Matomo
Open source and self-hostable: you own 100% of the data. Cookieless mode, IP anonymization, DNT/consent tooling built in.
verified 2026-06-08 · grade set per the published methodology · affiliate relationship disclosed
How the grade breaks down
How little it collects, and whether collection is purpose-bound.
Whether it respects GPC, consent state, and tracking-prevention signals.
Cookieless vs. persistent IDs, cross-site linkage, fingerprinting risk.
Where data lives and whether it is shared with third parties.
How verifiable and documented its real behavior is.
At a glance
Matomo can be fully self-hosted, which means the operator owns the entire dataset and no third party ever receives it. It offers a cookieless configuration, IP anonymization, a built-in consent manager, Do-Not-Track honoring, and data-retention controls. Defaults are reasonable but the strongest privacy posture requires enabling cookieless mode and IP anonymization. The Matomo Cloud option keeps data in the EU. Because configuration determines the outcome, consent is recommended unless cookieless mode plus anonymization is enabled.
Sources & basis for grade
Grades reflect documented behavior, vendor documentation, and ad.rip scans as of the date above. Each assessment is reproducible and vendors may request correction.
- Matomo privacy/anonymization documentation
- Matomo consent-manager docs
- Matomo open-source repository