This page describes what the plugin does and what it does not do. It is not legal advice.
The plugin outputs a script in the storefront that loads matomo.js from the configured Matomo URL. Tracking requests go to matomo.php at the same address. The collected data therefore ends up at the Matomo instance you entered. If you host Matomo yourself, it stays on your server. The plugin stores no visitor data in the shop database.
With Cookieless Tracking (default: On) the script calls disableCookies on the Matomo tracker. The tracker then sets no cookies. If the option is off, Matomo's standard cookies apply.
With Respect Do-Not-Track (default: On) two things happen:
setDoNotTrack, so the Matomo tracker honors the browser's signal.DNT header on the server. If it has the value 1, no script is output at all.How consent is handled depends on Use Klaro Consent Manager.
type="text/plain" and the attribute data-name (Klaro service name). The browser does not run it until Klaro releases it after consent.klaro-consent-change and calls setConsentGiven on consent and forgetConsentGiven on withdrawal in the Matomo tracker. The current Klaro state is also queried on page load.The plugin decides on the server whether the script is output:
DNT: 1 and Respect Do-Not-Track is on, nothing is output.cookie-preference with statistics equal to true, or one of the cookies matomo_consent, CookieConsent, CookieControl or cookie-agreed with one of the values 1, true, yes, accepted or allow.If Require Cookie Consent is on, the script also contains
requireConsent. The Matomo tracker then sends only aftersetConsentGivenhas been called. Without Klaro the plugin does not call it itself. In that case you need your own code that calls Matomo'ssetConsentGivenafter consent, otherwise no data is transmitted.
The plugin does not configure IP anonymization. The IP Anonymization selection in the configuration is not evaluated and does not influence the generated script. Enable IP address anonymization in Matomo's own privacy settings.
The plugin does not add the customer's name, e-mail address or address to the tracking code.
Visitors can disable tracking through an iframe delivered by Matomo. The plugin ships a ready-made page at /matomo/opt-out and an includable component for this, see Storefront. Link the page in your privacy policy.
Legal note: Whether consent is required for analytics depends on your jurisdiction and the concrete implementation. Even for tracking without cookies, many legal experts recommend obtaining consent. Have the requirements for your shop assessed by a professional.