Matomo's cookieless tracking mode stops Matomo storing an identifier on the visitor's device, but it does not settle the consent question everywhere. In Germany, running Matomo without a cookie banner ("Matomo ohne Cookie-Banner") is contested, because section 25 of the TDDDG covers any access to information on the device, not only cookies. France exempts properly configured audience measurement, and since 5 February 2026 the UK lets first-party statistics run without opt-in if visitors are told and can object.
Instead of cookies like _pk_id or _pk_ses, cookieless Matomo generates a server-side hash called config_id to group page views into visits. Here is how it works, what it costs you in data, and where it needs consent.
How Matomo's cookieless mode works
When cookies are disabled, Matomo stops setting first-party tracking cookies in the visitor's browser. Visitor identification moves to the config_id, a short-lived hash derived from the visitor's operating system, browser, browser plugins, IP address and browser language. This hash resets every 24 hours, and the default window for matching a returning visit is 30 minutes.
The config_id is not a fingerprint in the usual sense. Fingerprinting aims to track users persistently across sites and sessions, while the config_id is time-limited, randomly seeded and stored only on the server.
Turning it on is a one-line change in the tracking code:
_paq.push(['disableCookies']);Place this before the trackPageView call, and Matomo works without cookies for every visitor. For WordPress sites using the Matomo plugin, the same setting exists under Matomo Analytics > Settings.
What you lose without cookies
Cookieless mode has real costs in data accuracy. Because the config_id hash resets often and cannot persist between sessions, several standard reports become unreliable.
| Report or metric | With cookies | Without cookies |
|---|---|---|
| Returning and new visitors | Accurate across sessions | All visits counted as new after the hash resets |
| Visit count per visitor | Tracked over the cookie lifetime (up to 13 months) | Lost after each session window |
| Multi-session attribution | Conversion credited to the original campaign | Conversion credited to the last-touch channel only |
| Cohort analysis | Works | Not possible |
| Multi-channel attribution | Distributes credit across touchpoints | Cannot link sessions across visits |
| E-commerce order attribution | Linked to the original traffic source | Linked to the session that completed the purchase |
Page views, event tracking, downloads, outlinks and site search reports stay accurate. The loss is concentrated in anything that needs to recognise the same person across several sessions.
Matomo cookieless tracking under the DSGVO and section 25 TDDDG
The DSGVO (Datenschutz-Grundverordnung) is the German name for the GDPR, which governs the processing of personal data. Cookie consent rules come from a separate law: the Telecommunications Digital Services Data Protection Act, or TDDDG (formerly the TTDSG). Section 25 of the TDDDG transposes Article 5(3) of the ePrivacy Directive into German law. The guide to cookie consent in Germany covers both laws in more detail.
Section 25 does not mention cookies by name. It regulates the storage of information in, or access to information stored in, the end user's terminal equipment. That covers cookies, localStorage, fingerprinting scripts and any JavaScript that reads device properties such as screen resolution or installed plugins.
Consent is only unnecessary if the access is "strictly necessary" for a service the user explicitly requested. Web analytics are not something the user requested: the site operator wants them. The German Data Protection Conference (DSK) has not granted analytics a blanket exemption from consent, unlike the French CNIL, which offers a specific audience measurement exemption for properly configured tools like Matomo.
Does Matomo's cookieless mode require consent in Germany?
This is where legal opinions diverge.
Matomo's JavaScript tracker, even without cookies, still reads information from the visitor's device: the browser's user agent string, screen resolution, plugins and language settings are read in the browser to build the config_id. Under a strict reading of section 25 TDDDG, this device access triggers the consent requirement even though nothing is stored on the device.
Some privacy practitioners argue that reading a user agent string, which the browser sends with every HTTP request anyway, is not the same as querying the device. The DSK has not published a definitive position on this scenario. The EDPB's Guidelines 2/2023 on the technical scope of Article 5(3), adopted in final form on 7 October 2024, take a broad view: any "gaining of access" to information on a terminal device falls within scope.
German courts have followed that line. On 19 March 2025 the Administrative Court of Hannover (10 A 5385/22) held that loading Google Tag Manager itself needs consent under section 25 TDDDG. On 11 December 2025 the Higher Regional Court of Frankfurt (6 U 81/23) ruled that third-party cookie providers are directly liable under section 25 TDDDG for cookies placed without consent. That ruling is not final: the court allowed an appeal to the Federal Court of Justice (BGH).
The practical takeaway for Germany
If your site targets German visitors, cookieless Matomo reduces the data you process but does not clearly remove the need for consent. Asking for consent before Matomo runs is the cautious option. Operators who rely on the narrower reading inform visitors in their privacy policy, offer an opt-out and configure Matomo to avoid processing personal data (IP anonymisation of 2 or 3 bytes, no User ID, no cross-domain tracking), knowing that a regulator or court may disagree.
Where cookieless Matomo tracking can run without consent
Germany's cautious position is not universal. As of October 2026, two places have clear exemptions for audience measurement that meets their conditions.
France: the CNIL exempts audience measurement cookies from consent when they meet the conditions in its guidance on analytics for websites and apps: the data serves only to produce anonymous statistics for the site owner, is not cross-checked with other processing, visitors are informed and can object, and trackers last no longer than 13 months. The CNIL points to open-source software such as Matomo that you can configure yourself.
United Kingdom: since 5 February 2026, changes made by the Data (Use and Access) Act 2025 let sites store or read information for statistics about how their own site is used, to improve it, without consent. Visitors must get clear information and a simple, free way to object, and the data must not be shared except to help with those improvements. A self-hosted, single-site Matomo with minimised data can fit those conditions. The ICO published its final guidance on storage and access technologies on 29 April 2026.
Some other EU countries have their own audience measurement positions. Check your national regulator before relying on one.
Does cookieless Matomo need consent?
How to configure Matomo to process less personal data
Whether or not your jurisdiction demands consent for cookieless tracking, reducing the personal data Matomo collects lowers your risk everywhere. These steps are what the exemptions above ask for.
Step 1: Disable cookies
Add _paq.push(['disableCookies']); before trackPageView. You can also turn on "Force tracking without cookies" in the Matomo admin under Privacy settings (available since Matomo 4).
Step 2: Anonymise IP addresses
Mask at least 2 bytes of the IP address, and 3 bytes if you can. IP addresses are personal data under the GDPR, and full masking removes that identifier.
Step 3: Anonymise referrer data
Referrer URLs can contain personal data, such as campaign parameters, usernames or links from personal pages. Turn on referrer anonymisation (Matomo 4 or later).
Step 4: Turn off features that process personal data
Turn off User ID tracking, e-commerce tracking, heatmaps and session recordings. If you need them, run them only after consent through your consent tool.
Step 5: Track each site on its own
Do not use cross-domain tracking or third-party cookies. Track each site separately so visitor profiles do not span several properties.
Step 6: Inform visitors and offer an opt-out
Describe the tracking in your privacy policy, and embed the Matomo opt-out or an equivalent mechanism. The French and UK exemptions both require a way for visitors to object.
Matomo consent management with a consent tool
Matomo has its own consent API, described in its guide to tracking consent. requireConsent holds all tracking until setConsentGiven is called. requireCookieConsent tracks without cookies until setCookieConsentGiven is called, which is the "cookieless by default, cookies after consent" pattern some sites use.
Kukie.io's Matomo integration uses the first pattern. On an opt-in site, it loads Matomo only after the visitor accepts analytics, with requireConsent followed by setConsentGiven, and calls forgetConsentGiven when the visitor withdraws. Kukie.io's automatic blocking also treats Matomo scripts a site adds itself as analytics and holds them until consent. So with Kukie.io, Matomo runs only for visitors who accept analytics. A cookieless-first setup needs your own Matomo code and a blocking rule that lets it load before the choice.
EU reform is still a proposal
The European Commission's Digital Omnibus proposal, published on 19 November 2025, would move the cookie consent rules out of the ePrivacy framework and into the GDPR through a new Article 88a. Consent would remain the default for storing or accessing information on a user's device, with a closed list of exemptions, including aggregated audience measurement carried out by the service provider for its own service and internal use, with no data sharing with third parties.
That scope matters for Matomo. As proposed, the exemption excludes tools that work across several sites or share data with third parties. A self-hosted, single-site Matomo instance configured for data minimisation fits the description closely. The proposal also requires one-click refusal on banners and bars asking a visitor again for the same purpose within six months of a refusal.
As of October 2026, the Digital Omnibus is still a proposal. The European Parliament's committees have not adopted a position, and the Council's compromise text of 18 June 2026 dropped the separate browser-signal article (88b). Nothing in it applies yet, so the current national rules above still decide whether cookieless Matomo needs consent.
Questions about cookieless Matomo
Does Matomo's cookieless mode collect any personal data?
In its default cookieless configuration, Matomo still reads browser properties (user agent, screen resolution, language) and the visitor's IP address. If you anonymise the IP by at least 2 bytes and avoid User IDs and e-commerce order IDs, the remaining data is generally not considered personal. Full IP masking removes the last direct identifier.
Can I use Matomo without a cookie banner in Germany?
It is contested. Section 25 of the TDDDG covers any access to information stored on a user's device, not just cookies, and Matomo's JavaScript reads device attributes. No DSK exemption for analytics exists in Germany, so asking for consent first is the cautious option.
What is the config_id in Matomo?
The config_id is a server-side hash built from a visitor's operating system, browser type, plugins, IP address and language. It groups page views into visits for up to 24 hours, is not stored on the visitor's device and resets daily.
How does the CNIL exemption for Matomo work?
The CNIL exempts audience measurement from consent when the data only produces anonymous statistics for the site owner, is not cross-checked with other processing, visitors are informed and can object, and trackers last no more than 13 months. Matomo can be configured to meet those conditions.
What reports become inaccurate in Matomo's cookieless mode?
Returning visitor counts, visit frequency, multi-session campaign attribution, cohort analysis and multi-channel attribution all lose accuracy. Page views, event tracking, downloads, outlinks and site search stay accurate.
Is the Matomo cookieless config_id considered browser fingerprinting?
Matomo says it is not, because the config_id is randomly seeded, limited to 24 hours, stored only on the server and used on a single site. German authorities have not published a position on it.
Should I use a hybrid cookieless-plus-consent approach?
It is a common pattern: Matomo's requireCookieConsent tracks without cookies until setCookieConsentGiven is called. Whether the cookieless part needs consent still depends on the country, and in Germany it is contested. Kukie.io's Matomo integration loads Matomo only after analytics consent instead.
Check what Matomo sets on your pages
Whether you run Matomo with cookies, without them or only after consent, start by checking what your pages actually set and when. A scan lists every cookie your site sets, including _pk_id and _pk_ses, and shows whether they appear before a visitor chooses.
