How to Add Matomo to Your Cookie Banner: A 3-Step Tutorial for GDPR Compliance

Introduction

*Updated for 2026 compliance practices.*

Integrating Matomo analytics with your cookie consent banner is a critical step for GDPR-compliant tracking. This practical guide explains **how to add Matomo to your cookie banner in a 3-step tutorial**, ensuring that you respect user consent choices while maintaining accurate analytics. We’ll cover the technical implementation, common pitfalls, and how to verify your setup using GDPRChecker’s scanning tools. Remember, this guide provides technical implementation guidance, not legal advice. For official requirements, consult the European Data Protection Board and GDPR.eu.

What Is "How to Add Matomo to Your Cookie Banner: 3-Step Tutorial"?

This topic addresses the process of configuring Matomo (formerly Piwik) to respond to consent signals from your cookie banner. Under GDPR, analytics cookies and similar tracking technologies require prior consent unless they are strictly necessary. Matomo can be set up to track users only after they’ve given consent, or to track anonymously without cookies when consent is denied. The "3-step tutorial" refers to a streamlined approach: (1) configure Matomo’s consent settings, (2) integrate with your consent management platform (CMP), and (3) verify the setup. This ensures that your analytics practices align with the ePrivacy Directive and GDPR.

Why Adding Matomo to Your Cookie Banner Matters for GDPR

Non-compliance with consent requirements can lead to significant fines. The GDPR mandates that websites obtain explicit, informed consent before processing personal data via cookies or trackers. Matomo, when configured correctly, can operate in a privacy-friendly manner, but only if it respects the user’s consent choice. By integrating Matomo with your cookie banner, you ensure that:

• Tracking scripts fire only after consent is given.
• You can implement a "consent-less" tracking mode (e.g., anonymized data) when consent is denied.
• You maintain an audit trail of consent, which is crucial for demonstrating compliance.

For a broader understanding of consent requirements, see our guide on cookie banner requirements.

Step-by-Step: How to Add Matomo to Your Cookie Banner

Step 1: Configure Matomo’s Consent Management

Matomo offers built-in mechanisms to handle user consent. You can choose between two primary approaches:

1. **Tracking Consent**: Matomo waits for explicit consent before setting any tracking cookies or sending data. This is the strictest approach.
2. **Cookie Consent**: Matomo uses cookies but respects the user’s consent choice. If consent is denied, it can fall back to cookie-less tracking (using a random ID that is not stored).

To enable these, add the following to your Matomo tracking code:

```javascript _paq.push(['requireConsent']); // For tracking consent _paq.push(['requireCookieConsent']); // For cookie consent ```

Place this code before the `_paq.push(['trackPageView']);` call. If you use Matomo Tag Manager, you can set these requirements in the container settings.

**Real-world example**: A SaaS company using Matomo for product analytics wants to track feature usage but must comply with GDPR. They enable `requireConsent` so that no data is collected until the user clicks "Accept" on the cookie banner. This ensures that even if the banner is slow to load, no tracking occurs prematurely.

Step 2: Integrate Matomo with Your Consent Banner

Your cookie banner must communicate consent choices to Matomo. This is typically done via JavaScript callbacks when the user interacts with the banner. Most CMPs (Consent Management Platforms) provide an API to listen for consent events. For example:

```javascript // When user gives consent _paq.push(['rememberConsentGiven']); // When user revokes consent _paq.push(['forgetConsentGiven']); ```

If you’re using a custom banner, you’ll need to trigger these functions based on the user’s action. For Google Consent Mode v2 users, note that Matomo is not directly integrated with Google’s consent signals, but you can map consent states manually. Learn more about consent mode in our Google Consent Mode v2 checker guide.

**Edge case**: What if a user previously consented but later revokes? Matomo’s `forgetConsentGiven` will delete any tracking cookies and stop future tracking. However, previously collected data remains in your Matomo database. Ensure your privacy policy discloses this retention.

Step 3: Verify the Integration

After implementation, you must test that Matomo respects consent choices. Use browser developer tools to monitor network requests:

• **Without consent**: No requests to your Matomo endpoint should appear, or they should be anonymized (e.g., no `_pk_id` cookie set).
• **With consent**: Requests should include the full tracking data.

Additionally, use GDPRChecker’s scanner to validate your setup. Our tool checks for pre-consent network requests, banner behavior, and disclosure gaps. Run a scan before and after changes to confirm compliance. For a complete verification workflow, see our implementation checklist below.

Common Mistakes When Adding Matomo to Your Cookie Banner

1. **Forgetting to require consent in Matomo**: Simply adding a banner doesn’t stop Matomo from tracking; you must call `requireConsent` or `requireCookieConsent`.
2. **Not handling consent revocation**: If your banner allows users to change preferences, ensure Matomo is updated accordingly.
3. **Assuming Matomo is exempt from consent**: Even self-hosted Matomo requires consent if you use cookies or collect personal data (e.g., IP addresses).
4. **Misconfiguring tag managers**: If you load Matomo via Google Tag Manager, ensure the consent checks are in place before the tag fires.
5. **Ignoring anonymization settings**: Without consent, Matomo can still track if you enable anonymization features (e.g., masking IPs). Failing to configure this may lead to non-compliance.

For more on avoiding pitfalls with consent management, read our article on do I need a CMP if I do not run Google Ads.

How to Validate Your Setup with GDPRChecker

GDPRChecker’s scanning tools help you verify that your Matomo integration is compliant. Here’s how:

1. **Run a public scan**: Enter your website URL to check for pre-consent network requests. The scanner will flag any requests to Matomo that occur before consent.
2. **Test banner behavior**: Interact with your cookie banner and observe whether Matomo requests are blocked or allowed accordingly.
3. **Review the cookie inventory**: GDPRChecker lists all cookies set by your site, including Matomo’s `_pk_id` and `_pk_ses`. Ensure they are categorized correctly and only set after consent.
4. **Check for disclosure gaps**: The scanner verifies that your privacy policy mentions Matomo and explains its purpose.

After making changes, re-scan to confirm the issues are resolved. For ongoing monitoring, consider GDPRChecker’s paid plans, which offer runtime protection and consent records.

Comparison: Matomo Consent Modes vs. Google Consent Mode v2

While both Matomo and Google Analytics offer consent-aware tracking, their approaches differ. Here’s a comparison:

| Feature | Matomo Consent Management | Google Consent Mode v2 | |---------|---------------------------|------------------------| | **Consent signals** | Custom JavaScript API (`requireConsent`, `rememberConsentGiven`) | Google-defined consent types (`ad_storage`, `analytics_storage`) | | **Cookie-less tracking** | Built-in support via configurable tracking | Limited to modeled data for gaps | | **Self-hosting** | Fully self-hosted option | Not available for GA4 | | **Integration with CMPs** | Manual integration via callbacks | Standardized via TCF or Google CMP Partner program | | **Compliance flexibility** | Fine-grained control over data collection | Relies on Google’s compliance framework |

For a deeper dive into Google’s approach, see our Consent Mode v2 vs. Google Certified CMP guide.

Real-World Examples of Matomo Cookie Banner Integration

Example 1: E-commerce Site with Strict Consent An online store uses Matomo for conversion tracking. They implement `requireConsent` and configure their CMP to call `rememberConsentGiven` only when the user accepts all cookies. Result: No Matomo cookies are set until consent, and the store maintains a clean consent record.

Example 2: Blog with Cookie-less Fallback A content blog wants basic analytics without intruding on privacy. They use `requireCookieConsent` and configure Matomo to track anonymously when consent is denied (by not setting cookies and masking IPs). This allows them to gather pageview counts without personal data.

Example 3: SaaS Platform with Multi-tenant Matomo A SaaS company provides Matomo analytics to its customers. They integrate a custom banner that passes consent per tenant. Each tenant’s Matomo instance is configured to respect the consent choice, ensuring compliance across all subdomains.

Implementation Checklist

Use this checklist to ensure your Matomo cookie banner integration is complete:

1. Add `_paq.push(['requireConsent'])` or `_paq.push(['requireCookieConsent'])` to your Matomo tracking code.
2. Configure your CMP to call `_paq.push(['rememberConsentGiven'])` on accept.
3. Configure your CMP to call `_paq.push(['forgetConsentGiven'])` on revoke.
4. Test that no Matomo cookies are set before consent (check `_pk_id`, `_pk_ses`).
5. Verify that Matomo tracking requests are sent only after consent.
6. If using cookie-less fallback, confirm that IP anonymization is enabled.
7. Update your privacy policy to disclose Matomo usage and data retention.
8. Run a GDPRChecker scan to identify any pre-consent requests or missing disclosures.
9. Test the reject flow: ensure that declining cookies stops all Matomo tracking.
10. Document your consent configuration for audit purposes.
11. Schedule regular re-scans (e.g., monthly) to catch configuration drift.
12. If using Google Consent Mode alongside Matomo, ensure no conflicts in consent signals.

FAQ

What is "how to add matomo to your cookie banner 3 step tutorial"? It’s a practical guide for website owners to integrate Matomo analytics with a cookie consent banner in three steps: configuring Matomo’s consent requirements, connecting it to the banner via JavaScript, and verifying the setup. This ensures GDPR-compliant tracking by respecting user consent choices.

Do I need to add Matomo to my cookie banner for GDPR? Yes, if Matomo sets cookies or processes personal data (like IP addresses), you must obtain prior consent under the ePrivacy Directive and GDPR. Integrating Matomo with your banner ensures that tracking only occurs after the user gives explicit consent.

How do I implement adding Matomo to my cookie banner? Implement by adding `_paq.push(['requireConsent'])` to your Matomo code, then use your CMP’s callbacks to trigger `rememberConsentGiven` or `forgetConsentGiven` based on user choices. Test thoroughly to confirm that tracking is blocked until consent is granted.

How can I verify my Matomo cookie banner setup with a scanner? Use GDPRChecker’s public scanner to check for pre-consent network requests to Matomo, verify cookie categories, and ensure your privacy policy discloses Matomo. Re-scan after changes to confirm compliance.

What are common mistakes when adding Matomo to a cookie banner? Common mistakes include forgetting to call `requireConsent`, not handling consent revocation, assuming self-hosted Matomo is exempt, misconfiguring tag managers, and neglecting to anonymize data when consent is denied. These can lead to unintentional tracking and non-compliance.

Which cookies and trackers should I check for Matomo integration? Check for Matomo’s first-party cookies: `_pk_id` (visitor ID), `_pk_ses` (session), and any custom cookies. Also monitor network requests to your Matomo endpoint. GDPRChecker’s cookie inventory can help identify these.

How often should I review my Matomo cookie banner integration? Review your integration at least quarterly, or whenever you update your CMP, Matomo, or privacy policy. Regular GDPRChecker scans can detect configuration drift, such as new trackers or broken consent flows.

What evidence should I keep for Matomo cookie banner compliance? Keep records of your consent configuration (screenshots of settings), consent logs from your CMP, Matomo’s tracking settings, and GDPRChecker scan reports. This documentation demonstrates your compliance efforts to regulators.

Conclusion

Adding Matomo to your cookie banner is a straightforward but essential task for GDPR compliance. By following this 3-step tutorial—configuring Matomo, integrating with your banner, and verifying with tools like GDPRChecker—you can ensure that your analytics respect user privacy. Remember to avoid common mistakes, test thoroughly, and maintain documentation. For a complete compliance check, run a free scan at GDPRChecker today and close any consent gaps.

Related GDPRChecker guides

• [How to Add a Cookie Banner to Your Website](/guides/how-to-add-cookie-banner-to-website)

Article schema

```json { "@context": "https://schema.org", "@type": "Article", "headline": "How to Add Matomo to Your Cookie Banner: A 3-Step Tutorial for GDPR Compliance", "description": "Learn how to add Matomo to your cookie banner in 3 steps for GDPR compliance. Step-by-step guide with verification, common mistakes, and a scanner CTA.", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://www.gdprchecker.online/guides/how-to-add-matomo-to-your-cookie-banner-3-step-tutorial" }, "publisher": { "@type": "Organization", "name": "GDPRChecker", "url": "https://www.gdprchecker.online" } } ```

Copyright and editorial notice