French CNIL recommends Matomo: the only analytics tool that does not require Cookie Consent

Matthieu Aubry
October 29, 2014

There has been recent and important changes in France regarding data privacy and the use of cookies. This blog post will introduce you to these changes and explain how you make your website compliant.

Read the latest related update (Oct 2021): Matomo exempt from tracking consent in France

Cookie Consent in the data freedom law

Since the adoption of the EU Directive 2009/136/EC “Telecom Package”, Internet users must be informed and provide their prior consent to the storage of cookies on their computer. The use of cookies for advertising, analytics and social share buttons require the user’s consent:

It is necessary to inform users of the presence, purpose and duration of the cookies placed in their browsers, and the means at their disposal to oppose it.

What is a cookie?

Cookies are tracers placed on Internet users’ hard drives by the web hosts of the visited website. They allow the website to identify a single user across multiple visits with a unique identifier. Cookies may be used for various purposes: building up a shopping cart, storing a website’s language settings, or targeting advertising by monitoring the user’s web-browsing.

Which cookies are exempt from the Cookie Consent rule?

France has exempted certain cookies from the cookie consent rule: for those cookies that are strictly necessary to offer the service sought after by the user you do not need to ask consent to user. Examples of such cookies are:

the shopping cart cookie,
authentication cookies,
short lived session cookies,
load balancer cookies,
certain first party analytics (such as Matomo (Piwik) cookies),
persistent cookies for interface personalisation.

Asking users for consent for Analytics (tracking) Cookies

For all cookies that are not exempted from the Cookie Consent then you will need to:

obtain consent from web users before placing or reading cookies and similar technologies,
clearly inform web users of the different purposes for which the cookies and similar technologies will be used,
propose a real choice to web users between accepting or refusing cookies and similar technologies.

You don’t need Cookie Consent with Matomo

The excellent news is that there is a way to bypass the Cookie Consent banner on your website:

If you are using another analytics solution other than Matomo then you will need to ask users for consent. If you do not want to ask for consent then download and install Matomo or signup to a service offering Matomo hosted in the Cloud to get started.

If you are already using Matomo you need to do two simple things: (1) anonymise visitor IP addresses (at least two bytes) and (2) include the opt-out iframe solution in your website (learn more).

Note that these recommendations currently only apply in France, but because the law is European we can expect similar findings in other European countries.

CNIL recommends Matomo

We are proud that the CNIL has identified Matomo as the only tool that respects all privacy requirements set by the European Telecom law.

About the CNIL

The CNIL is an independent administrative body that operates in accordance with the French data protection legislation. The CNIL has been entrusted with the general duty to inform people of the rights that the data protection legislation allows them.

The role and responsabilities of the CNIL are:

to protect citizens and their data
to regulate and control processing of personal data
to inspect the security of data processing systems and applications, and impose penalties

Matomo and Privacy

At Matomo we love Privacy – our open analytics platform comes with built-in Privacy.

Future of Privacy at Matomo

Matomo is already the leader when it comes to respecting user privacy but we plan to continue improving privacy within the open analytics platform. For more information and specific ideas see Privacy enhancing issues in our issue tracker.