{"id":236899,"date":"2022-07-06T10:00:47","date_gmt":"2022-07-06T08:00:47","guid":{"rendered":"https:\/\/devowl.io\/?p=236899"},"modified":"2025-05-02T18:45:00","modified_gmt":"2025-05-02T16:45:00","slug":"matomo","status":"publish","type":"blog","link":"https:\/\/devowl.io\/de\/dsgvo-konform\/matomo\/","title":{"rendered":"Matomo GDPR-konform in eine WordPress-Website einbinden"},"content":{"rendered":"<section class=\"l-section wpb_row height_medium\"><div class=\"l-section-h i-cf\"><div class=\"g-cols vc_row via_flex valign_top type_default stacking_default\"><div class=\"vc_col-sm-12 wpb_column vc_column_container\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"wpb_text_column\"><div class=\"wpb_wrapper\"><p>Tracking and data protection don&#8217;t fit? Yes it can! Because that&#8217;s exactly what the web analysis tool <a href=\"https:\/\/matomo.org\/\" target=\"_blank\" rel=\"noopener\">Matomo Analytics<\/a> has made its mission. Matomo is considered a more privacy-friendly alternative to Google Analytics and is therefore also being used more and more frequently on websites.<\/p>\n<p>But be careful! Because under certain conditions, the integration of Matomo on your website may not be privacy-compliant.<\/p>\n<p>This article explains what these conditions are and what you should consider in order to integrate Matomo into your WordPress website in a DSGVO-compliant manner!<\/p>\n<\/div><\/div><div class=\"w-iconbox us_custom_8551abba iconpos_left style_outlined color_primary align_left no_title\"><div class=\"w-iconbox-icon\" style=\"font-size:18px;\"><i class=\"fas fa-info\"><\/i><\/div><div class=\"w-iconbox-meta\"><div class=\"w-iconbox-text\"><p><strong>Attention: This article is not legal advice!<\/strong> We as developers of WordPress plugins and contractors of website projects have dealt intensively with this topic, as it is essential in our daily work. However, we are neither lawyers, nor can we guarantee the completeness, timeliness and accuracy of the following information. In case of doubt, always consult a lawyer.<\/p>\n<\/div><\/div><\/div><div class=\"wpb_text_column\"><div class=\"wpb_wrapper\">\n<\/div><\/div><div class=\"wpb_text_column\"><div class=\"wpb_wrapper\"><h2>What is Matomo?<\/h2>\n<p>&#8220;Matomo&#8221; is the Japanese word for <em>honesty. <\/em>Because that&#8217;s exactly what the free open source software has made its mission. If you&#8217;ve been around the World Wide Web for a bit longer, you may still know the analytics tool under the name <em>Piwik<\/em>.<\/p>\n<blockquote>\n<p>As a community to create the leading open platform for digital analytics that gives every user full control over their data.<\/p>\n<\/blockquote>\n<p>Like Google Analytics, Matomo is a web analytics tool that helps website operators better understand the behavior of their visitors so they can better target their own optimization efforts. However, secretly collecting data is out of place with the all-in-one web analysis platform. The collection of data should be as transparent as possible for both website visitors and operators. Likewise, data access to third parties should only be permitted after authorization.<\/p>\n<p>Matomo is based on PHP and uses a MySQL database. You can either download and host it locally or move the hosting to the Matomo cloud.<\/p>\n<h2>Matomo and privacy<\/h2>\n<p>Although Matomo provides less data compared to its competitor Google Analytics, the analytics tool scores with more privacy-friendly features.<\/p>\n<p>Some measures Matomo offers to comply with data protection:<\/p>\n<ul>\n<li>Anonymization of data.<\/li>\n<li>Users can opt out of any tracking<\/li>\n<li>First-party cookies as standard<\/li>\n<li>Individuals can view the data collected<\/li>\n<li>Ability to delete visitor data if desired<\/li>\n<li>Data is not used for other purposes (compared to Google Analytics)<\/li>\n<li>IP anonymization<\/li>\n<li>Visitor log and profiles can be disabled<\/li>\n<li>Data is stored in the EU (Matomo Cloud) or in any country of your choice (Matomo On-Premise)<\/li>\n<\/ul>\n<p>So, as you can see, unlike Google Analytics, you don&#8217;t have to take much additional action to avoid any privacy violations when using an analytics service. For example, thanks to the location of the Matomo cloud in the EU, the thorny issue of data <em>transfer to the USA<\/em> is eliminated.<\/p>\n<p>However, even Matomo is in some ways not completely free of errors.<\/p>\n<p>If you do not host Matomo locally on your server, but on the Matomo cloud, the IP address &#8211; which is a <a href=\"https:\/\/devowl.io\/data-protection\/personal-data-gdpr\/\" target=\"_blank\" rel=\"noopener\">personal data<\/a> in many countries &#8211; is sent to the Matomo server.<\/p>\n<p>In addition, the analysis service uses tracking <a href=\"https:\/\/devowl.io\/cookies\/definition-cookies\/\" target=\"_blank\" rel=\"noopener\">cookies<\/a> to distinguish users and to link data from multiple page views.<\/p>\n<p>Tracking cookies belong to the non-essential cookies. Essential cookies are technically necessary cookies that are important for the basic functionality of the website (e.g. login area cookies). For non-essential cookies, you usually always need consent within the EU.<\/p>\n<p>But don&#8217;t panic! In the next section, we&#8217;ll show you how you can easily obtain consent.<\/p>\n<h2>How to integrate Matomo in a DSGVO-compliant way<\/h2>\n<p>Although Matomo &#8211; as you now already know &#8211; is comparatively more privacy-compliant than Google Analytics, we still recommend that you meet the following criteria to be on the safe side so as not to commit any data protection violations.<\/p>\n<h3>\u2705 Opt-in consent<\/h3>\n<p>Matomo itself provides you with an opt-out function. However, we recommend that you rather rely on the <a href=\"https:\/\/devowl.io\/data-protection\/opt-in-opt-out\/\" target=\"_blank\" rel=\"noopener\">opt-in principle<\/a> &#8211; i.e., you obtain the active consent of your website visitor before setting non-essential cookies and transferring personal data. This way, you are definitely on the safe side if the worst comes to the worst.<\/p>\n<p>This is the case if you host Matomo in the Matomo cloud.<\/p>\n<p>To get opt-in consent as easily as possible, you should use a consent management plugin like <a href=\"https:\/\/devowl.io\/wordpress-real-cookie-banner\/\" target=\"_blank\" rel=\"noopener\">Real Cookie Banner<\/a>.<\/p>\n<ol>\n<li>Open your WordPress backend.<\/li>\n<li>Go to <em>Plugins &gt; Install<\/em> in the left menu.<\/li>\n<li>Search for <em>Real Cookie Banner<\/em>.<\/li>\n<li>Install and activate the plugin. And Real Cookie Banner is ready to go.<\/li>\n<li>Navigate again on the left menu to <em>Cookies &gt; Services (Cookies) &gt; Add Service<\/em>.<\/li>\n<li>Search for <em>Matomo<\/em>.<\/li>\n<\/ol>\n<\/div><\/div><div class=\"w-image us_custom_938809ae align_center\"><a ref=\"magnificPopup\" href=\"https:\/\/devowl.io\/wp-content\/uploads\/blog\/matomo-en.png\" aria-label=\"matomo-en\" class=\"w-image-h\"><img decoding=\"async\" width=\"652\" height=\"325\" src=\"https:\/\/devowl.io\/wp-content\/uploads\/blog\/matomo-en-652x325.png\" class=\"attachment-us_652_652 size-us_652_652\" alt=\"\" loading=\"lazy\" srcset=\"https:\/\/devowl.io\/wp-content\/uploads\/blog\/matomo-en-652x325.png 652w, https:\/\/devowl.io\/wp-content\/uploads\/blog\/matomo-en-326x162.png 326w, https:\/\/devowl.io\/wp-content\/uploads\/blog\/matomo-en-890x443.png 890w, https:\/\/devowl.io\/wp-content\/uploads\/blog\/matomo-en-18x9.png 18w, https:\/\/devowl.io\/wp-content\/uploads\/blog\/matomo-en.png 1000w\" sizes=\"auto, (max-width: 652px) 100vw, 652px\" \/><\/a><\/div><div class=\"wpb_text_column\"><div class=\"wpb_wrapper\"><ol start=\"7\">\n<li>Click on the template. Now you are in the service configuration.<\/li>\n<li>Scroll down to the <em>Technical Handling<\/em> section.<\/li>\n<li>Enter your Matomo host name and Matomo site ID.<\/li>\n<\/ol>\n<\/div><\/div><div class=\"w-iconbox us_custom_8551abba iconpos_left style_outlined color_primary align_left no_title\"><div class=\"w-iconbox-icon\" style=\"font-size:18px;\"><i class=\"fas fa-lightbulb\"><\/i><\/div><div class=\"w-iconbox-meta\"><div class=\"w-iconbox-text\"><p><strong>Matomo host:<\/strong> Your Matomo host name is, for example, <em>matomo.example.com.<\/em><\/p>\n<p><strong>Matomo Site ID:<\/strong> You can find your Matomo Site ID under <em>Settings &gt; Manage Websites<\/em>.<\/p>\n<\/div><\/div><\/div><div class=\"wpb_text_column\"><div class=\"wpb_wrapper\"><ol start=\"10\">\n<li>Scroll to the end of the template and click <em>Save.<\/em><\/li>\n<li>Done!<\/li>\n<\/ol>\n<p>In addition to creating the template, you should switch to Matomo Tag Manager event in <em>Cookies &gt; Settings &gt; General<\/em> in the Load services after consent using section.<\/p>\n<\/div><\/div><div class=\"w-image us_custom_938809ae align_none\"><a ref=\"magnificPopup\" href=\"https:\/\/devowl.io\/wp-content\/uploads\/blog\/matomo-settings-en.png\" aria-label=\"matomo-settings-en\" class=\"w-image-h\"><img decoding=\"async\" width=\"890\" height=\"584\" src=\"https:\/\/devowl.io\/wp-content\/uploads\/blog\/matomo-settings-en-890x584.png\" class=\"attachment-large size-large\" alt=\"\" loading=\"lazy\" srcset=\"https:\/\/devowl.io\/wp-content\/uploads\/blog\/matomo-settings-en-890x584.png 890w, https:\/\/devowl.io\/wp-content\/uploads\/blog\/matomo-settings-en-326x214.png 326w, https:\/\/devowl.io\/wp-content\/uploads\/blog\/matomo-settings-en-18x12.png 18w, https:\/\/devowl.io\/wp-content\/uploads\/blog\/matomo-settings-en-652x428.png 652w, https:\/\/devowl.io\/wp-content\/uploads\/blog\/matomo-settings-en.png 1000w\" sizes=\"auto, (max-width: 890px) 100vw, 890px\" \/><\/a><\/div><div class=\"w-iconbox us_custom_8551abba iconpos_left style_outlined color_primary align_left no_title\"><div class=\"w-iconbox-icon\" style=\"font-size:18px;\"><i class=\"fas fa-lightbulb\"><\/i><\/div><div class=\"w-iconbox-meta\"><div class=\"w-iconbox-text\"><p>For more information, you can read our knowledge base article on <a href=\"https:\/\/devowl.io\/knowledge-base\/real-cookie-banner-with-google-tag-manager-or-matomo-tag-manager\/\" target=\"_blank\" rel=\"noopener\">setting up Real Cookie Banner<\/a> with Matomo.<\/p>\n<\/div><\/div><\/div><div class=\"wpb_text_column\"><div class=\"wpb_wrapper\"><p>Done! Now you can use Matomo DSGVO-compliant after the opt-in consent of your visitors.<\/p>\n<\/div><\/div><div class=\"w-btn-wrapper align_none\"><a class=\"w-btn us-btn-style_1 us_custom_4f24afa8\" target=\"_blank\" rel=\"nofollow\" href=\"https:\/\/devowl.io\/wordpress-real-cookie-banner\/\"><span class=\"w-btn-label\">Try Real Cookie Banner now!<\/span><\/a><\/div><div class=\"wpb_text_column\"><div class=\"wpb_wrapper\"><h3>\ud83d\udc65 IP-anonymization<\/h3>\n<p>Since the IP address is a personal data in some countries within the EU, you are generally only allowed to collect, process and store it on the basis of opt-in consent.<\/p>\n<p>To get around this, there is the so-called IP anonymization. As the name suggests, the IP address of the visitor is changed or shortened so that a unique identification is no longer possible.<\/p>\n<p>IP anonymization is activated by default in Matomo.<\/p>\n<p>To make sure that this is the case, you can check it again under <em>Administration &gt; Privacy &gt; Anonimyze data<\/em>. Here, either the <em>2 bytes<\/em> or <em>3 bytes<\/em> option should be selected.<\/p>\n<h3>\u274c DNT command<\/h3>\n<p>Unlike many other services, Matomo is probably one of the few that implement the user&#8217;s <a href=\"https:\/\/devowl.io\/data-protection\/do-not-track\/\" target=\"_blank\" rel=\"noopener\">Do Not Track command<\/a>. Roughly summarized, the DNT header is a web technology or function that automatically tells the HTTP header of a website when it is visited that the visitor does not consent to the collection and storage of their data. However, this command is not a legal one and therefore not useful in most cases.<\/p>\n<p>Matomo respects the DNT wish of the visitor.<\/p>\n<p>However, you still need to enable this feature in your Matomo account under <em>Administration &gt; Privacy &gt; Users opt-out &gt; Support Do Not Track<\/em> preference.<\/p>\n<p>Additionally you should include the code snippet <code class=\"\" data-line=\"\">_paq.push([&quot;setDoNotTrack&quot;, true]);<\/code> in your JavaScript code to make sure that no requests are sent and no cookies are set.<\/p>\n<\/div><\/div><div class=\"wpb_text_column\"><div class=\"wpb_wrapper\"><h3>\ud83e\udd1d Order processing contract<\/h3>\n<p>You always need an order processing contract (AV contract) if you commission an external company to process personal data. This contract regulates the handling of this data in accordance with data protection requirements. The basis for an AV contract is <a href=\"https:\/\/gdpr-info.eu\/art-28-gdpr\/\" target=\"_blank\" rel=\"noopener\">Article 28 of the GDPR<\/a>.<\/p>\n<p>For the use of Google Analytics, you definitely have to conclude an order processing contract.<\/p>\n<p>Not necessarily for the use of Matomo. You only need to sign an AV contract with Matomo if you host Matomo in the in-house cloud. If you host Matomo locally, you do not need an AV contract because the data is not forwarded to the Matomo servers.<\/p>\n<h3>\ud83d\udcdd Privacy policy<\/h3>\n<p>Even if you still need to conclude an AV contract for the use of Matomo, you are not spared from listing Matomo in the privacy policy. Here you should explain, among other things, the purpose for which you use Matomo on your website, what data is processed and who receives it.<\/p>\n<\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/section>\n","protected":false},"author":12,"featured_media":236904,"template":"","meta":{"_acf_changed":false,"_seopress_robots_primary_cat":"","_seopress_titles_title":"Integrate Matomo GDPR compliant into a WordPress website","_seopress_titles_desc":"Learn how to use the popular web analytics tool Matomo in a DSGVO-compliant way on your WordPress website.","_seopress_robots_index":"","inline_featured_image":false,"restrictTranslations":["en_US","de_DE"],"footnotes":""},"class_list":["post-236899","blog","type-blog","status-publish","has-post-thumbnail","hentry","content-cluster-gdpr-compliant"],"acf":[],"_links":{"self":[{"href":"https:\/\/devowl.io\/de\/wp-json\/wp\/v2\/blog\/236899","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devowl.io\/de\/wp-json\/wp\/v2\/blog"}],"about":[{"href":"https:\/\/devowl.io\/de\/wp-json\/wp\/v2\/types\/blog"}],"author":[{"embeddable":true,"href":"https:\/\/devowl.io\/de\/wp-json\/wp\/v2\/users\/12"}],"version-history":[{"count":11,"href":"https:\/\/devowl.io\/de\/wp-json\/wp\/v2\/blog\/236899\/revisions"}],"predecessor-version":[{"id":241896,"href":"https:\/\/devowl.io\/de\/wp-json\/wp\/v2\/blog\/236899\/revisions\/241896"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devowl.io\/de\/wp-json\/wp\/v2\/media\/236904"}],"wp:attachment":[{"href":"https:\/\/devowl.io\/de\/wp-json\/wp\/v2\/media?parent=236899"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}