How to set up Matomo with Cookiequiet

What does Matomo set?

Matomo's FAQ lists the cookies its JavaScript tracker creates: _pk_id (visitor ID, 13 months), _pk_ses and _pk_hsr (30 minutes), _pk_ref (attribution, 6 months) and _pk_cvar (30 minutes). When you ask for consent through Matomo, it also stores the consent in mtm_consent or mtm_cookie_consent. All are first-party: Matomo runs on your own server or on Matomo Cloud, and the data stays with you. Matomo falls in the analytics category in Cookiequiet, unless you configure it for an exemption your authority accepts.

Option 1: no tracking before consent

Matomo's requireConsent call, pushed before trackPageView, stops every tracking request and every cookie until consent is given. Matomo offers two ways to grant it: rememberConsentGiven, which Matomo stores in its own cookie, and setConsentGiven, which you call on every page. Cookiequiet already stores the choice, so use setConsentGiven from the cq:consent event, which Cookiequiet dispatches on window on every page load where a choice is stored and after each choice, with the granted categories in detail.categories:

html
<script src="https://cookiequiet.com/cq.js" data-site="YOUR_SITE_KEY" data-consent-mode="1" data-auto-block="1" defer></script>
<script>
  var _paq = window._paq = window._paq || [];
  _paq.push(['requireConsent']);
  window.addEventListener('cq:consent', function (e) {
    if (e.detail.categories.indexOf('analytics') >= 0) _paq.push(['setConsentGiven']);
  });
  _paq.push(['trackPageView']);
  _paq.push(['enableLinkTracking']);
  (function() {
    var u = 'https://matomo.example.com/';
    _paq.push(['setTrackerUrl', u + 'matomo.php']);
    _paq.push(['setSiteId', '1']);
    var d = document, g = d.createElement('script'), s = d.getElementsByTagName('script')[0];
    g.async = true; g.src = u + 'matomo.js'; s.parentNode.insertBefore(g, s);
  })();
</script>

No request reaches Matomo until consent is given. If you need the first page view of a visitor who accepts on that page, the marked tag below is the simpler route, because Cookiequiet runs the whole code, page view included, at the moment of the click. When a visitor withdraws, Matomo's guide says that with your own consent tool you simply stop calling setConsentGiven, which happens on the next page.

The same result without code: mark the whole tracking code with type="text/plain" and data-cq-category="analytics". Cookiequiet runs it when analytics is granted. Mark it even if Matomo is on your own server: the auto-blocker does not hold scripts served from your own domain.

Option 2: cookieless until consent

requireCookieConsent lets Matomo send tracking requests at once, but sets no cookie until cookie consent is given. Replace the two calls above with requireCookieConsent and setCookieConsentGiven. Visitors who refuse are still counted, without a visitor ID across visits; those who accept are measured with cookies. Matomo's FAQ on disabling cookies adds a caution: cookieless JavaScript tracking may still need consent in many European countries unless an exemption applies, so check your authority's position. The guide to cookieless analytics compares the options.

Option 3: the CNIL exemption (France)

The CNIL accepts audience measurement without consent when the tool is configured within strict limits. Matomo documents a setup that it says meets the criteria of the CNIL's guidance published on 4 July 2025:

• Purposes limited to performance measurement, navigation problems, technical optimisation, server capacity and content analysis; no marketing measurement or cohorts for targeted content.
• Tracker lifetime of 13 months at most, not extended on new visits.
• Data retention of 25 months at most (Matomo's CNIL mode sets 759 days).
• IP addresses truncated: the CNIL asks for at least the last octet; Matomo's CNIL mode masks 2 bytes.
• No cross-referencing with other processing; cross-domain tracking is off in CNIL mode.
• Information and opt-out: visitors are told Matomo is used, and an opt-out is visible, for example in the privacy policy.

To enable it, a superuser opens Administration, Privacy, Compliance, picks the site, turns on Enforce compliance where possible, saves, then works through the self-assessment table for items marked unknown, the opt-out included. Leave the tracking code unmarked in that case, and list the _pk cookies in your cookie table so the banner explains them. This is the CNIL's position for France: other authorities can read the ePrivacy rules differently, as the France page and the article on analytics without consent explain.

What about Google Tag Manager?

In Google Tag Manager, give the Matomo tag a Custom Event trigger on cq_consent with cq_analytics equals true, firing once per page, as the Tag Manager guide shows.

How do I test it?

1. Open the site in a private window. With option 1 or a marked tag, the network tab shows no request to matomo.php before a choice; with option 2, requests go out but no _pk_ cookie is set.
2. Click Reject all: still no _pk_id.
3. Clear the cookies, click Accept all, reload: _pk_id and _pk_ses appear and the visit shows in Matomo's visitor log.
4. Check the consent log in the Cookiequiet dashboard.

Cookiequiet is free for one website with geo-targeting; Starter is €3 per website per month with unlimited pageviews.