Question from Data Protection Officer

heurteph-ei · September 27, 2022, 2:07pm

@cs_matomo,
You can have a look at this looooonnng post (feature request):

github.com/matomo-org/matomo

Add an option to disable fingerprinting / config_id entirely

opened 11:43AM - 03 Dec 21 UTC

closed 07:06AM - 14 Feb 22 UTC

MoritzLost

Enhancement c: Privacy

## Summary This is continuation of #16361 and the [related discussion](https:…//forum.matomo.org/t/does-device-fingerprinting-require-consent/42869) in the forums. Right now, the stance of Matomo is that in cookie-less mode, [it doesn't use fingerprinting](https://matomo.org/faq/general/how-is-the-visitor-config_id-processed/) so it doesn't require consent. Under GDPR this line of thought is perfectly sound and reasonable. However, under the ePrivacy directive (which is now implemented in German law since 1 December, 2021 with the [TTDSG](https://dsgvo-gesetz.de/ttdsg/)), this is once again a debatable point. The key phrase in the ePrivacy directive is the 'access to information' already stored on the user's device. Of course, it's not entirely clear what this means in practice. But call it a fingerprint or not, Matomo does [access some data from the user's device](https://github.com/matomo-org/matomo/blob/4.x-dev/js/piwik.js#L3130-L3187) to create the config_id (in particular, the screen size and supported mime types). It's really up for debate if this constitutes 'access to information' – but as long as there's no legal precedence, some clients will want to cover all their bases. So it will once again be necessary to require consent before using Matomo, even without cookies or 'real' fingerprinting in place. So having an option to disable the device detection further would be great. Instead, the config_id could be based solely on User-Agent and anonymised IP address (which the server receives implicitly, so no data access is required). Of course, this would further limit the usefulnes of some reports. But this would be acceptable in order to be 100% sure that using Matomo without consent is completely safe, legally speaking.