Matomo Analytics: Privacy and Consent

What Matomo Analytics for OXID eShop 7 does with its privacy settings in the tracking code: cookieless, Do-Not-Track, consent cookies, Klaro, opt-out. Including what the module does not do.

Deutsche Version

Back to overview

Live Demo: Try this and other plugins live — no installation, no risk: demo.markus-michalski.net

This page describes exactly what the module does with its privacy settings, and what it does not do. The settings themselves are listed under Configuration.

The module does not implement the "IP anonymization" setting. It is read and shown in the admin, but never written into the tracking code. Level 2 (the default) therefore does not protect any IP addresses. Configure anonymization in your Matomo installation itself.

What the settings do in the tracking code

Setting	Effect
Cookieless tracking	Outputs `_paq.push(["disableCookies"])`. Matomo then sets no tracking cookies.
Respect Do-Not-Track	Outputs `_paq.push(["setDoNotTrack", true])`. In addition, without the Klaro integration the module delivers no tracking code at all when the browser sends the header `DNT: 1`.
Require consent	Outputs `_paq.push(["requireConsent"])`. In addition, without the Klaro integration and without cookieless tracking, the module checks for a consent cookie on the server.
Enable Klaro integration	Embeds the tracking script as `type="text/plain"`, which Klaro only executes after consent. Adds an event handler that reports `setConsentGiven` or `forgetConsentGiven` to Matomo.
IP anonymization	No effect.

Other calls (heartbeat, link tracking, e-commerce) are unrelated to privacy behavior and are covered on Technical Details.

When the tracking code is delivered

For every page, isMatomoEnabled() decides in this order:

graph TD
    A["Page request"] --> B{"Tracking enabled, HTTPS URL valid, site ID above 0?"}
    B -->|"No"| X["No tracking code"]
    B -->|"Yes"| C{"Klaro integration on?"}
    C -->|"Yes"| K["Tracking code as text/plain, Klaro decides"]
    C -->|"No"| D{"Respect DNT and header DNT 1?"}
    D -->|"Yes"| X
    D -->|"No"| E{"Cookieless tracking on?"}
    E -->|"Yes"| Y["Tracking code delivered"]
    E -->|"No"| F{"Require consent?"}
    F -->|"No"| Y
    F -->|"Yes"| G{"Consent cookie present?"}
    G -->|"Yes"| Y
    G -->|"No"| X

Consequences:

With the Klaro integration enabled, the server-side check is skipped. The DNT header is then not evaluated on the server either; only the setDoNotTrack call in the tracking code remains.
With cookieless tracking enabled (the default), the consent cookie check is skipped even if "Require consent" is on. The DNT header is still checked first.
The consent cookie check only runs when cookieless tracking is off, the Klaro integration is off and "Require consent" is on.

The check recognizes these cookies:

Cookie	Counts as consent for the values
`matomo_consent`	`1`, `true`, `yes`, `accepted`, `allow`
`CookieConsent`	same
`CookieControl`	same
`cookie-agreed`	same

The value is compared case-insensitively. Any other value counts as no consent. If one of the four cookies has a matching value, the code is delivered.

With "Require consent" the module outputs requireConsent but never calls setConsentGiven without the Klaro integration. Matomo therefore stays in the "consent pending" state until your own script calls _paq.push(["setConsentGiven"]). Without the Klaro integration, the module never signals a granted consent by itself.

Klaro integration

With the Klaro integration enabled:

Tracking code and e-commerce code are placed in <script type="text/plain" data-type="text/javascript" data-name="...">. The value of data-name is the configured Klaro service name. The browser does not execute them until Klaro releases them.
A regular (not blocked) script listens for the klaro-consent-change event. If consent for the service name is true, it calls _paq.push(["setConsentGiven"]); when consent is withdrawn it calls _paq.push(["forgetConsentGiven"]). A call is only made when the state differs from the last reported one.
After the page has loaded (with a 100 ms delay), the script also reads the current state via klaro.getManager().getConsent(...) if Klaro is available by then.
As long as Klaro has not executed the tracking code, _paq does not exist and the handler does nothing.

On the confirmation page, order tracking is also output with type="text/plain".

What is sent to Matomo

The module passes the following data to the tracking code, provided the respective switches are on:

Area	Data
Page view	Standard Matomo page view (`trackPageView`). The Matomo server sees the visitor's IP address on every request.
Product view	Article number, title, category path, gross price
Cart	Per line: article number, title, gross unit price, quantity; gross total
Order	Order number, revenue, subtotal, tax, shipping costs, per line article number, title, price, quantity

The module itself does not transmit customer data such as name, address or email address.

Opt-out for visitors

Visitors can opt out via the page index.php?cl=matomo_optout or via the widget. Both embed the opt-out iframe of your Matomo installation. Details are on Storefront and Templates.

Legal note

Whether analytics requires consent depends on your jurisdiction and your configuration. The module provides the technical switches but makes no legal assessment. Seek legal advice.