Ditching Google Analytics for Matomo: A Self-Hosted, Privacy-First Alternative

July 25, 2026 · Kilo Code

# Ditching Google Analytics for Matomo: A Self-Hosted, Privacy-First Alternative

**Tier:** 🔰 Kid / ⚙️ Student / 🧠 Pro
*A technical explainer on how Matomo works, why we chose it over GA4, and what tradeoffs come with self-hosted analytics.*

We just finished installing Matomo Analytics on isaacbell.io. I want to walk through what Matomo is, why we picked it over Google Analytics, and what you give up when you make that switch.

## What Matomo Is

Matomo is an open-source web analytics platform. It does what Google Analytics does — page views, visit duration, referrers, browser/device stats — but it runs on your own server. You download it, drop it on a PHP/MySQL host, add a JavaScript snippet to your site, and you’re tracking.

There’s also Matomo Cloud (the managed SaaS version, €22/month and up), but we went the self-hosted route. We wanted full control over the data and we already had the server infrastructure to support it.

The key difference from GA4 is philosophical: Matomo treats you as the data owner. Google Analytics treats you as a participant in Google’s data ecosystem.

## Why We Left GA4

Three reasons.

### 1. Data ownership

With GA4, your analytics data lives on Google’s servers under Google’s terms. Google uses aggregated, anonymized analytics data to improve its advertising products. You can see your reports, you can export them (with effort), but you don’t own the data in any meaningful legal sense.

With self-hosted Matomo, the data never leaves our server. The MySQL database sits in our infrastructure. There’s no third party reading along, no data-sharing agreement to negotiate, no processor relationship to manage. I can run `SELECT * FROM matomo_log_visit` if I want raw per-visit data. Try that with GA4.

### 2. GDPR posture

GA4 *can* be made GDPR-compliant, but it takes work. You need a Data Processing Amendment with Google, Consent Mode v2 configured correctly, a certified consent management platform, IP anonymization enabled, and data retention capped at 14 months. Several European data protection authorities (Austria’s DSB, France’s CNIL, Italy’s Garante) have ruled standard GA4 configurations non-compliant.

Matomo configured in cookieless mode with full IP anonymization sidesteps the consent requirement entirely. No cookie gets stored, no personal data gets processed, and under the ePrivacy Directive and GDPR, that means no consent banner is needed. The CNIL has explicitly approved Matomo in this configuration. That’s not a loophole — it’s a direct consequence of how the law defines its triggers.

We’re not operating in healthcare or finance, so the legal stakes aren’t existential. But we take it seriously. I’d rather not maintain a litigation posture over website analytics when I don’t have to.

### 3. Ecosystem lock-in

Google Analytics is deeply integrated with Google Ads, Search Console, Looker Studio, and BigQuery. If your business depends on those integrations — if you’re spending real money on Google Ads and need closed-loop attribution — GA4 is hard to beat. But we’re not running ad campaigns. We don’t need funnel analysis or cohort reporting. We want to know which blog posts people read, where traffic comes from, and whether visitors find the pages useful. Matomo does all of that without pulling us deeper into Google’s orbit.

## How Matomo Works, Technically

Here’s the stack.

**Server side:** PHP (7.4+) running on Apache or Nginx, backed by MySQL or MariaDB. The tracker entry point is `matomo.php` — every tracking request hits that script, which writes raw data into `log_*` tables (`log_visit`, `log_action`, `log_link_visit_action`, etc.). A separate archiving process (triggered by cron or on-demand) aggregates that raw log data into precomputed reports stored in `archive_numeric_*` and `archive_blob_*` tables. The web UI and reporting API query those archive tables, not the raw logs, so report generation stays fast.

**Client side:** A JavaScript tracker (`matomo.js`) served from our domain. When a page loads, the tracker collects the page URL, referrer, screen resolution, browser user-agent, and a few other standard fields, then fires an HTTP request to `matomo.php` with those values as query parameters.

**Cookies:** By default, Matomo sets three first-party cookies:

These are first-party cookies set on our domain. No cross-site tracking, no third-party cookie shenanigans, no data shared with ad networks. If we wanted to go fully cookieless, we’d add `_paq.push([‘disableCookies’])` to the tracking snippet, and Matomo would switch to a config-ID-based approach that doesn’t store anything on the visitor’s device.

The database schema is open and documented. If you want to pull raw visit logs, join against actions, or build custom dashboards, you have direct SQL access. No BigQuery export required, no data sampling at any traffic level.

## What Data We Actually Collect

Straight from [our privacy page](https://isaacbell.io/privacy/):

– Page views and page URLs
– Visit duration
– Referring sites
– Browser and device type

That’s it. We don’t collect IP addresses beyond a country-level geolocation lookup (two-octet anonymization: 192.168.x.x). We don’t track user IDs across sessions. We don’t set third-party cookies, fingerprint visitors, or integrate with any advertising platform. The data is used to understand which content resonates and where traffic comes from — nothing else.

## The Opt-Out Mechanism

Our privacy page includes a `

You may choose to prevent this website from aggregating and analyzing the actions you take here. Doing so will protect your privacy, but will also prevent the owner from learning from your actions and creating a better experience for you and other users.

` shortcode that renders an interactive opt-out iframe. Here’s what it does:

When a visitor checks the opt-out box, Matomo sets a `mtm_consent_removed` cookie on our domain. On every subsequent page load, the JavaScript tracker checks for that cookie before sending data to `matomo.php`. If the cookie is present, the tracker bails — no tracking request gets sent, no visit gets logged.

The opt-out is cookie-based, which means it has the usual limitations: clearing cookies removes it, switching browsers resets it, and private browsing windows won’t remember it. But for visitors who want a no-tracking preference honored on our site, it works.

There’s also a `matomo_sessid` nonce cookie used to prevent CSRF attacks on the opt-out form. That one contains no identifying data and is classified as strictly necessary.

## The Tradeoffs

Self-hosted Matomo isn’t a zero-cost drop-in replacement. Here’s what you lose vs. GA4:

**No Google Search Console integration.** GA4 pulls Search Console data directly into your reports — search queries, click-through rates, average position. With Matomo, we tag our URLs with UTM parameters where possible and use Search Console separately. Not a dealbreaker for us, but it’s an extra step.

**No Google Ads attribution.** If you’re running paid search campaigns, GA4’s closed-loop attribution from click to conversion is genuinely valuable. Matomo doesn’t plug into that ecosystem.

**No machine-learning insights.** GA4 surfaces predictive metrics — churn probability, purchase probability — that Matomo doesn’t attempt. For content-driven sites with no conversion funnel to optimize, we don’t miss them.

**Smaller community.** GA4 has an enormous user base, endless tutorials, and a thriving ecosystem of third-party tools. Matomo’s community is smaller (though active and helpful). If you hit a weird edge case, there are fewer Stack Overflow threads to scroll through.

**You’re on the hook for hosting.** Self-hosted Matomo needs a PHP/MySQL server, periodic updates (the software updates ~monthly), database backups, and enough disk space for your archive tables. For a site our size, a modest VPS handles it easily — roughly €8–15/month in hosting costs. But someone has to keep it running.

**Cookieless mode trades accuracy for privacy.** Without cookies, Matomo can’t reliably identify returning visitors or track cross-session attribution. You get accurate page-level and session-level data, but visitor-level metrics like “new vs. returning” become estimates. Whether that matters depends on what questions you’re asking your analytics.

## Quick Setup: WordPress in 5 Lines

If you run WordPress and have a PHP/MySQL host ready:

“`bash
# 1. Download and extract
wget https://builds.matomo.org/matomo-latest.zip && unzip matomo-latest.zip -d /var/www/analytics

# 2. Run the web installer at https://analytics.yourdomain.com

# 3. Install the WP-Matomo plugin on your WordPress site

# 4. Add the tracking code to your theme (or let the plugin handle it)

# 5. Add

to your privacy page for the opt-out iframe
“`

The web installer is similar to the WordPress five-minute install — it walks you through database credentials, admin account creation, and site setup.

## The Bottom Line

Matomo isn’t a better Google Analytics. It’s a different tool with different values. GA4 wins on integrations, machine learning, and zero upfront cost. Matomo wins on data ownership, privacy posture, and independence from the Google ecosystem.

For isaacbell.io — a personal site with a blog, a contact form, and no ad campaigns — the choice was straightforward. We don’t need predictive audiences or Search Console integration. We want to know which posts people find useful and where they found them, without handing visitor data to an advertising company to do it.

If you’re in a similar position — running a content site, an indie project, a consultancy portfolio, or anything where privacy is a feature rather than a checkbox — Matomo is worth a look.