Ditching Google Analytics for Matomo: A Self-Hosted, Privacy-First Alternative

A technical explainer on how Matomo works, why we chose it over GA4, and what tradeoffs come with self-hosted analytics.

We just finished installing Matomo Analytics on isaacbell.io. I want to walk through what Matomo is, why we picked it over Google Analytics, and what you give up when you make that switch.

What Matomo Is

Matomo is an open-source web analytics platform. It does what Google Analytics does — page views, visit duration, referrers, browser/device stats — but it runs on your own server. You download it, drop it on a PHP/MySQL host, add a JavaScript snippet to your site, and you’re tracking.

There’s also Matomo Cloud (the managed SaaS version, €22/month and up), but we went the self-hosted route. We wanted full control over the data and we already had the server infrastructure to support it.

The key difference from GA4 is philosophical: Matomo treats you as the data owner. Google Analytics treats you as a participant in Google’s data ecosystem.

Why We Left GA4

Three reasons.

1. Data ownership

With GA4, your analytics data lives on Google’s servers under Google’s terms. Google uses aggregated, anonymized analytics data to improve its advertising products. You can see your reports, you can export them (with effort), but you don’t own the data in any meaningful legal sense.

With self-hosted Matomo, the data never leaves our server. The MySQL database sits in our infrastructure. There’s no third party reading along, no data-sharing agreement to negotiate, no processor relationship to manage. I can run SELECT * FROM matomo_log_visit if I want raw per-visit data. Try that with GA4.

2. GDPR posture

GA4 can be made GDPR-compliant, but it takes work. You need a Data Processing Amendment with Google, Consent Mode v2 configured correctly, a certified consent management platform, IP anonymization enabled, and data retention capped at 14 months. Several European data protection authorities (Austria’s DSB, France’s CNIL, Italy’s Garante) have ruled standard GA4 configurations non-compliant.

Matomo configured in cookieless mode with full IP anonymization sidesteps the consent requirement entirely. No cookie gets stored, no personal data gets processed, and under the ePrivacy Directive and GDPR, that means no consent banner is needed. The French CNIL has explicitly listed Matomo in its exempted tools list when configured this way. That’s not a loophole — it’s a direct consequence of how the law defines its triggers.

We’re not operating in healthcare or finance on this specific site, so the legal stakes aren’t existential. But we take it seriously. I’d rather not maintain a litigation posture over website analytics when I don’t have to.

3. Ecosystem lock-in

Google Analytics is deeply integrated with Google Ads, Search Console, Looker Studio, and BigQuery. If your business depends on those integrations — if you’re spending real money on Google Ads and need closed-loop attribution — GA4 is hard to beat. But we’re not running ad campaigns. We don’t need funnel analysis or cohort reporting. We want to know which blog posts people read, where traffic comes from, and whether visitors find the pages useful. Matomo does all of that without pulling us deeper into Google’s orbit.

How Matomo Works, Technically

Here’s the stack.

Server side: PHP (7.4+) running on Apache or Nginx, backed by MySQL or MariaDB. The tracker entry point is matomo.php — every tracking request hits that script, which writes raw data into log_* tables (log_visit, log_action, log_link_visit_action, etc.). A separate archiving process (triggered by cron or on-demand) aggregates that raw log data into precomputed reports stored in archive_numeric_* and archive_blob_* tables. The web UI and reporting API query those archive tables, not the raw logs, so report generation stays fast.

Client side: A JavaScript tracker (matomo.js) served from our domain. When a page loads, the tracker collects the page URL, referrer, screen resolution, browser user-agent, and a few other standard fields, then fires an HTTP request to matomo.php with those values as query parameters.

Cookies: By default, Matomo sets three first-party cookies:

These are first-party cookies set on our domain. No cross-site tracking, no third-party cookie shenanigans, no data shared with ad networks. If we wanted to go fully cookieless, we’d add _paq.push(['disableCookies']) to the tracking snippet, and Matomo would switch to a config-ID-based approach that doesn’t store anything on the visitor’s device.

The database schema is open and documented. If you want to pull raw visit logs, join against actions, or build custom dashboards, you have direct SQL access. No BigQuery export required, no data sampling at any traffic level.

What Data We Actually Collect

Straight from our privacy page:

• Page views and page URLs
• Duración de la visita
• Referring sites
• Browser and device type

That’s it. We don’t collect IP addresses beyond a country-level geolocation lookup (two-octet anonymization: 192.168.x.x). We don’t track user IDs across sessions. We don’t set third-party cookies, fingerprint visitors, or integrate with any advertising platform. The data is used to understand which content resonates and where traffic comes from — nothing else.

The Opt-Out Mechanism

Our privacy page includes a

Exclusión completa; sus visitas a este sitio web no serán registradas por la herramienta de análisis web. Tenga en cuenta que si borra sus cookies, elimina la cookie de exclusión o si cambia de ordenador o navegador web, deberá realizar el procedimiento de exclusión de nuevo.

Puede optar por evitar que este sitio web recopile y analice las acciones que realiza aquí. Hacerlo protegerá su privacidad, pero también impedirá que el propietario aprenda de sus acciones y cree una mejor experiencia para usted y otros usuarios.

When a visitor checks the opt-out box, Matomo sets a mtm_consent_removed cookie on our domain. On every subsequent page load, the JavaScript tracker checks for that cookie before sending data to matomo.php. If the cookie is present, the tracker bails — no tracking request gets sent, no visit gets logged.

The opt-out is cookie-based, which means it has the usual limitations: clearing cookies removes it, switching browsers resets it, and private browsing windows won’t remember it. But for visitors who want a no-tracking preference honored on our site, it works.

There’s also a matomo_sessid nonce cookie used to prevent CSRF attacks on the opt-out form. That one contains no identifying data and is classified as strictly necessary.

The Tradeoffs

Self-hosted Matomo isn’t a zero-cost drop-in replacement. Here’s what you lose vs. GA4:

• No Google Search Console integration: GA4 pulls Search Console data directly into your reports — search queries, click-through rates, average position. With Matomo, we tag our URLs with UTM parameters where possible and use Search Console separately.
• No Google Ads attribution: If you’re running paid search campaigns, GA4’s closed-loop attribution from click to conversion is genuinely valuable. Matomo doesn’t plug into that ecosystem.
• No machine-learning insights: GA4 surfaces predictive metrics — churn probability, purchase probability — that Matomo doesn’t attempt. For content-driven sites with no conversion funnel to optimize, we don’t miss them.
• Smaller community: GA4 has an enormous user base and endless tutorials. Matomo’s community is smaller (though active and helpful). If you hit a weird edge case, there are fewer Stack Overflow threads to scroll through.
• You’re on the hook for hosting: Self-hosted Matomo needs a PHP/MySQL server, periodic updates, database backups, and disk space for archive tables. Roughly €8–15/month in hosting costs.
• Cookieless mode trades accuracy for privacy: Without cookies, Matomo can’t reliably identify returning visitors or track cross-session attribution. Visitor-level metrics like “new vs. returning” become estimates.

Quick Setup: WordPress in 5 Lines

# 1. Download and extract 
wget https://builds.matomo.org/matomo-latest.zip && unzip matomo-latest.zip -d /var/www/analytics

# 2. Run the web installer at https://analytics.yourdomain.com
# 3. Install the WP-Matomo plugin on your WordPress site
# 4. Add the tracking code to your theme (or let the plugin handle it)
# 5. Add 
Exclusión completa; sus visitas a este sitio web no serán registradas por la herramienta de análisis web. Tenga en cuenta que si borra sus cookies, elimina la cookie de exclusión o si cambia de ordenador o navegador web, deberá realizar el procedimiento de exclusión de nuevo.
Puede optar por evitar que este sitio web recopile y analice las acciones que realiza aquí. Hacerlo protegerá su privacidad, pero también impedirá que el propietario aprenda de sus acciones y cree una mejor experiencia para usted y otros usuarios.

        
        
        No ha optado por la exclusión. Desmarque esta casilla para optar por la exclusión.
		Actualmente no est
s suscrito. Marca esta casilla para suscribirte.
        
La funci
s de exclusi
sn del seguimiento requiere que las cookies est
sn habilitadas.
 to your privacy page for the opt-out iframe

The web installer is similar to the WordPress five-minute install — it walks you through database credentials, admin account creation, and site setup.

The Bottom Line

Matomo isn’t a better Google Analytics. It’s a different tool with different values. GA4 wins on integrations, machine learning, and zero upfront cost. Matomo wins on data ownership, privacy posture, and independence from the Google ecosystem.

For isaacbell.io — a personal site with a blog, a contact form, and no ad campaigns — the choice was straightforward. We don’t need predictive audiences or Search Console integration. We want to know which posts people find useful and where they found them, without handing visitor data to an advertising company to do it.

If you’re in a similar position — running a content site, an indie project, a consultancy portfolio, or anything where privacy is a feature rather than a checkbox — Matomo is worth a look.