Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Piwik PRO is a privacy first analytics and tag management suite hosted in the European Union and built as a GDPR friendly alternative to Google Analytics.
Piwik PRO Core is the analytics module of the Piwik PRO Analytics Suite, a privacy oriented platform for measuring website and product usage. European organisations, public bodies and regulated industries often adopt it as an alternative to Google Analytics because data can be hosted inside the European Union and the product is built around data ownership and granular consent.
In its standard configuration Piwik PRO sets first party cookies such as _pk_id and _pk_ses to recognise returning visitors and group page views into sessions. It records page URLs, referrers, device and browser details, approximate location derived from the IP address and on site interactions. IP addresses can be anonymised and the platform also offers a fully cookieless tracking mode that relies on no persistent identifiers.
Because the standard mode stores and reads identifiers on the user device, it falls under Article 5(3) of the ePrivacy Directive, which requires prior consent for non essential storage. The data collected, including online identifiers and IP addresses, is personal data under the GDPR, so a lawful basis, transparency and respect for data subject rights all apply.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
When Piwik PRO runs in standard analytics mode you must obtain prior, informed and freely given consent before the tracking tag sets cookies. The suite includes its own Consent Manager that can hold analytics back until the visitor agrees. In the anonymous, cookieless mode you may be able to rely on legitimate interest, but confirm this with your data protection officer.
With the default European Union hosting, visitor data stays on servers inside the EU and is not transferred to third countries. Piwik PRO also offers United States and private cloud hosting; selecting those options introduces international transfers that must be covered by a safeguard such as Standard Contractual Clauses or the EU US Data Privacy Framework.
Load the Piwik PRO tag only after consent, list its cookies in your cookie policy and confirm the hosting region in the administration panel. Enable IP anonymisation, set proportionate retention periods, sign the data processing agreement offered by Piwik PRO and record the platform in your register of processing activities.
Websites using Piwik PRO Core must obtain user consent under GDPR regulations.
DPIA considerations
A full DPIA is rarely mandatory for standard consented web analytics, but it is recommended when Piwik PRO is combined with cross device tracking, user IDs or large scale behavioural profiling. Document data minimisation, retention periods and the anonymisation settings applied.
Sample consent text
We use Piwik PRO analytics cookies to understand how visitors use our website and to improve it. These cookies are set only if you accept analytics.
Third-party domains contacted
piwik.procontainers.piwik.procdn.piwik.proCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| _pk_id | Analytics | 13 months (configurable) | Stores a unique visitor identifier so Piwik PRO can recognise returning visitors. |
| _pk_ses | Analytics | 30 minutes | Marks a short lived session to group page views from the same visit. |
| _pk_ref | Analytics | 6 months | Stores attribution data about the source that referred the visitor. |
| stg_traffic_source_priority | Analytics | 30 minutes | Used by Piwik PRO Tag Manager to determine how traffic sources are attributed. |
Piwik PRO Core collects user analytics data — you legally need a consent banner. Try FlowConsent free.
In standard mode Piwik PRO sets first party cookies such as _pk_id, which identifies the visitor, and _pk_ses, which marks the current session. Their lifetimes are configurable and the suite can also run without any cookies.
Yes, in its standard analytics mode you need prior consent because it stores and reads cookies on the device. In the fully anonymous, cookieless mode consent may not be required, but you should confirm this for your jurisdiction.
Standard analytics relies on consent under Article 6(1)(a) of the GDPR together with Article 5(3) of the ePrivacy Directive. Anonymous mode can sometimes rely on legitimate interest under Article 6(1)(f).
Not when you use the default European Union hosting, where data stays in the EU. If you choose US or private cloud hosting, transfers must be protected by Standard Contractual Clauses or the EU US Data Privacy Framework.
A DPIA is not usually required for standard consented analytics, but it becomes advisable when you enable user IDs, cross device tracking or large scale profiling. Document your reasoning either way.
Place the tag behind a consent gate, enable IP anonymisation, set short retention periods, sign the data processing agreement and describe the cookies in your policy. Keep the EU hosting region unless you have a reason to change it.
Other privacy oriented analytics include Matomo, Plausible, Fathom and Umami, while Google Analytics 4 remains the most common but more transfer heavy option. The right choice depends on hosting location and consent strategy.
List each Piwik PRO cookie with its name, purpose and duration, state that analytics runs only after consent and explain how visitors can withdraw it. Review the entry whenever you change tracking settings or hosting.