Matomo Tag Manager

The MTM container itself does not set tracking cookies. It can store a transient first party cookie when an admin uses preview/debug mode, and the consent variable can persist a small first party preference. Tracking cookies come from the tags fired through MTM (Matomo Analytics, Meta Pixel, etc.), not from the container loader.

Loading the empty MTM container can rely on legitimate interest under Article 6(1)(f) GDPR. However, every tag that MTM fires which sets cookies, reads identifiers or transfers data abroad requires prior consent under Article 5(3) ePrivacy. In practice you must gate those tags with the MTM consent variable connected to your CMP.

Two layers apply. The container loader: legitimate interest (Art. 6(1)(f) GDPR). Tags that store or read information on the device, profile users or transfer data: explicit, granular consent (Art. 6(1)(a) GDPR) plus Art. 5(3) ePrivacy. Document the distinction in your record of processing.

No. The MTM container is served from the customer Matomo instance (self hosted in the EU) or from Matomo Cloud in Germany. There is no transfer to the United States by default. Tags fired through MTM may still create their own transfers (a Meta Pixel will continue to send data to the US), so the assessment must be done tag by tag.

A DPIA is generally not required for the container itself, particularly when MTM is self hosted in the EU and used only to manage tags. A DPIA may be triggered by the underlying tags: session recording, advertising profiling, large scale tracking or transfers to the United States.

Self host MTM in the EU or use Matomo Cloud, enable the consent variable, integrate it with your CMP so that consent dependent tags only fire after opt in, prefer Matomo Analytics in cookieless mode, document MTM and every fired tag in the cookie policy and review the container regularly.

The main alternative is Google Tag Manager, but GTM creates third country transfers and does not solve the underlying compliance issues. Other options include Tealium iQ, Commanders Act TagCommander, Piano Manager, server side GTM hosted in the EU and Adobe Launch. None of them ship with Matomo Cloud in Germany out of the box.

List Matomo Tag Manager itself (publisher: InnoCraft, hosting: self hosted or Matomo Cloud Germany, legal basis: legitimate interest, no third country transfer for the container) and then list every individual tag fired through MTM with its own purpose, retention, cookies and legal basis. Update the policy each time a new tag is added in MTM.

Only one first party cookie, mtm_consent (or mtm_consent_removed when consent is refused), which stores the consent decision and the timestamp. All other cookies are set by the tags fired by the container, not by MTM itself.

Loading the empty container before consent is permissible because MTM by itself does not collect personal data. You must, however, ensure that no consent gated tag fires until the visitor accepts. Configure each tag with a consent type and wire the container to your CMP.

The container itself is based on legitimate interest (technical necessity to fire tags). Each tag inherits its own legal basis: legitimate interest for hardened analytics, consent for marketing or advertising tags.

The container script is served from your Matomo instance, so no US transfer occurs from MTM itself. Tags fired by the container may transfer data to their respective vendors and must be assessed individually.

Not for the container. Each tag must be assessed on its own merits. A DPIA is recommended when MTM is used to deploy large numbers of marketing tags, sensitive tracking or behavioural advertising.

Host Matomo in the EU, classify every tag, assign the matching consent type, connect MTM to your CMP, restrict admin access with the Matomo permission system and use container versioning to keep an audit trail.

Google Tag Manager (the market leader, with US transfer concerns), Tealium iQ (US), Adobe Experience Platform Launch (US), Piwik PRO Tag Manager (EU), Commanders Act TagCommander (FR) and the open source Tag Manager Plus.

List the mtm_consent cookie as strictly necessary (consent technology) and add a dedicated entry for each tag fired by the container. Re generate the policy after every container publish.