Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Matomo Analytics without consent needs opt-out-improvement to become GDPR-compliant for this use case #16812

Closed
LfD-Nds opened this issue Nov 26, 2020 · 7 comments
Closed

Matomo Analytics without consent needs opt-out-improvement to become GDPR-compliant for this use case #16812

LfD-Nds opened this issue Nov 26, 2020 · 7 comments
Labels
answered For when a question was asked and we referred to forum or answered it. c: Privacy For issues that impact or improve the privacy. duplicate For issues that already existed in our issue tracker and were reported previously.

Comments

@LfD-Nds
Copy link

LfD-Nds commented Nov 26, 2020 •
edited

Hello everyone,
In Matomo 3.13.6 or newer it should be possible to operate the Matomo analytics solution without cookies (https://matomo.org/faq/new-to-piwik/how-do-i-use-matomo-analytics-without-consent-or-cookie-banner/).
As you already mentioned in the FAQs (https://matomo.org/faq/general/faq_157/) there is an issue with cookies, created despite the use of _paq.push(['disableCookies']) in following use cases:

  • when you exclude yourself from being tracked using the cookie method or using the iframe opt-out method, Matomo will create a cookie piwik_ignore set on the domain of your Matomo server (a temporary short-lived cookie called MATOMO_SESSID will also be created).
  • when you’re asking for consent before tracking visitors, two cookies may be created: mtm_consent and mtm_consent_removed.
  • _pk_testcookie is also created without any identifier and is directly deleted (it is only used to check whether the visitor’s browser supports cookies).

Using the standard iframe opt-out method on our site we can confirm, that wenn users change their opt-out in our Privacy-Page, where the Matomo opt-out is embedded, following cookies are being created:

  • _pk_id..
  • _pk_ses..
  • mtm_consent or respectively mtm_consent_removed.

This issue means, that there is currently no GDPR-compliant way to operate Matomo without cookies, because the opt-out option is a "must" as visitors should be able to change their opt-in for analytics any/multiple times. "_pk_id" and "_pk_sess"-Cookies require a cookie-banner as they are not essential for the website operation in terms of Art. 6.1(f) GDPR. The use of "MATOMO_SESSID" for security reasons and "mtm_consent/mtm_consent_removed"-cookies to save the opt-in/-out state of user's consent can be viewed as essential, if there is no way to avoid them technically.

We had unfortunately to remove Matomo from our site, because the cooke-less operation is the only option for us.

Is there a possiblity that this issue will be solved and wenn (especially the setting "_pk_id" and "_pk_sess"-Cookies)?

The cookie-less operation of Matomo is important for public entities and all website owners, who do not make e-commerce or other business with the need for high accuracy of reports. Which means, that the issue is actually concerning a very large group of users.
@Findus23
Copy link
Member

Findus23 commented Nov 26, 2020 •
edited

Hi,

I don't have time right now to answer extensively, but want to add two quick notes:

#14402: MATOMO_SESSID is needed to avoid CSRF which would allow other websites to opt-in or opt-out of the tracking without the user noticing which I think is far worse for privacy than a cookie that doesn't do any tracking.

If you suggest that Matomo should not store any cookies at all for a visitor, then how should Matomo remember that this specific user has opt out of the tracking?
(I am genuinely interested what others think would be the privacy-wise ideal solution on handling user opt-out/opt-in and remembering it without allowing to track users this way. I personally don't see any solution that is possible at all (independent of Matomo) that would work better than what is possible right now).

@Findus23 Findus23 added the c: Privacy For issues that impact or improve the privacy. label Nov 26, 2020
@LfD-Nds
Copy link
Author

LfD-Nds commented Nov 26, 2020 •
edited

Is it possible to reliably avoid the setting of "_pk_id" and "_pk_sess"-Cookies in cookie-less mode?

The use of "MATOMO_SESSID" for security reasons and "mtm_consent/mtm_consent_removed"-cookies to save the opt-in/-out state of user's consent can be viewed as essential (which means that no cookie banner is needed), if there is no way to avoid them technically. I've changed our request above. Thank you for your quick feedback!

@sgiehl
Copy link
Member

sgiehl commented Nov 26, 2020

@LfD-Nds Just FYI, we have released Matomo 4.0.0 shortly, which also brings some improvements towards cookieless tracking.
I've just checked that and if disableCookies is called for the tracker, there should not be any _pk_id or _pk_sess cookie.
The MATOMO_SESSID cookie is still set by the opt-out for the reasons @Findus23 mentioned.

@tsteur
Copy link
Member

tsteur commented Nov 26, 2020

BTW even in the 3.14 release this might be already fixed. Regarding the opt out this is a duplicate of #16791 and explained in #16791 (comment) that it is an essential cookie.

@LfD-Nds any chance you can update to the latest 3.X and check if it's fixed there for you or otherwise to the latest Matomo 4? (Matomo 4 is a staged release so it might be a few days until it becomes available)

@tsteur tsteur added the duplicate For issues that already existed in our issue tracker and were reported previously. label Nov 26, 2020
@LfD-Nds
Copy link
Author

LfD-Nds commented Nov 26, 2020

Yes, we will check/update and report the results here. Thank you all for your helpfull replies!

@tsteur
Copy link
Member

tsteur commented Nov 26, 2020

Great @LfD-Nds I will close this issue for now but we're more than happy to reopen if anything needs doing.

@tsteur tsteur closed this as completed Nov 26, 2020
@tsteur tsteur added the answered For when a question was asked and we referred to forum or answered it. label Nov 26, 2020
@NathanC
Copy link

NathanC commented Jul 18, 2022

Couldn't there be a server-side flag to opt out every user of cookies entirely, which would render this cookie unnecessary?

I've enabled "Force Tracking Without Cookies"
image

But I still see the MATOMO_SESSID. Why is it needed in this case?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
answered For when a question was asked and we referred to forum or answered it. c: Privacy For issues that impact or improve the privacy. duplicate For issues that already existed in our issue tracker and were reported previously.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
5 participants
@tsteur @sgiehl @NathanC @Findus23 @LfD-Nds