Privacy-friendly website analytics without a cookie banner

Most websites want to know how many people visit, where they come from and which pages work. Since the GDPR, doing that with Google Analytics means a cookie banner, consent management and sending visitor data to a US company. This article describes how we do it instead: self-hosted Matomo, configured so that no consent popup is needed. These are the settings we use on our own sites and on sites we host for customers.

Why a cookie banner is usually avoidable

The GDPR and the Dutch Telecommunicatiewet only require consent for cookies and tracking that are not strictly necessary and that can identify a person. Functional cookies and session cookies are allowed without asking. Analytics is allowed without consent when it has a low impact on privacy: the data is anonymised, it stays with you, and it is not shared or combined with other data. The Dutch Autoriteit Persoonsgegevens describes these conditions for privacy-friendly analytics. Matomo can be configured to meet them; Google Analytics cannot, because the data is processed by Google.

Even without a banner, you still need a cookie statement on the site that explains which cookies exist and why. See our own cookie policy as an example.

Configure Matomo for consent-free analytics

Matomo is open source and runs on your own server. That alone solves the biggest problem: the data never leaves your organisation. On top of that, set the following options in Matomo.

• Anonymise IP addresses. In Administration, Privacy, Anonymize data: mask at least two bytes of the IP address. Also enable anonymising the IP when enriching visits, so geolocation runs on the masked address.
• Do not use user IDs or fingerprinting across days. Leave the User ID feature off unless visitors are logged in and informed. Matomo’s configuration ID is reset daily by default; keep it that way.
• Shorten cookie lifetime, or disable cookies completely. Matomo can run cookieless by adding _paq.push(['disableCookies']); before trackPageView in the tracking code. You lose returning-visitor accuracy, but you also lose any cookie discussion.
• Respect Do Not Track, which Matomo enables by default.
• Delete old raw data. In Privacy, Anonymize data, set raw visitor logs to be deleted after a few months. Aggregated reports stay available.
• Host in the EU. We run Matomo on servers in the Netherlands. Check where your hosting provider stores backups too.

With these settings Matomo does not process personal data in a way that needs consent, and you can drop the banner.

Other things on a website that set cookies

Analytics is rarely the only third party on a page. Check these as well.

• Embedded YouTube videos. Embed from www.youtube-nocookie.com instead of www.youtube.com.
• Social sharing buttons. Use plain links to the share URLs of each network instead of their JavaScript widgets. Widgets and share counters set cookies before the visitor clicks anything.
• Fonts, maps and chat widgets. Loading fonts from Google, embedding Google Maps or adding a chat widget sends the visitor’s IP address to that party. Self-host fonts where you can, and mention the rest in your privacy statement.
• Forms. Only ask what you need, and say in the form what you do with the data.

Privacy by design

Privacy by design and privacy by default sound abstract, but in practice they follow from normal engineering discipline: collect the minimum, keep data close to where it is used, delete what you no longer need, and be able to explain every field you store. If you can list every cookie and every external request your site makes, you are most of the way there.

Want help setting up privacy-friendly analytics or dashboards on your own infrastructure? Have a look at our digital independence page or get in touch via info@squins.com.