This guide explains the privacy implications of tracking your visitors’ web analytics data, and how Matomo (Piwik) can easily be configured to ensure that your users’ privacy is respected.

Matomo (Piwik) ensures the privacy of your users and analytics data. When using Matomo, YOU keep control of your data, nobody else does. Your data is stored in your own MySQL database, and logs or report data will never be sent to other servers by Matomo. Learn more about Privacy.

To ensure further security, after you have installed Matomo (Piwik), we recommend that you:

  1. make your Matomo (Piwik) server more secure by undertaking a few extra security checks
  2. follow the guide below to enable important Privacy features

By design, Matomo (Piwik) ensures that your analytics data is only accessible to the Matomo administrator, meaning it is completely secure. This guide will explain how to easily make your favourite web analytics tool “privacy compliant”. Firstly, you will need to log in as Super User and click on Administration > Privacy.

Step 1) Automatically Anonymize Visitor IPs

By default, IP Anonymisation is enabled in Matomo (Piwik). This means Matomo stores in the database each new visitor IP address (ipv4 or ipv6 format) with the last components removed to protect user’s privacy. IP anonymisation is a good way to protect users with static IP address as otherwise their browsing history would be easily tracked across several days and even across websites tracked within the same Matomo server.

To ensure that you do not store the visitor IP, which is Personally Identifiable Information (PII), please go to Administration > Privacy to enable IP anonymization, and check you have 2 bytes or 3 bytes masked from the IP address.

Step 2) Delete Old Visitors Logs

You can configure Matomo (Piwik) to automatically delete your older logs from the database. For privacy reasons, we highly recommend that you keep the detailed Matomo logs for only 3 to 6 months and delete older log data.

Deleting old logs also has one other important advantage: it will free significant database space, which will, in turn, slightly increase performance!

If you run the automatic script as explained in the FAQ, it is safe to delete your old log data and still access all historical reports in Matomo (Piwik).

Step 3) Include a Web Analytics Opt-Out Feature on Your Site (Using an iFrame)

On your website, in your existing privacy policy page or in the ‘Legal’ page, you can actually add a way for your visitors to “opt-out” of being tracked by your Matomo (Piwik) server. By default, all of your website visitors are tracked, but if they opt-out by clicking on the iframe link, a cookie ‘piwik_ignore’ will be set. All visitors with a piwik_ignore cookie will not be tracked.

In Administration > Privacy, you will be able to copy and paste the following Iframe code:

You can make the opt-out iframe look great on your website by customising the fonts and colors. You will also be able to customise the Opt-out iframe text color, background color, font size, and font family.

Here below is the example iframe for this website. You can opt out from being tracked on demo.matomo.org:

Step 4) Respect DoNotTrack preference

Do Not Track is a technology and policy proposal that enables users to opt out of tracking by websites they do not visit, including analytics services, advertising networks, and social platforms. By default, Matomo (Piwik) respects users preference and will not track visitors which have specified “I do not want to be tracked” in their web browsers. For more information about DoNotTrack, check out donottrack.us.

Step 5) Create a Privacy Policy page on your website(s)

A privacy policy is a statement or a legal document that discloses some or all of the ways a party gathers, uses, discloses, and manages a customer or client’s data. It fulfills a legal requirement to protect a customer or client’s privacy.

When you use Matomo (Piwik) to track your visitors, we recommend to update your Privacy Policy to explain how Matomo is used and what data it gathers. We provide a Privacy Policy template here for Matomo users that you can copy on your site.

Step 6) Optional Privacy Preferences

  • As the Matomo (Piwik) administrator, you may decide that giving access to real time & visitor log features are not necessary for your Matomo users. In this case, you can disable the Live plugin in Administration > Plugins.
  • If you track a number of websites with the same Matomo (Piwik) server, all your websites’ code will contain the Matomo server URL in the Javascript code. To prevent other users from finding out all your websites, you can Hide the Matomo Server URL in your JavaScript using this technique (FAQ)
  • Some countries legislation require websites to control which cookies they set based on user preferences. You can easily disable all Matomo (Piwik) Cookies for a particular visitors or for all visitors by calling a Javascript function in the Matomo code, see the FAQ: How do I disable tracking cookies?.

For reference the list of metadata and data points and collected by Matomo (Piwik) is documented here.

Any questions?

Many answers and more information about Matomo you can find here:

We are social

Follow us: