Deutsche Version

Back to overview

Matomo Analytics: Privacy

This page describes what the plugin does and what it does not do. It is not legal advice.

Where does the data go?

The plugin outputs a script in the storefront that loads matomo.js from the configured Matomo URL. Tracking requests go to matomo.php at the same address. The collected data therefore ends up at the Matomo instance you entered. If you host Matomo yourself, it stays on your server. The plugin stores no visitor data in the shop database.

Cookies

With Cookieless Tracking (default: On) the script calls disableCookies on the Matomo tracker. The tracker then sets no cookies. If the option is off, Matomo's standard cookies apply.

Do-Not-Track

With Respect Do-Not-Track (default: On) two things happen:

• The script contains setDoNotTrack, so the Matomo tracker honors the browser's signal.
• Without Klaro the plugin additionally checks the DNT header on the server. If it has the value 1, no script is output at all.

Consent

How consent is handled depends on Use Klaro Consent Manager.

With Klaro

• The script is output with type="text/plain" and the attribute data-name (Klaro service name). The browser does not run it until Klaro releases it after consent.
• The server-side check for the DNT header and consent cookies is skipped. The Do-Not-Track signal is then honored only by the Matomo tracker in the browser.
• A helper script listens for the Klaro event klaro-consent-change and calls setConsentGiven on consent and forgetConsentGiven on withdrawal in the Matomo tracker. The current Klaro state is also queried on page load.

Without Klaro

The plugin decides on the server whether the script is output:

1. If the visitor sent the header DNT: 1 and Respect Do-Not-Track is on, nothing is output.
2. If Cookieless Tracking is on, the script is output without looking for consent.
3. If Cookieless Tracking is off and Require Cookie Consent is on, the script is only output when consent is found: either the JSON cookie cookie-preference with statistics equal to true, or one of the cookies matomo_consent, CookieConsent, CookieControl or cookie-agreed with one of the values 1, true, yes, accepted or allow.
4. In all other cases the script is output.

If Require Cookie Consent is on, the script also contains requireConsent. The Matomo tracker then sends only after setConsentGiven has been called. Without Klaro the plugin does not call it itself. In that case you need your own code that calls Matomo's setConsentGiven after consent, otherwise no data is transmitted.

IP anonymization

The plugin has no setting for IP anonymization and does not anonymize IP addresses itself. You configure that in Matomo's own privacy settings.

What data do the E-Commerce events contain?

• Product view: product number, product name, category path, price
• Cart: product number, label, unit price and quantity per product, plus the cart total
• Order: order number, grand total, net amount, tax amount, shipping costs and, per product, number, label, unit price and quantity

The plugin does not add the customer's name, e-mail address or address to the tracking code.

Opt-out

Visitors can disable tracking through an iframe delivered by Matomo. The plugin ships a ready-made page at /matomo/opt-out and an includable component for this, see Storefront. Link the page in your privacy policy.

Legal note: Whether consent is required for analytics depends on your jurisdiction and the concrete implementation. Even for tracking without cookies, many legal experts recommend obtaining consent. Have the requirements for your shop assessed by a professional.