that show how the tool is set up. It does not issue attestations or confirm to a regulator that your setup qualifies. Your legal team, and where needed your data protection authority, makes that call.
Practical decisions come first. Confirm which Matomo edition and plugins you run, because the Heatmap and Session Recording plugin is a separate paid product that the CNIL criteria exclude. Decide whether User ID, custom dimensions carrying identifiers, or cross-site tracking are in scope, and remove them if they are. Confirm IP anonymization, retention periods and the list of pages excluded from collection, such as account and form pages. Keep a dated record of each setting and who approved it, and re-check the configuration after each Matomo upgrade, since Matomo 6.0.0 is still in beta and its defaults should be reviewed before you adopt it. Confirm the current CNIL criteria directly with the regulator before you finalize the setup.
Which CNIL exemption conditions the analytics setup must meet
This table maps each condition in the CNIL audience measurement exemption to what the analytics function must do and how to set it up in Matomo. Read each row as a design requirement, then confirm the current CNIL criteria directly with the CNIL before relying on the configuration.
| Condition | What the setup must do | How to configure it in Matomo |
|---|---|---|
| Purpose limited to performance measurement | Use the data only to measure site performance, such as page popularity and navigation, and never to build advertising profiles or retarget visitors. | Keep the site to standard reports and do not connect advertising or retargeting tags. Document the purpose in the processing record. |
| Anonymous statistics only | Collect aggregate counts that cannot be tied back to an individual visitor, consistent with the data minimization principle in GDPR Article 5. | Anonymize IP addresses, shorten or drop visitor identifiers according to the CNIL criteria, and review the tracking code for any personal identifiers. |
| No marketing measurement | Do not use the data to measure advertising campaigns, cross-site behavior or marketing audiences. | Disable campaign attribution features used for ad targeting and do not share raw data with ad networks or tag managers. |
| No User ID tracking | Do not link visits to a logged-in identity. Per Matomo's ePrivacy FAQ, adding User ID removes the exemption. | Leave the User ID feature disabled in the tracking code and in any site-level settings. |
| No heatmaps or session recording | Do not record individual mouse movements, clicks or sessions, since Matomo's ePrivacy FAQ states these features remove the exemption. | Do not install the Heatmap and Session Recording plugin, which is a paid premium plugin, on sites that rely on the exemption. |
| Security of the analytics server | Protect the collected data with access control and hardening, in line with the security of processing expectation in GDPR Article 32, and restrict who can export raw logs. | Limit administrator accounts, enforce strong authentication, keep the platform patched and document the hosting location and access review. |
| Lawful basis and national confirmation | Confirm that the exemption applies to your country and configuration, since Matomo's FAQ notes that France, Italy, the Netherlands and Spain each apply their own criteria under GDPR Article 6 principles. | Ask the CNIL or your data protection authority to confirm the current criteria, and keep the written confirmation and configuration evidence with the processing record. |
Which self-hosted platforms can meet the exemption criteria
Only some analytics platforms can be set up to fit the CNIL exemption, and the fit depends on configuration as much as on the product. The cards below cover the platform most often cited for this exemption, the alternatives a team must test itself, and the features that remove the exemption once switched on.
Matomo On-Premise Community
Matomo's own ePrivacy FAQ names the CNIL exemption for certain privacy-focused analytics, which makes it the platform with a documented starting point. The On-Premise Community edition is GPLv3 licensed and free to run on your own servers. Matomo 5.14.1 is the latest stable release, and Matomo 6.0.0 is in beta, so pin your version and confirm which release your configuration was tested against. Confirm that the exemption criteria still apply after each upgrade.
Heatmap and session recording add-on
The Heatmap and Session Recording plugin is a paid premium add-on sold per number of users under the InnoCraft EULA, not the GPL. Matomo's FAQ states that heatmaps and session recordings remove the exemption. Enabling it on a site that relies on the exemption means that site needs a consent mechanism. Keep it out of the exempt configuration, and check procurement records so no one installs it without a privacy review.
Plausible and its own configuration
Plausible is a privacy-oriented alternative that a team must evaluate against the CNIL criteria itself, since the supplied sources do not cover its position under the exemption. Check how it collects data by default, whether it stores identifiers, whether its cookie and retention settings can be switched off, and whether its optional features add data points. Ask the vendor or the CNIL for written confirmation before relying on it.
Umami and its own configuration
Umami is another lightweight option that needs the same independent check. Verify what the tracking script sends, whether any session or user identifier is created, how IP addresses are handled, and whether a feature such as event data or custom properties adds information beyond anonymous page statistics. Document the result per site so an auditor can trace the decision.
Confirm behavior in your own setup
Default behavior can change between versions, plugins and hosting setups, so a platform that qualifies in a vendor demo may not qualify on your site. Test the live tracking request in a browser with developer tools, review cookies and local storage, and confirm that no User ID or external script is loaded. Record the test results with the version and configuration, and repeat the test after every upgrade.
Confirm exemption status with the regulator
Exemption criteria belong to national authorities, and Matomo's FAQ notes that France, Italy, the Netherlands and Spain each apply their own rules, with the CNIL configuration suggested for Italy, the Netherlands and Spain. Ask counsel to confirm which national criteria apply to each audience. Keep records of the configuration you relied on, since the GDPR does not issue certificates for this purpose.
Why User ID, heatmaps and session recording remove the exemption
The exemption depends on what the tracker collects, so each feature that records more than anonymous, aggregate statistics moves the setup outside the stated purpose. Matomo's ePrivacy FAQ states that adding User ID, heatmaps or session recordings removes the exemption. User ID attaches a stable identifier you assign, such as an account number, so visits can be linked to a known person across sessions and devices. Heatmaps record where visitors move the cursor, click or scroll on individual pages, which is behavioral detail rather than a count. Session recording replays a visitor's interactions, and unless inputs are masked it can capture form content. None of these is automatically unlawful. They simply fall outside the anonymous measurement the CNIL exemption describes, so they need a consent basis or a separate tool with its own assessment.
Audit for these features in three places, not only in the analytics console. First, review the Matomo configuration for any User ID setting, the Heatmap and Session Recording plugin and any custom dimensions that carry account or profile data. Second, inspect the tag manager containers and the site's own JavaScript for tracking snippets, identifier variables and replay scripts that may have been added for a marketing or product team. Third, check the Google Analytics Importer. Matomo's documentation says it imports only aggregated report data, not raw visit and action data, so it is not a route for raw visitor records, but imported reports still sit in the same Matomo site and should be covered by the same review. Record the results in a dated configuration baseline and repeat the check after every release, because a single container change can reintroduce a removed feature.
What a regulator or auditor asks to see for the exemption
This table lists the evidence a team should hold to show that its analytics stays within the exempt purposes, and which system produces each item. Read it as a pre-inspection checklist: if a row has no owner or no stored copy, the exemption is hard to defend. DeployOpen prepares this evidence for assessment, but independent reviewers and the relevant authority make any determination.
| Evidence item | Produced by | What it must show | Common gap |
|---|---|---|---|
| Written purpose statement | Team documentation in the approved governance repository | Measurement limited to audience performance, with no advertising, retargeting or cross-site profiling | Purpose written generically as web analytics, with no statement excluding marketing use |
| Configuration export and settings screenshots | Matomo administration settings, exported and dated | Anonymous statistics only, with the exemption-relevant options set as documented | Screenshots taken from a test instance or undated images |
| Enabled plugins and licenses | Matomo plugin manager and the server's installed plugin list | No premium or session-recording plugins that would remove the exemption, each plugin with its license | Heatmap or session recording plugin installed for a single campaign and left enabled |
| IP anonymization and retention settings | Matomo privacy settings and scheduled data purge configuration | IP masking level and retention period match the written configuration | Settings changed in the admin panel without updating the documentation |
| Tag inventory from the site | Tag manager container export and a crawl of production pages | Only the analytics tag is present, with no User ID, identity fields or third-party marketing tags | Old tags left in templates or added by a marketing team outside the tag manager |
| Configuration change log | Deployment repository history and Matomo admin change records | Who changed what, when, and under which approval, for every setting covered above | Changes made directly in production with no commit or ticket reference |
| Web server and access logs | Reverse proxy or web server on the analytics host | Analytics endpoint is reachable only as configured, and access to the admin area is restricted | Admin interface exposed without an access control layer |
How to configure Matomo inside the CNIL exemption
This sequence moves a Matomo deployment from an open question to a documented setup that matches the purposes, data limits and feature restrictions the CNIL exemption depends on. It produces evidence that legal, security and engineering can review together. It does not by itself guarantee that a regulator will accept the setup as exempt.
Confirm the measurement purposes with legal
Legal counsel or the data protection officer writes down the purposes the analytics will serve, such as measuring site performance and audience volume, and records that marketing measurement and advertising profiling are excluded. Engineering uses this written scope as the input for every later setting. The step is done when the signed purpose statement names each permitted use and each excluded use, and the team has confirmed that the CNIL criteria are the basis for the assessment rather than an assumption.
Install Matomo on infrastructure you control
The platform engineering team installs Matomo 5 or 6 on servers in the organization's own cloud account, data center or approved hosting, following the requirements in Matomo's FAQ for PHP, MySQL or MariaDB and the web server. Matomo 6.0.0 is currently in beta according to the changelog, so the team should confirm whether the production target is the latest stable 5.x release or a released 6.x version. The step is done when the instance serves the tracking endpoint from the intended domain and the database sits in the approved region.
Configure anonymous collection and IP handling
The administrator sets Matomo to collect only aggregated audience statistics, disables any tracking of user identifiers, and configures IP anonymization in the privacy settings so that stored addresses cannot identify a visitor. The administrator also reviews every tag and custom dimension to confirm that none carries a persistent identifier or personal data. The step is done when a test visit produces a stored record with the anonymized address and no user identifier, and the configuration export is saved in the change record.
Set retention and cookie behavior
The administrator sets the retention period for raw visit data and archived reports to the value approved in the purpose statement, and confirms the cookie settings used by the tracker. The team checks whether the cookieless or minimal-cookie mode is in use and documents the reasoning for the choice. The step is done when the retention settings match the approved schedule, a scheduled job removes data past that period, and a screenshot or configuration export confirms each value.
Remove features that break the exemption
The team audits the installed plugins and tracking code and removes or disables any feature that CNIL-based guidance associates with ending the exemption, including User ID tracking, heatmaps and session recordings. Matomo's Heatmap and Session Recording plugin is a separately licensed paid add-on, so the team should confirm it is not installed on any tracked site. The step is done when a plugin inventory shows no excluded feature active and the tag manager contains no trigger that loads one.
Document the setup and its evidence
The privacy team writes a configuration record that lists the purposes, the Matomo version, hosting location, anonymization and retention settings, the plugin inventory, and the data flows to any third party. It also records who approved each setting and when. The step is done when the record is stored with the data protection documentation and the team can produce it on request to an auditor or supervisory authority. This record supports accountability but does not itself constitute a regulatory approval.
Review the setup after each Matomo upgrade
Each time a Matomo release is installed, the operations team repeats the plugin inventory, anonymization, retention and tracking-code checks, and compares the results with the documented setup. Upgrades can change defaults or add plugins, so the review must confirm that the settings still match the purpose statement. The step is done when the review record for the new version is signed off and any changes are reflected in the documentation before the upgrade is considered closed.
What tooling alone does not satisfy
A correctly configured Matomo instance can still leave a site outside the exemption, and the configuration only covers one part of the analysis. The cards below cover the parts a tool cannot decide for you: the rest of the page, the legal analysis you still own, differences between regulators, and changes that may arrive in the law.
The rest of the page
The exemption applies to the analytics tool, not to the whole page. Other tags on the same pages, such as advertising pixels, social widgets, embedded video players, chat tools and map embeds, can each set cookies or send data to third parties and trigger consent on their own. Inventory every script and iframe on each template, including tags added by a tag manager or a CMS plugin, and confirm that none of them loads before consent. Tooling covers only the analytics tag.
Lawful basis and records of processing
Being exempt from the consent requirement for the tracker does not settle the wider GDPR position. The controller still has to document the lawful basis for processing personal data through analytics, respond to data subject requests, set retention, and keep records of processing activities under Article 30. Those records describe your purposes, recipients, retention and security measures. Ask your data protection officer or counsel to sign off the analysis for each site, and keep the record with the configuration export.
Different criteria across Member States
Matomo's FAQ names France, Italy, the Netherlands and Spain as authorities that exempt certain privacy-focused analytics when their criteria are met, and suggests following the CNIL configuration for Italy, the Netherlands and Spain. That suggestion is a starting point, not a legal guarantee. Each supervisory authority is independent under Article 51, and an organization serving visitors in several countries should confirm the position in each market before applying one configuration everywhere.
Changes in CNIL position
A regulator's position on exempt analytics is a guidance position that can be revised, and the criteria may be updated after new enforcement or guidance. Record the date you checked the criteria, the Matomo version in use and the configuration in place, then review the setup when the CNIL publishes new guidance or when Matomo changes default settings. Matomo's changelog lists Matomo 5.14.1, released on October 4, 2026, as the latest stable version, so confirm the version your instance runs before you sign off the setup.
Pending EU procedures
Two EU procedures could change the rules that shape this analysis. The Omnibus IV proposal (procedure 2025/0130(COD)) has a text agreed in negotiations and awaits Parliament's first-reading vote, and the Digital Omnibus proposal (procedure 2025/0360(COD)) awaits committee decision. The GDPR text had not been amended as of October 2026. Neither procedure should be treated as settled. Put both on your review calendar and ask counsel what each would change for your analytics setup.
No certification from any tool
No analytics product, including a configuration that follows a regulator's criteria, produces an audit report, attestation or certificate of GDPR compliance. Article 42 certification is voluntary, issued by accredited bodies for up to three years, and does not reduce the controller's responsibility. Treat the Matomo configuration as one control in your evidence file, and ask an independent auditor or certification body what evidence they will expect to see.
Questions buyers ask before setting up consent-exempt analytics
How much effort does a consent-exempt Matomo configuration and its documentation take?
The effort depends on how many sites, tags and features are in scope, and on how much of the current tracking has to be removed before the setup can qualify. The configuration itself is a bounded set of settings: restricting the purposes to audience measurement, turning on anonymous collection, excluding marketing measurement, and confirming that User ID, heatmaps and session recordings are off. The documentation is often the larger share, because the evidence has to show what is collected, why, for how long and by whom. Effort rises with the number of domains, the presence of a tag manager, the number of existing trackers on pages, and whether historical data must be kept or migrated. Ask any provider for a written list of sites, tags and documentation deliverables before accepting a quote.
Can our team configure Matomo alone using its own documentation?
Yes, a capable internal team can configure Matomo using its documentation, and the ePrivacy FAQ explains the CNIL criteria in plain terms. The harder part is not the settings but proving the result. Your team must confirm that no other script, plugin, CDN or embedded widget sends data that falls outside the exemption, and that the configuration still holds after every Matomo upgrade and plugin change. Teams without a privacy engineer or a tester often find that gap later. If you want an outside check of your own setup, DeployOpen can plan and implement self-hosted open-source platforms, and it runs security testing, but it does not issue audit reports or certifications, so the assessment itself stays with independent auditors or your regulator.
What do legal, IT and marketing need to contribute to the project?
Each function owns a different part of the result. Legal or the data protection officer defines the permitted purposes, the retention period and the wording of the privacy notice, and signs off on whether the setup meets the regulator's criteria for your country. IT owns hosting, access control, backups, updates and the list of every script on the site. Marketing owns the tag inventory and must accept that campaign and advertising measurement will run through other tools, not through this one. Without a named decision-maker in each function, the configuration tends to stall at the point where a marketing tag conflicts with the exemption. Agree these responsibilities in writing before the scope is fixed.
How long does a consent-exempt analytics setup take?
Duration depends on scope and cannot be quoted without a written scope. The main variables are the number of sites, the state of the existing tag setup, how many stakeholders must approve the documentation, and whether historical data is being imported. A single site with a clean tag setup and a clear legal position is a very different project from a multi-site estate with a tag manager and several business units. Ask for a timeline in the written fixed-scope proposal, with dependencies such as legal review and access to the website listed separately so that delays can be traced to their cause.
Is the Matomo Community edition enough for exempt analytics?
The Community edition can support a consent-exempt setup, because the exemption depends on how the tracker is configured and what it collects, not on the license tier. Matomo's pricing page describes On-Premise Community as free, with unlimited users and hits and forum support. What changes with paid options is the feature set: the Heatmap and Session Recording plugin is a separate, paid premium plugin, and using it removes the exemption according to Matomo's ePrivacy FAQ. Confirm with the Matomo project and your regulator whether any paid add-on you plan to use affects the criteria. Support terms, such as an agreed response time, are a separate purchase that you should request in writing.
Do Italy, the Netherlands and Spain follow the CNIL criteria?
Matomo's ePrivacy FAQ names France, Italy, the Netherlands and Spain as authorities that exempt certain privacy-focused analytics from consent when their criteria are met, and it suggests following the CNIL configuration for Italy, the Netherlands and Spain. Treat that as a starting point, not a legal opinion. Each authority publishes its own guidance and may set different conditions on purposes, retention or identifiers, so your counsel should check the current text of each national rule against your configuration before you rely on it. The same applies to any other EU or EEA country where your visitors are located. Ask your legal team to record which rule was checked for each country.
What does a fixed-scope quote for this work include?
A written fixed-scope quote defines the sites, the features to be switched off, the configuration steps, the documentation deliverables, the testing performed and the handover. Most engagements at DeployOpen are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts, and DeployOpen does not publish a price list, so the quote follows from that written scope. Ask each provider to state what is one-time, such as configuration and documentation, and what recurs, such as hosting, upgrades, regression checks after each Matomo release and any retainer for ongoing support. Also ask who keeps the evidence file and how it is updated.
How to keep the exemption valid after upgrades and new features
The exemption is a property of the configuration as it runs today, not of the setup you documented last year. Each Matomo release, plugin installation, tag change or new report can alter what is collected, and a single change can move a site from anonymous statistics into territory where consent is required. Treat every upgrade, plugin addition and tracking-tag edit as a change request that triggers a fresh review against the purposes you documented. Check the tracking script, the custom dimensions, the User ID setting, the IP handling and the list of enabled plugins, and confirm that no heatmap, session recording or marketing feature has been switched on, even for a short test. Matomo's own release notes are the starting point for that review, and the Matomo changelog shows the latest stable version and what is in beta, so the team knows which release it is checking against. Note that the exemption criteria come from national regulators, so a change in your version does not settle whether the configuration still meets them.
The evidence pack needs the same discipline. Keep a dated record of the configuration, the purposes statement, the retention settings, the access list for the analytics server and the review log, and update each entry when something changes. Assign one named owner for the exemption and a second person who can run the check if that owner leaves. Confirm with your counsel or data protection officer which regulator guidance applies in each country where you operate, because the ePrivacy position differs by authority and Matomo's FAQ points to the CNIL configuration as the reference for several others. Track the legal calendar as well. Regulation (EU) 2025/2518 on procedural rules for cross-border GDPR enforcement applies from 2 April 2027, and the Omnibus IV and Digital Omnibus proposals still in procedure could change GDPR obligations that your purposes statement relies on. Set a recurring review date, and re-check the configuration whenever one of these dates or proposals moves forward.
How DeployOpen scopes, configures and documents CNIL-aligned analytics
DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside your own infrastructure, including Matomo for analytics. For consent-exempt analytics under CNIL rules, we work from a written scope that fixes the purposes, the data collected and the features switched off, then deliver the configuration and the evidence your team needs to explain it. DeployOpen prepares these controls for review but does not issue audit reports or attestations.
How we scope
- Write down the measurement purposes and confirm they exclude marketing measurement and ad targeting.
- List every collected field and confirm that the setup produces anonymous statistics only.
- Identify features that would remove the exemption, such as User ID, heatmaps and session recording, and mark them out of scope.
How we build
- Configure the Matomo instance in your cloud account, data center or air-gapped network, with no user-level identifiers.
- Test tracking behavior on representative pages to confirm no unintended identifiers or extra data leave the site.
- Document data retention, IP handling and access roles as configured, so each setting can be checked against the written scope.
How we hand over
- Deliver a configuration record that maps each setting to the agreed analytics purposes and the CNIL criteria your team relies on.
- Provide runbooks for the administrators who maintain the tracking configuration after go-live.
- Confirm with your legal and compliance team which regulator guidance applies to each market where you operate.
How we support
- Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
- Ongoing support, upgrades and continuous testing are available as a retainer after handover.
- Re-check the configuration when Matomo releases a new version or when a new feature is proposed for the site.
