# Matomo privacy rating

Open source web analytics platform, formerly Piwik, with detailed reports, goals, heatmaps and a tag manager. Can be self-hosted or used as the hosted Matomo Cloud.

## Summary

Matomo scores 50 out of 100 (grade D) on the website analytics criteria. It meets 4 of 11 criteria: open source, no ads or data sales, TLS configuration and self-hostable. It partly meets security headers, no cookies and no personal data. It does not meet no trackers or telemetry, independent audit, transparency report and tells users about requests. It is based in New Zealand: Five Eyes member. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade B.

- Website: https://matomo.org
- Source code: https://github.com/matomo-org/matomo
- License: GPL-3.0
- Jurisdiction: New Zealand. Five Eyes member.
- Platforms: Web
- Home page trackers: LinkedIn Insight, Matomo Cloud (cookieless analytics)
- Category: [Website analytics](https://privacyratings.com/web-analytics/)
- Grade: D (50/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | Yes | GPL-3.0-or-later. Some premium plugins are sold separately. | https://github.com/matomo-org/matomo/blob/5.x-dev/LEGALNOTICE |
| No trackers or telemetry | No | The privacy policy lists Google Ads tracking on the website, with consent where required. | https://matomo.org/privacy-policy/ |
| No ads or data sales | Yes | Funded by Matomo Cloud subscriptions and paid plugins. The privacy policy states personal data is never sold. | https://matomo.org/privacy-policy/ |
| Independent audit | No | No independent audit is published. Paid external penetration tests are mentioned but no report is public. |  |
| Transparency report | No | No transparency report or government request policy is published. |  |
| Tells users about requests | No | No published policy on notifying users about data requests. |  |
| TLS configuration | Yes | Grade A+ | https://www.ssllabs.com/ssltest/analyze.html?d=matomo.org&hideResults=on |
| Security headers | Partial | Grade B (75/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=matomo.org |
| Modern web standards | Not tested yet | Not tested yet. |  |
| No cookies | Partial | The default tracking code sets first-party cookies, and a cookieless mode can be turned on. | https://matomo.org/faq/general/faq_157/ |
| No personal data | Partial | IP masking is on by default, and full anonymization and data retention limits can be configured. | https://matomo.org/faq/general/configure-privacy-settings-in-matomo/ |
| Self-hostable | Yes | Matomo On-Premise is officially supported for self-hosting. | https://matomo.org/faq/on-premise/installing-matomo/ |

Source: https://privacyratings.com/web-analytics/matomo/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/web-analytics/matomo.md