Understanding Matomo: A UK GDPR-Ready Analytics Guide

Understanding Matomo starts with one question most guides skip: where’s your visitor data actually going? Matomo Analytics is a privacy-first web analytics platform that lets UK and Irish businesses keep visitor data under their own control, rather than handing it to a US-based provider by default, and that’s a genuinely different starting point. For SMEs working under UK GDPR, the Data Protection Act 2018 and PECR, that single difference changes how much compliance work lands on your desk.

This guide covers what Matomo is, how Matomo web analytics compares with Google Analytics 4, what UK privacy law actually requires, the real hosting costs, and how to set up tracking without a cookie banner.

Three things worth knowing before you read on:

• Matomo can run without setting cookies at all, which removes most PECR consent problems.
• Self-hosted Matomo keeps data inside the UK or Ireland; Matomo Cloud stores it in Germany. Both avoid the US data transfer question that GA4 raises.
• It’s worth saying plainly: the software itself is free. Hosting, plugins and setup time are the real costs, and for most SMEs they come in lower than the compliance workarounds GA4 often needs.

What Is Matomo?

What is Matomo, in practice? Understanding Matomo means understanding a different starting point for analytics: data ownership first, features second. Matomo began life as Piwik, an open-source project launched in 2007. It rebranded to Matomo in 2018 and has since grown into one of the most widely used open-source analytics platforms, with installations across the public and private sectors.

At a basic level, Matomo web analytics does what any analytics platform does. It tracks how visitors find a website, what they do once they arrive, and where they leave. The difference is what happens to that data afterwards. With self-hosted Matomo, the data stays inside a database on a server the business controls, accessible only to people the business authorises. No third party, including Matomo itself, can see it.

Matomo also offers a cloud-hosted option for businesses that want the same privacy position without running their own server. Matomo Cloud stores data on servers in Germany, inside the EU, and that’s a genuinely different arrangement from GA4’s processing in the United States. ProfileTree’s website hosting and management service can set up either option as part of a wider site support package, handling server configuration, plugin updates and ongoing maintenance so a business doesn’t have to build that expertise in-house.

A useful semantic shorthand for the platform: Matomo is a web analytics tool built on data ownership rather than advertising, which is the opposite starting point to Google’s model. That’s why public bodies, healthcare providers and privacy-conscious agencies keep appearing on Matomo’s client list, and it is the reason this guide treats data ownership as the first question, not a footnote at the end.

Matomo vs Google Analytics 4: Why UK Businesses Are Switching

Understanding Matomo analytics against its main competitor is where the decision usually gets made. GA4 replaced Universal Analytics with a fundamentally different data model, and many marketing managers found the transition harder than expected. Matomo’s reporting style is closer to what Universal Analytics users were used to: session-based reports, straightforward goal tracking and a dashboard that doesn’t need a data analyst to interpret.

Matomo is maintained as an open-source project with a paid cloud arm sitting alongside it, rather than as a free front end for an advertising business. That funding model is worth stating plainly, because it explains why future development prioritises data controls and reporting depth over advertising integrations, which is the opposite of GA4’s incentives as part of Google’s wider ad platform.

The feature gap matters as much as the compliance gap. Heatmaps, session recordings, funnel analysis and A/B testing sit inside Matomo’s core or paid plugins. In GA4, most of these need a separate tool such as Hotjar or Microsoft Clarity, which means another third-party processor and another data protection agreement to manage. For businesses already reviewing their analytics tools stack, that additional processor is worth weighing against Matomo’s single-platform approach, something covered in more depth in ProfileTree’s wider comparison of business analytics tools.

Core Features of the Matomo Analytics Platform

Understanding Matomo’s feature set is where the privacy argument turns into a practical one, and it helps explain why some businesses switch while others stay on GA4 for specific jobs. The core platform covers the analytics fundamentals: traffic sources, visitor behaviour, conversions, page performance. What sets the Matomo dashboard apart from other analytics dashboards is what’s included alongside those basics, without needing a third-party plugin.

Heatmaps, Session Recordings and the Matomo Dashboard

The Matomo dashboard is widget-based, so a marketing manager using Matomo analytics can drag reports onto the screen in whatever order matters most to them, rather than working through GA4’s fixed report structure. Heatmaps show where visitors click, tap and scroll on a page. Session recordings let a team watch anonymised replays of individual visits, and that’s genuinely useful for spotting where a checkout page or contact form is losing people.

One ProfileTree client, Conor McTernan, described how the team helped him work through Google Analytics troubleshooting and get the correct tracking set up, calling the wider support “a fountain of knowledge.” The same hands-on approach applies when businesses move to Matomo and need help interpreting the dashboard for the first time.

Tag Management, Goals and E-commerce Tracking

Matomo’s built-in tag manager lets a business add and update tracking scripts without editing code every time a campaign launches. Goal tracking covers the usual conversion points: a form submission, a newsletter sign-up, and a download, and shows which traffic sources drive them. The e-commerce module tracks revenue, average order value and abandoned carts, working with WooCommerce and other platforms through plugins, all reported straight back to the Matomo dashboard without sending transaction data to a third party.

Media Analytics, Form Analytics and Custom Reports

Media analytics tracks how visitors interact with video and audio embedded on a page, including play rate and drop-off point, and that’s worth knowing for any business running video content as part of its marketing. Form analytics shows where visitors abandon a contact form or checkout field, field by field, rather than just reporting an overall bounce rate. Custom reports let a marketing manager combine metrics from across these Matomo analytics modules into a single Matomo dashboard view built around the questions their own business actually asks, instead of the fixed report templates GA4 provides by default.

Matomo and UK GDPR: What the ICO Expects

Understanding Matomo web analytics’ compliance position means looking past the general “GDPR mentioned” checkbox that most analytics guides settle for. UK businesses operate under the UK GDPR and the Data Protection Act 2018, administered by the Information Commissioner’s Office rather than an EU authority, though the practical rules are close to identical: a lawful basis for processing, transparency about what is collected, and meaningful control for the user.

GA4’s biggest risk sits in data transfers. When a UK visitor loads a page with GA4 running, their data moves to Google’s US servers. Standard Contractual Clauses cover that transfer on paper, but ICO guidance treats SCCs as carrying residual risk, particularly where the volume or sensitivity of the data is high. Self-hosted Matomo on a UK or Irish server avoids the question entirely, because no international transfer happens in the first place. According to Ciaran Connolly, founder of ProfileTree, that single structural difference removes one of the more time-consuming lines in a GDPR paperwork review before a business even reaches the consent question.

PECR, the Privacy and Electronic Communications Regulations, governs cookie use in the UK and requires informed, specific consent before non-essential cookies get set, as set out in the ICO’s guide to cookies and similar technologies. Matomo can be configured to avoid setting cookies at all, using IP anonymisation and session-less tracking, which is documented in Matomo’s own technical guidance and increasingly used by UK public sector sites seeking compliance without a consent banner. For a business that currently shows a cookie banner and sees consent refusal rates around 30 to 50 percent, cookieless tracking means analytics data for every visitor, not only the ones who click accept.

Northern Ireland sits in a genuinely unusual spot after Brexit, keeping partial alignment with EU rules that the rest of the UK does not follow in the same way. For web analytics, that means UK GDPR applies, but businesses trading across the border or operating under the Northern Ireland Protocol also need to keep EU GDPR obligations in view, including how Ireland’s Data Protection Commission expects cross-border transfers to be documented.

A Belfast business selling into the Republic of Ireland, for example, may need to satisfy both the ICO and the Irish regulator on the same analytics setup, which is more paperwork than a single-jurisdiction UK business faces. Matomo’s self-hosting model answers both questions in the same move, because the governance question comes down to where the server sits. ProfileTree’s guide to data protection for online businesses covers the wider compliance picture for firms weighing these questions across multiple regulations.

Hosting Options: Matomo Cloud vs Self-Hosted

Understanding Matomo web analytics hosting choice is usually where organisations get stuck between principle and practicality. Self-hosting requires a web server running PHP 7.2.5 or higher and a MySQL or MariaDB database. Most managed WordPress hosting environments meet those requirements already, though shared hosting plans can hit resource limits at higher traffic volumes.

The Matomo software costs nothing. A VPS sufficient for a small or medium-sized website typically runs £10 to £30 a month from a UK or Irish hosting provider, and ProfileTree’s beginner’s guide to choosing the right hosting setup covers how shared, VPS and dedicated options compare for exactly this kind of decision. Premium plugins, heatmaps, A/B testing and funnel analysis, are available as add-ons if the free core doesn’t cover what a business needs, with a full plugin bundle running around €229 a year, broadly comparable to a mid-tier Hotjar subscription but without the data leaving the server.

Self-hosting also means owning updates, backups and security patching, a genuine overhead for a business without in-house technical support. ProfileTree can configure and maintain a self-hosted installation as part of a wider hosting and management engagement, handling server setup, plugin integration and ongoing updates so the marketing team can focus on the reports rather than the infrastructure behind them.

Matomo Cloud removes that overhead entirely. Pricing starts at roughly €19 a month for smaller sites, with all premium features included and data held on servers in Germany. For most SMEs without a technical resource, cloud’s the more realistic starting point once the time cost of managing a server is factored in.

Put over a three-year period, the arithmetic is straightforward. Self-hosted Matomo on a mid-range £20 a month VPS comes to roughly £720 across three years, plus around €687 if a business needs the full premium plugin bundle for all three years. Matomo Cloud at €19 a month comes to roughly €684 over the same period with every premium feature already included. Neither figure accounts for staff time, but the cloud total’s a fixed number a finance team can plan against, while the self-hosted total depends on how much server maintenance the business handles itself.

How to Configure Matomo for Cookieless Tracking

Understanding Matomo’s cookieless setup is the section most competing guides treat as a footnote rather than a genuine option. Getting there involves a short sequence rather than a single toggle, and it follows the same logic as Matomo’s own published guidance on tracking without a cookie banner.

1. Turn on IP anonymisation, which strips the last portion of each visitor’s IP address before it is stored, removing the direct identifier.
2. Switch to session-less visit tracking, which measures visits without a persistent identifier following a user between sessions.
3. Disable the visitor profile and user ID features, since these rely on the kind of persistent tracking PECR treats as needing consent.
4. Review the retention window and set it to a period the business can justify, rather than leaving the default in place.
5. Test the configuration with a consent management tool switched off entirely to confirm no cookie gets set anywhere on the site.

The trade-off is real and worth stating plainly. Without a persistent identifier, Matomo can’t recognise a returning visitor across separate sessions, so multi-day attribution weakens. For most SME reporting needs, that loss is smaller than the gain of collecting data from the visitors who’d otherwise click “reject.” Matomo’s own guidance on tracking without consent or a cookie banner covers the full configuration in more technical depth than this guide needs to. Businesses handling forms as part of this setup may also want to review ProfileTree’s guide to designing GDPR-compliant web forms, since the same consent logic applies to both.

The Real Cost of Matomo: Total Cost of Ownership

Understanding Matomo’s total cost means looking past the “free” headline GA4 also carries. The pricing above covers the two Matomo routes; what’s missing from most comparisons is what GA4’s “free” price tag actually leaves out.

GA4 looks free by comparison, but the hidden cost for UK businesses is the compliance overhead: a consent management platform, legal review of data processing agreements, and the residual exposure that comes with SCC-based transfers. Those costs rarely appear in a tool comparison because they sit with legal or compliance budgets rather than the marketing line, which is why GA4 isn’t actually as cheap as it looks once the full picture is added up.

Businesses that have already paid for a consent management platform to run GA4 properly can often reduce that ongoing cost by switching to a cookieless Matomo configuration instead. Weighing risk appetite against budget this way is the same kind of exercise ProfileTree covers in its practical guide to data management strategy, and deciding which route fits a specific business is exactly the kind of question ProfileTree’s team is built to work through with a client.

Is Matomo Right for Your Organisation?

Understanding Matomo’s fit comes down to priorities rather than features alone, and there’s no single right answer for every business. It suits SMEs with GDPR-conscious clients, since agencies and professional services firms whose clients ask about data handling get a stronger answer from Matomo than from GA4. E-commerce businesses benefit from keeping transaction data in their own database rather than passed through Google’s systems. Public sector and healthcare organisations, where data can’t leave UK infrastructure under internal policy, find self-hosted Matomo on a UK server one of the more straightforward routes to that requirement.

Matomo doesn’t suit organisations as well when there’s no technical resource and no budget for server management, or where a business is deeply tied into Google’s advertising tools through Google Ads conversion tracking, which needs extra configuration to work with Matomo rather than GA4.

A business running most of its paid media through Google Ads and reporting straight into Google’s own bidding algorithms may find that the extra setup work outweighs the benefit of moving reporting into a Matomo dashboard, at least until that integration gap closes further. ProfileTree’s digital training programmes cover web analytics as part of a wider curriculum on using data to make better marketing decisions, including sessions on tools like Matomo for teams building confidence without relying on outside support long-term.

FAQs