A proposed Matomo launch in England, reviewed at the desk and held

This privacy first measurement launch review reaches a hold verdict for a hypothetical Matomo deployment at an organisation operating in England. This is not a review of a real England-based organisation, and no such organisation was contacted. The product documentation answers useful capability questions, but implementation evidence is missing.

What to take away

Who reviewed what

The reviewer was the privacymeasurement.co.uk editorial evidence desk. The desk is anonymous: no individual byline is attached to this review. The review covered public documentation for Matomo Cloud and On-Premise where the cited page identified both, plus independent UK regulator, security and government testing guidance. It did not assess a real customer, supplier proposal or sector.

The evidence was reviewed on 5 September 2026. No supplier paid for inclusion, provided access or had editorial input. There is no referral arrangement or disclosed commercial relationship. Dated note: the cited Matomo pages reflect the documentation as read on 5 September 2026; no Matomo release number was frozen for this review, so confirm the version you deploy.

Method and hands-on limits

The desk method asked whether records could support six launch gates: known collection, controlled access, retention and export, permission behaviour, security operations, and accessible accurate reporting. First-party pages evidenced only documented features. ICO, NCSC and GOV.UK pages supplied independent expectations, not product certification.

This review is hypothetical. It is not a review of a real England-based organisation, and no England-based organisation was contacted. No installation, cloud tenancy, tag, consent interface, API, dashboard, audit log, deletion, export, assistive technology or incident route was tested. Performance, support and contract terms were not compared. The verdict concerns evidence readiness, not product quality or UK compliance.

Evidence that can enter the pack

Matomo's first-party page on tracked data lists default and optional information, including visitor identifiers, events, goals and ecommerce configuration. Default cookies include _pk_id and _pk_ses, and tracked fields can include visitor ID, page URL, referrer and event category. This provides questions for a field inventory. It does not establish what the proposed implementation would collect.

The supplier's user roles documentation describes View, Write, Admin and Superuser permissions for Cloud and On-Premise. Role assignments sit in the access table and API tokens in the user_token_auth table. A launch pack could map those roles to named users, but local assignments and least-privilege configuration remain untested.

Matomo documents automatic removal of older raw tracking logs on its historical-data deletion page. The On-Premise setting is delete_logs_older_than, and raw logs sit in matomo_log_visit and matomo_log_link_visit_action. That record warns that deletion can affect data. It is not evidence that a retention schedule has been approved or executed.

The supplier also describes API, warehouse and database routes on its raw-data export page. Availability varies by deployment. Database export columns include idvisit and idsite. An exit test would need the buyer's chosen route, complete sample, schema, time, access control and restoration check.

Gates that remain untested

The ICO's UK-wide storage and access guidance requires analysis of what the technology does and why. Neither a first-party cookie nor an on-premise label decides permission or the downstream UK GDPR position.

Matomo can set requireConsent to consent, which blocks _pk_id and _pk_ses until the visitor agrees, and writes an mtm_consent_removed cookie when consent is withdrawn. The proposed consent states, lawful basis, roles, notice, retention, rights and transfer facts are absent.

Security is also open. The NCSC advises customers to configure SaaS securely, control privileged access, retain useful logs and prepare incident recovery in its SaaS guidance. Matomo's On-Premise settings include force_ssl and login_allowlist, and API tokens sit in the user_token_auth table. Public feature pages cannot show the buyer's identities, alerts, log protection, backups or provider contacts.

Functional and measurement checks need evidence. A launch candidate needs synthetic journeys across approved permission states, field validation, duplicate handling and reconciliation to a known source.

The Matomo dashboard uses DataTables controls, so manual and assistive-technology review should cover export menus and table pagination. GOV.UK's accessibility testing method illustrates why automated checks alone are insufficient for government services; qualified advice should set the buyer's obligations and coverage.

Bounded verdict and route to proceed

Hold production collection and decision use. The hold is caused by no buyer specification, contract, configured account or test evidence, not by an adverse finding about Matomo. A narrower proceed decision becomes possible only after named owners supply the evidence set out above.

The release approver must tie any decision to one version and list open exceptions with owners and expiry dates. A failed permission case stops the affected collection. Material unexplained variance withholds the report. Loss of critical access logging invokes security review. These gates should not be traded against each other or converted into an overall score.

Before you act

Common questions

What did the review actually cover?

The desk read public Matomo Cloud and On-Premise pages and independent ICO, NCSC and GOV.UK guidance. It reviewed documents only, not a live deployment, supplier proposal or sector.

Why is the verdict a hold rather than a rejection?

The hold reflects missing implementation evidence, not a finding against Matomo. Without a buyer's own specification and test results, the desk cannot approve production.

What would allow a narrower proceed decision?

A named owner set must provide the approved field and flow specification, access evidence, retention and export tests, permission journeys, security and recovery results, accessibility findings and a rollback rehearsal. The release approver then ties the decision to one Matomo version and lists exceptions with expiry dates.