GDPR Compliance: What Matomo Requires From You
Matomo is often described as a GDPR-compliant alternative to Google Analytics. The reality is more nuanced: the core analytics can be made consent-free in several EU countries, but only with explicit configuration. Some features always require user consent regardless.
The default installation is not compliant
A fresh Matomo installation tracks visitors using first-party cookies, collects unmasked IP addresses, and retains data indefinitely. In this state, it requires a consent banner like any other cookie-based tool. To reach compliance, you need to manually enable IP anonymization, disable User ID features, configure data retention limits, and implement an opt-out mechanism.
With this setup in place, Matomo can qualify for a consent-free analytics exemption in several EU countries: France (recognised by the CNIL), Spain, Italy, and the Netherlands. That is a meaningful advantage over Google Analytics. But it is a configuration target you have to reach, not a starting point.
Behavioral features: separate plugins, separate consent
Heatmaps and session recordings are a separate plugin, not a built-in feature. On Matomo Cloud they are included in paid plans (from €29/month). On self-hosted Matomo, they require purchasing the Heatmap & Session Recording plugin, priced at €219 to €659 per year depending on the number of users.
Beyond the cost, these features are explicitly excluded from consent-free exemptions under ePrivacy law, regardless of how the rest of Matomo is configured. They require explicit, purpose-specific user consent before activation. Teams who adopt Matomo for its consent-free core analytics need to account for this the moment they want behavioral data. Sublim includes behavioral analytics within the same privacy-first, cookieless architecture as its core tracking, with no extra plugin, no extra cost, and no additional consent layer required.



