Offer Privacy-First Analytics to Clients with Matomo

Somewhere between the fourth cookie banner revision and the second client asking whether Google Analytics is still legal, most studios realize the analytics line of their business has changed shape. The tool is no longer a paste and forget snippet. It is a compliance decision, a data quality decision, and, handled right, a billable monthly service. This guide is for agencies and freelancers who want to make that shift pay: privacy-first analytics on Matomo, packaged so clients keep it on retainer.

TL;DR

• Regulators in France, Austria, Italy, and Denmark have ruled Google Analytics use unlawful, and Sweden's authority fined telecom Tele2 SEK 12 million (about EUR 1 million) over it.
• A correctly configured Matomo setup can measure traffic without consent in much of Europe, so your client sees 100% of visits instead of the roughly 79% who click accept.
• Matomo Cloud lists at EUR 22 per month for 50,000 hits; a managed platform instance runs at EUR 9 per month flat. Both routes support white-label reporting under your brand.
• Agencies commonly resell managed analytics at EUR 49 to EUR 249 per client per month, which leaves healthy margin at every tier.
• The fastest launch path is a one-week rollout: import Google Analytics history, swap the tag, drop the banner where the law allows, deliver branded reports.

Why clients suddenly ask about analytics compliance

The pressure started with Max Schrems' noyb campaign. After the EU Court of Justice struck down the Privacy Shield framework in 2020, noyb filed 101 complaints against websites in Europe using Google Analytics, arguing the tool ships visitor data to the United States without the protections GDPR Chapter V requires. The EDPB set up a task force, and national authorities began ruling one by one.

The pattern in every decision is the same: standard contractual clauses and encryption did not help, because the US provider holds the keys and can be compelled to disclose data. Google's own transparency reports list IP addresses among data reachable through US national security requests, which is exactly the identifier analytics tools transmit.

Fines are no longer theoretical anywhere in Europe. The CMS GDPR Enforcement Tracker counted roughly 3,275 public fines totalling about EUR 7.16 billion by late September 2026, and 2025 alone added more than EUR 1.8 billion. When a client asks you about analytics now, they are really asking: what is our exposure, and who fixes it. That is a service conversation, not a tool conversation.

How much data does a consent banner actually delete

Google Analytics needs consent before it tracks in Europe. What clients rarely see is the size of the hole that leaves in their reports.

A 2023 study presented at the Traffic Measurement and Analysis conference analyzed more than 4 million real consent banner interactions across 400-plus websites. When refusing required extra clicks, only 1% to 4% of visitors refused. When the banner offered a one-click Reject All button, which regulators now require in most of Europe, refusal jumped to about 21%. Regulators did not make banners honest so people could click accept faster. A compliant Google Analytics setup today measures roughly four fifths of visitors at best, and the missing fifth is not random: it is the privacy-aware segment, often the higher-income, higher-intent one.

French officialdom ran its own experiment. The CNIL with the DITP tested banner designs on 4,026 adults: 17% refused cookies even on a neutral banner, and 31% said they are not comfortable sharing their data at all. A 2024 USENIX Security study of 3,947 participants found 48% not ready to share their data. The people banners filter out are a majority in intention, and a fifth in practice.

Consent-free measurement closes that gap. If the analytics configuration never touches the legal definition that triggers consent, the banner never appears, and every visit lands in the report. That single sentence is the strongest pitch an agency has.

When can analytics legally run without a consent banner

French CNIL guidance, widely referenced across Europe, exempts strictly limited audience measurement from consent. The conditions, in plain terms:

• The data serves audience measurement only, on one site, with no reuse for other purposes
• No merging across sites or services, and no attempt to re-identify visitors
• IP addresses truncated, and no other persistent cross-site identifier
• Stored signals expire within 13 months
• Visitors get a visible opt-out
• No handoff of the raw data to third parties for their own purposes

Matomo maps to that list directly. Disable first-party tracking cookies so no identifier is stored on the visitor's device, enable IP anonymization, set log retention to 13 months or less, switch off cross-site linking and the visitor profile if the client does not need it, respect Do Not Track, and embed Matomo's opt-out iframe in the privacy page. Matomo documents a configuration that processes no personally identifiable information at all, and its GDPR Manager keeps records of processing tidy for client audits. Matomo itself states the setup can be used without requiring consent, which is the entire point.

Two honest caveats. Rules differ by country, and German authorities in particular have taken stricter positions, so confirm the client's market before removing any banner. And this is engineering, not legal advice: you implement the configuration, the client's counsel signs off.

Three ways to deliver managed Matomo to clients

There are three realistic delivery models, and the right one depends on how much infrastructure you want to own.

Matomo Cloud at EUR 22 per month covers 50,000 hits, 30 websites, 30 team members, Frankfurt hosting, and 24 months of raw data retention, with overage at EUR 2.20 per 5,000 hits. It ships with the Google Analytics importer, a GDPR Manager, and the White Label option that puts your logo and colors on the interface. It is ISO 27001:2022 certified, which answers the security questionnaire before a client sends it. The 21-day trial needs no credit card, so you can stage a proof of concept on live traffic before the client commits.

Self-hosting trades money for control. The software is genuinely free and unlimited, but you inherit the update cadence, PHP version management, database care, and the kind of security advisories that hit the Matomo ecosystem this month. Budget real engineer hours, not best-case hours.

The managed platform route keeps per-client cost flat: a managed Matomo instance runs EUR 9 per month, updates and security are handled for you, and each client gets an isolated instance, which makes retention rules and offboarding clean. For an agency stacking ten clients, the difference between per-hit billing and a flat EUR 9 compounds quickly.

Pricing the offer so it pays for itself

Analytics is one of the few services where input cost and perceived value sit far apart, which is exactly what a retainer wants. Some honest reference math, with tooling priced at Matomo Cloud's EUR 22 entry block per 50,000 hits per month:

On the managed platform route the tooling line drops to EUR 9 flat regardless of traffic, which lifts the small-client margin to about 88% and makes low-volume clients profitable instead of filler. These retainer figures are reference points, not law: anchor to what the client stops losing, which is banner-filtered data, compliance exposure, and the hours their team currently spends arguing with tag configurations.

If you want the full pricing playbook, including bundle structures and the renewal conversation, read the agency MRR guide to managed analytics. For positioning against other privacy tools, start with the Matomo versus Plausible comparison.

What to say in the pitch

Lead with the client's numbers, not the tool. One sentence does most of the work: right now, about a fifth of your visitors never reach your reports, because the law forces your analytics behind a consent banner, and we can measure all of them, legally, with your brand on the report.

Three objections come up every time. "Google Analytics is free": it is free the way a leaky roof is free, you pay in the 21% of traffic the banner removes, in regulator exposure that already produced a SEK 12 million fine in Sweden, and in hours your team spends reconfiguring consent modes. "We have years of history in Google Analytics": Matomo's importer migrates it, and you keep GA read-only in parallel for a quarter so nobody feels cut off. "Is this legal advice": no, we implement the configuration the regulator describes, and your counsel reviews it, which makes the decision easy for their lawyer too.

Close with one action, not five: a paid two-week pilot on one property, ending in a branded report walkthrough. The pilot converts because the client sees their own full-funnel data before they decide.

The first-week rollout plan

A rollout that slips past a week loses momentum, so run it as a fixed schedule.

• Day 1: provision the instance, create the client's site, generate the tracking tag on a staging page
• Day 2: run the Google Analytics importer against historical data, then swap the live tag
• Day 3: rebuild goals, funnels, and segments the client actually uses, and name them in the client's language
• Day 4: apply the consent-free configuration, audit the banner, and hand over a privacy-policy paragraph for their counsel
• Day 5: schedule white-label email reports to each stakeholder, weekly for the first month
• Day 6 and 7: baseline dashboard plus a walkthrough call that ends in a renewal conversation

While the instance warms up, point the client's team at supporting reading: how SaaS customer success teams use the same data for retention, or the deeper guide to reselling managed Matomo.

White-label reporting that carries your brand

The report is the product. Matomo's White Label option on the Business tier puts your logo and colors on the interface your client logs into, scheduled email reports arrive as PDFs under your brand, and segment links let you hand a stakeholder exactly the view you discussed on a call, with no seat friction. Scope each client login to their site only, so the multi-client agency view never leaks.

Deliver one branded artifact every month, even when nothing dramatic happened. The monthly PDF is what a client forwards internally when someone asks why the analytics retainer exists, so make it forwardable: three charts, three sentences, one recommendation. Retention in this business is a screenshot problem.

Frequently asked questions

Do clients still need a cookie banner with Matomo?
Not necessarily. With first-party cookies disabled, IPs anonymized, retention capped at 13 months, cross-site features off, and an opt-out available, the setup can qualify for the audience measurement exemption regulators across Europe describe, so no banner is required. Some countries apply stricter readings, so verify per client market.

Is Matomo allowed to run without consent under GDPR?
GDPR itself governs how you process personal data. The consent banner requirement comes from the ePrivacy rules on storing or reading information on a visitor's device. A cookieless configuration does not store anything on the device, which is why Matomo can state it is usable without consent. GDPR principles still apply: purpose limitation, minimization, and the opt-out.

How much should an agency charge for managed analytics?
Reference bands from working agencies sit at EUR 49 to EUR 249 per client per month depending on traffic and reporting depth. Anchor the price to removed risk and recovered data, not to the EUR 9 to EUR 22 tooling cost underneath it.

Can I put my agency brand on Matomo reports?
Yes. The White Label option on Matomo Cloud's Business tier replaces Matomo branding with your logo and colors, and scheduled PDF email reports carry the same treatment. On self-hosted instances the custom logo config does the basics.

Will historical Google Analytics data carry over?
Matomo's Google Analytics importer migrates historical reports into the new instance. Run it before you retire the GA tag, keep GA read-only for a quarter, and expect minor differences where Google sampled data.

Should several clients share one Matomo instance?
You can host up to 30 websites on Matomo Cloud's entry tier, but per-client instances isolate data, respect per-client retention rules, and make offboarding a clean export instead of an unpicking job. Flat-cost managed hosting makes isolation affordable.

Sources

1. CMS GDPR Enforcement Tracker, aggregate fines snapshot, enforcementtracker.com
2. Swedish Authority for Privacy Protection (IMY): four companies must stop using Google Analytics, imy.se
3. EDPB task force report on the 101 noyb data transfer complaints, edpb.europa.eu
4. Garante per la protezione dei dati personali, decision against Caffeina Media, June 2022
5. Matomo pricing and plan features, matomo.org/pricing
6. Matomo privacy and consent-free configuration guides, matomo.org/privacy and matomo.org/cookie-consent-banners
7. I Refuse if You Let Me: Studying User Interaction with Privacy Banners, TMA 2023
8. CNIL and DITP cookie banner behavioral experiment, 4,026 participants
9. The Effect of Design Patterns on Cookie Consent Decisions, USENIX Security 2024

Try managed Matomo hosting for 7 days