# How to set up Matomo with Cookiequiet

> Matomo gives three ways to respect a refusal: requireConsent (nothing is sent before consent), requireCookieConsent (visits are tracked without cookies until consent), or a configuration that meets the CNIL's conditions for consent-free audience measurement in France. With Cookiequiet, call setConsentGiven or setCookieConsentGiven when the cq:consent event grants analytics, or mark the tracking code with data-cq-category="analytics".

Source: https://cookiequiet.com/platforms/matomo
Published: 2026-10-21
Publisher: Cookiequiet

## Steps

1. **Pick the consent model** Decide between no tracking before consent (requireConsent or a marked tag), cookieless tracking before consent (requireCookieConsent), or the CNIL exemption for French visitors.
2. **Place the Cookiequiet snippet first** Put the Cookiequiet snippet at the top of the head, then the Matomo tracking code from Administration, Websites, Tracking code.
3. **Add the require call** In the Matomo code, push requireConsent or requireCookieConsent before trackPageView, on every page.
4. **Grant from the cq:consent event** Add a listener that pushes setConsentGiven or setCookieConsentGiven when the event's categories include analytics. Cookiequiet fires it on every page load where a choice is stored.
5. **Or mark the tracking code** Instead of the require call, change the opening tag to type="text/plain" with data-cq-category="analytics" so the code runs only after consent.
6. **For the CNIL exemption, enable compliance mode** As a superuser, open Administration, Privacy, Compliance, choose the site, enable Enforce compliance where possible, save, and add the opt-out to your privacy policy.
7. **Test with Reject all** In a private window, click Reject all and check the _pk_ cookies and the requests to matomo.php against the model you chose. Accept all, reload, and check the visitor log.

## What does Matomo set?

Matomo's FAQ lists the cookies its JavaScript tracker creates: `_pk_id` (visitor ID, 13 months), `_pk_ses` and `_pk_hsr` (30 minutes), `_pk_ref` (attribution, 6 months) and `_pk_cvar` (30 minutes). When you ask for consent through Matomo, it also stores the consent in `mtm_consent` or `mtm_cookie_consent`. All are first-party: Matomo runs on your own server or on Matomo Cloud, and the data stays with you. Matomo falls in the **analytics** category in Cookiequiet, unless you configure it for an exemption your authority accepts.

## Option 1: no tracking before consent

Matomo's `requireConsent` call, pushed before `trackPageView`, stops every tracking request and every cookie until consent is given. Matomo offers two ways to grant it: `rememberConsentGiven`, which Matomo stores in its own cookie, and `setConsentGiven`, which you call on every page. Cookiequiet already stores the choice, so use `setConsentGiven` from the `cq:consent` event, which Cookiequiet dispatches on `window` on every page load where a choice is stored and after each choice, with the granted categories in `detail.categories`:

```html
<script src="https://cookiequiet.com/cq.js" data-site="YOUR_SITE_KEY" data-consent-mode="1" data-auto-block="1" defer></script>
<script>
  var _paq = window._paq = window._paq || [];
  _paq.push(['requireConsent']);
  window.addEventListener('cq:consent', function (e) {
    if (e.detail.categories.indexOf('analytics') >= 0) _paq.push(['setConsentGiven']);
  });
  _paq.push(['trackPageView']);
  _paq.push(['enableLinkTracking']);
  (function() {
    var u = 'https://matomo.example.com/';
    _paq.push(['setTrackerUrl', u + 'matomo.php']);
    _paq.push(['setSiteId', '1']);
    var d = document, g = d.createElement('script'), s = d.getElementsByTagName('script')[0];
    g.async = true; g.src = u + 'matomo.js'; s.parentNode.insertBefore(g, s);
  })();
</script>
```

No request reaches Matomo until consent is given. If you need the first page view of a visitor who accepts on that page, the marked tag below is the simpler route, because Cookiequiet runs the whole code, page view included, at the moment of the click. When a visitor withdraws, Matomo's guide says that with your own consent tool you simply stop calling `setConsentGiven`, which happens on the next page.

**The same result without code:** mark the whole tracking code with `type="text/plain"` and `data-cq-category="analytics"`. Cookiequiet runs it when analytics is granted. Mark it even if Matomo is on your own server: the auto-blocker does not hold scripts served from your own domain.

## Option 2: cookieless until consent

`requireCookieConsent` lets Matomo send tracking requests at once, but sets no cookie until cookie consent is given. Replace the two calls above with `requireCookieConsent` and `setCookieConsentGiven`. Visitors who refuse are still counted, without a visitor ID across visits; those who accept are measured with cookies. Matomo's FAQ on disabling cookies adds a caution: cookieless JavaScript tracking may still need consent in many European countries unless an exemption applies, so check your authority's position. The [guide to cookieless analytics](/guides/cookieless-analytics-options) compares the options.

## Option 3: the CNIL exemption (France)

The CNIL accepts audience measurement without consent when the tool is configured within strict limits. Matomo documents a setup that it says meets the criteria of the CNIL's guidance published on 4 July 2025:

- **Purposes** limited to performance measurement, navigation problems, technical optimisation, server capacity and content analysis; no marketing measurement or cohorts for targeted content.
- **Tracker lifetime** of 13 months at most, not extended on new visits.
- **Data retention** of 25 months at most (Matomo's CNIL mode sets 759 days).
- **IP addresses** truncated: the CNIL asks for at least the last octet; Matomo's CNIL mode masks 2 bytes.
- **No cross-referencing** with other processing; cross-domain tracking is off in CNIL mode.
- **Information and opt-out**: visitors are told Matomo is used, and an opt-out is visible, for example in the privacy policy.

To enable it, a superuser opens **Administration**, **Privacy**, **Compliance**, picks the site, turns on **Enforce compliance where possible**, saves, then works through the self-assessment table for items marked unknown, the opt-out included. Leave the tracking code unmarked in that case, and list the `_pk` cookies in your cookie table so the banner explains them. This is the CNIL's position for France: other authorities can read the ePrivacy rules differently, as the [France page](/laws/france) and the article on [analytics without consent](/blog/analytics-without-consent) explain.

## What about Google Tag Manager?

In Google Tag Manager, give the Matomo tag a Custom Event trigger on `cq_consent` with `cq_analytics equals true`, firing once per page, as the [Tag Manager guide](/platforms/google-tag-manager) shows.

## How do I test it?

1. Open the site in a private window. With option 1 or a marked tag, the network tab shows no request to `matomo.php` before a choice; with option 2, requests go out but no `_pk_` cookie is set.
2. Click **Reject all**: still no `_pk_id`.
3. Clear the cookies, click **Accept all**, reload: `_pk_id` and `_pk_ses` appear and the visit shows in Matomo's visitor log.
4. Check the consent log in the Cookiequiet dashboard.

Cookiequiet is free for one website with geo-targeting; Starter is €3 per website per month with unlimited pageviews.

## Questions

### What is the difference between requireConsent and requireCookieConsent?

requireConsent sends no tracking request and sets no cookie until consent is given. requireCookieConsent sends tracking requests at once but sets no cookie until cookie consent is given. Both must be called before trackPageView on every page.

### Does Matomo need a cookie banner?

With its default cookies, yes, in the EEA and the UK. In France, a Matomo configured to the CNIL's conditions can run without consent, with information and an opt-out. Other authorities may read the rules differently.

### Should I use rememberConsentGiven or setConsentGiven with Cookiequiet?

setConsentGiven. Cookiequiet already stores the choice and fires the cq:consent event on every page load where a choice exists, so Matomo does not need its own consent cookie.

### Which cookies does Matomo set and for how long?

Matomo lists _pk_id for 13 months, _pk_ref for 6 months, and _pk_ses, _pk_hsr and _pk_cvar for 30 minutes. Consent cookies are added only when you ask for consent through Matomo.

## Sources

- [Matomo developer guide: Tracking consent](https://developer.matomo.org/guides/tracking-consent)
- [Matomo FAQ: Which cookies are created by the Matomo JavaScript tracker?](https://matomo.org/faq/general/faq_146/)
- [Matomo FAQ: How do I disable all tracking cookies?](https://matomo.org/faq/general/faq_157/)
- [Matomo FAQ: Configure Matomo to comply with the CNIL consent exemption](https://matomo.org/faq/how-do-i-configure-matomo-without-tracking-consent-for-french-visitors-cnil-exemption/)
- [CNIL: Cookies, solutions pour les outils de mesure d'audience](https://www.cnil.fr/fr/cookies-solutions-pour-les-outils-de-mesure-daudience)