Matomo and the CNIL exemption: what the configuration turns off

Matomo is the tool most often named in France for audience measurement without consent. The CNIL published a guide to configure it for years, and since 2026 Matomo has a compliance page in its administration (Privacy > Compliance) that checks each criterion of the CNIL self-assessment of July 2025. Installed with its default settings, though, Matomo sets cookies and needs consent. The exemption depends on the configuration.

What follows comes from Matomo's FAQ on the CNIL exemption, read on 3 November 2026.

What the configuration changes

Setting	In the CNIL configuration
Measurement cookie	Kept, lifetime limited to 13 months and not extended on each visit
IP address	Masked: at least 2 bytes required, the configuration masks 3
User ID	Off, with its reports and segments
Device and screen	Device model and screen resolution off; major versions only for browsers and systems
Visits log and visitor profiles	Off, and so are raw data exports; real time stays as aggregated, rounded numbers
Segments	Restricted, and segmented numbers are rounded to the nearest ten
Referrers	Host or type only, no full URL or parameters
Campaigns (UTM)	Masked: the values show as discarded
Advertising conversion export	Off
Ecommerce	Restricted: order, revenue, price and product segments off, order ids anonymised
A/B tests	Off; turning the mode on permanently deletes existing experiment data
Heatmaps and session recordings	Off
Raw data retention	744 days, never more than 759
Cross-domain tracking	Off
Opt-out	You add it yourself (iframe or link)
Custom dimensions	No setting: do not send personal data in them

This table follows the CNIL's grid. Campaigns and revenue per channel are marketing, the visits log can follow a single visitor, and heatmaps and session recordings go beyond plain measurement.

What you lose

Marketing teams notice three losses:

• Campaigns. Without UTM tags there is no report per newsletter or paid campaign.
• Detailed ecommerce. Sales stay visible, but not revenue per segment or analysis per product.
• The single visitor. No visits log or profile, and small segments show rounded.

If you need them, you need consent, and so a banner, whatever the tool.

Cloud or self-hosted

Matomo comes as Cloud (hosted by Matomo) and On-Premise (on your servers). According to its FAQ, both can meet the criteria. For Cloud, Matomo provides a data processing agreement (article 28 of the GDPR) and keeps each customer's data separate. On-Premise you are your own host: non-reuse of the data is guaranteed by design, but security and updates are yours.

How it compares with Statsdot

Statsdot made similar choices in its CNIL exemption mode: no UTM tags or revenue, no visits log, numbers rounded to the nearest ten, and an opt-out button for the privacy policy. The differences:

• No cookie. Statsdot sets no cookie, even outside the CNIL mode. It counts with a code that changes every day, so a visitor is counted once per day.
• One switch. The mode is turned on per site, with one checkbox.
• Fewer features to start with. Statsdot has no heatmaps, A/B tests or session recordings, even without the mode.
• Hosted only. Statsdot cannot be installed on your servers.

Our self-assessment fills in the CNIL template criterion by criterion. The general comparison is on Statsdot vs Matomo, and moving from one to the other, history included, in Switch from Matomo to Statsdot.