Hello everyone, it is currently 13h00 and I am ready to start the conference that I had planned for today, which is called How to configure Matomo in the respect of the RGPD.
Before starting, I just want to make sure that the sound is ok. Frédéric, do you hear me correctly?
Yes, perfectly.
I am going to start this conference, which is scheduled from 13h00 to 13h45, including the different questions and answers that each of you may have in relation to this issue.
Do not hesitate to go to chat.matomocamp.org to register if you have not already done so, and once there, do not hesitate to ask questions in the room that is scheduled for this event.
Frédéric, who is the moderator of this conference, will ask these questions, either directly or at the end of the conference.
You can also ask questions throughout the MatomoCamp on this particular issue, whether today or tomorrow, since the Q&A room remains open.
I will perhaps, for the needs of the conference, keep a little more of a passing band and stop my camera.
The idea in this conference is first that I introduce myself, then that I present to you the objectives of this conference,
then to give you a definition of what the audience analysis is, since in a way it is what we are talking about today within the framework of the RGPD.
Then I will go over a definition of what personal data is in the sense of the RGPD.
Then I will deal with the exemption of consent with Matomo, which concerns the majority of the cases for which people will use Matomo and how to do that in respect of the RGPD.
Then I will address a part that we see quite few.
How do we do when we want to deal with personal data with Matomo and that we must recover the consent of the user?
And I will conclude this conference.
To introduce myself quickly, my name is Ronan Chardonneau.
I was lucky and honored to work for the Matomo team.
When we say the Matomo team, it means a lot of things.
I mainly worked for Inocraft from 2017 to 2019, which is the private company that is the main contributor to the development of Matomo.
In fact, it is not exactly true that I worked for the Matomo team, I worked for the Inocraft team.
But the Inocraft team being the main contributor to the Matomo project, in a way, through my work that I was able to do within the Inocraft company,
I was able to contribute to the development of the Matomo software and the Matomo software, in a way, I contributed a lot as a volunteer,
especially through the dissemination of knowledge, of tutorials that you can find on the Internet,
either on my Pertube channel, either on my YouTube channel, or also on different MOOCs that I was able to create,
including that of the Floss Marketing School, or also a MOOC that I was able to create on the Zest platform of knowledge, which is an association for non-profit purposes,
which releases tutorials, knowledge around different technologies or other knowledge.
What is interesting is that when I worked for Inocraft, from 2017 to 2019,
I was the person who was in charge of the implementation of the RGPD within the company.
And that allowed me to see a lot of things.
And the idea is, through this conference, and also the experience that I was able to have after leaving Inocraft,
to be able to share a little bit of all this in today's conference.
I am a trainee and independent consultant on Matomo, formerly it was not Matomo, it was called P-Week.
Since 2010, I have been one of the very first people to have a certain way to bet on P-Week, on Matomo,
and to have decided to build a whole structure, a whole business around that,
which is in particular the subject of a conference that will take place just after, from 2pm to 3pm, which I will do in English,
where I will explain how to develop an economic activity around Matomo.
This is my main job, I have been a trainee and independent consultant on Matomo since 2010,
and I am also the head of social and e-danger conferences that I have been in digital marketing,
now we call it digital marketing, since 2012.
In fact, I am training students in digital marketing, and for the past few years now,
I have been trying to bring them knowledge in digital marketing using free software,
and Matomo is naturally the one I am going to talk about the most.
I have a third activity that is quite recent, which is that I am an international expert on the subject of free software
from the Ministry of Higher Education, Research and Innovation,
on the subject of open science.
It consists of going abroad and being the spokesperson, the ambassador of the government
to explain what the government's policy is in terms of open science,
and in particular what is the policy that is carried out by the government
around the release of software produced by researchers
that in a certain way must be in free access and under license.
So this is a project that is brand new for me,
I may have the opportunity to talk about it in other conferences later.
And I am also the creator of a platform called Flossmarketingschool.com
that I strongly advise you to go and consult,
it is an internet site on which I actually release all the courses that I provide at e-danger,
these are courses in free access, you have tutorials,
textual explanations, you also have exercises,
and it's really great if you want to educate yourself in free software and digital marketing.
So the objective of the conference will be the following,
is that you discover how to learn how to get in concrete conformity with Matomo for the RGPD,
so I will share my screen, I will show you the different contents,
I will show you the back-end of Matomo,
what are the options through which you have to navigate to be in conformity.
If you have any questions, feel free to go to chat.matomocamp.org
and ask your questions, since it is through this intermediary that I will be able to help you even more,
to be closer to your needs.
So I will now advance a little, I will come back to this link a little later,
which is actually the key to the conference,
it is a guide that LACNIL has put online and which explains why in a certain way
and how software editors can be exempt from consent,
so it will be very interesting since it is a list of factors that are indicated
that explains how a software editor can be exempt from consent
and how we can collect data on users directly
without having offered them an acceptance list.
So the prerequisites for following this conference are the following.
I consider that for this conference, most of you already know the RGPD,
so if this is not the case, I strongly encourage you to go to the official link,
eur-lex.europa.eu,
on which you will find the official text of the RGPD which is 88 pages long.
Its reading and comprehension, to have it done,
require half a day of work or at least time to reflect, to read.
It is worth the investment in time, since it also allows you to be well educated,
well trained, what is the RGPD.
One of the basic rules of the RGPD is that the text must be readable and understandable to all,
so we are not on a document that needs to be BAC plus 15 to be able to read it.
And it's really very interesting because it allows you to see everything in the RGPD,
although not everything is concerned with everything that the RGPD says,
but it allows you to know what the RGPD is by a source of information
that has not been interpreted by a third that comes directly from the EU.
And that has its advantage.
Then I strongly recommend you to follow MOOCs that are related to the RGPD application or the RGPD in general.
Unfortunately, the MOOC edited by Acneel is currently in the process of reissue,
so if you go to it, it's a shame because the old version was very well done,
I think it could have gone online.
You will find it on this link because there is one day or the other where they will update it,
but it is good to know that they are in the process of renovation.
However, I know that when I started to educate myself on the RGPD,
Acneel had not yet released its online MOOC.
I had followed a training course by a Dutch university
which also apparently reviewed its MOOC.
It seems to me that it was this one, but I'm not sure.
I put the link there as an indicator.
I think you can easily type MOOC RGPD on a very well-known research engine
and easily find other MOOCs,
but I assume that to follow this conference,
you already know what a MINIMA is than the RGPD.
Before directly attacking the conformity of Matomo in the RGPD framework,
let's go back to the fundamentals and basically explain what we are talking about.
We are talking about Matomo.
What is Matomo? It is a solution in audience analysis.
The big question is what is a solution in audience analysis?
A solution in audience analysis is nothing more or less than a system of information.
It is just a database.
You have to understand what Matomo is.
It is a database.
It is a place that stores data.
What does it contain?
It contains traces of exchange between two computers,
between the computer that will be the client,
that is to say the visitor or the user,
if you have a mobile application, if you have an internet.
Taking a website is perhaps much simpler.
You have a visitor who arrives on your website.
Your website is hosted on what?
It is hosted on what is called a server.
You have a request that is made by a computer, that is to say a client,
and you have in front of you another computer that responds to it, which is called the server.
These two entities communicate via what?
They communicate via what we call HTTP requests.
What do these HTTP requests contain?
They contain information that is standard in communications between two computers,
which are the IP address of the client computer,
the time and date at which the request is made,
the page that is requested,
so the page that is requested is also a URL,
and via the URL the title of the page is also recovered.
The way in which the user came to the site,
how he or she knew it in a certain way,
which is called the URL reference,
is also transmitted behind everything that is going to be screen resolution.
Also through what is called the user agent,
the language of the browser is also transmitted.
And behind a little more information on the browser,
such as its version or the operating system on which it is used.
All this to tell you that this information is stored in a database.
I will maybe share my screen, it may be more explicit directly,
and that's why I think that Matomo is pretty great.
At least at Matomo you see what the database looks like.
Frédéric, do you see my screen well, what I share?
Yes, absolutely.
Typically, this is the database of Matomo.
This is what you have to install the day you install Matomo on the server of your choice.
We must not forget that Matomo, what makes it strong,
compared to all the other software on the market,
is that it is a free software.
It is a software that you directly recover on a site,
namely matomo.org.
Then, once you have this software,
you decide on the server on which you are going to install it.
And when you install it on a server,
you have to install what is called a database and it is there, our database.
This is where you have these famous HTTP requests
which contain data that have been extracted
and which have then been inserted into the database.
This is where we see, for example, the identifier of the visit,
the site on which you deployed Matomo.
You will then have everything that will be the IP address of the user.
You will have the location that will be represented here.
The information that we see here is not necessarily the most explicit,
but if we go a little more to the right,
we have directly information that we are more used to seeing,
namely the reference, namely the language of the navigator,
namely what type of engine is used,
basically which navigator, the version of the navigator, etc.
In the end, everything is recorded here in this famous database.
A solution for audience analysis, I remind you,
is just a database that contains the basic information
that has exchanges between a navigator, a client computer, and a server.
To make it simple, what are the personal data collected by default in Matomo?
In reality, in these famous personal data that we have, we don't have much.
Probably the most intrusive that we can have is the famous IP address
which also allows us to identify generally a home,
since the IP address is provided by your Internet access provider.
But in reality, it is especially dangerous if within a database,
you only have one person, since in this case,
it would mean that this IP address, at least one person,
your Internet access provider can know who is behind,
which is naturally less the case when in a database you have more individuals.
All this to tell you that already, in Matomo,
you don't have any information that is very personal.
Now, however, what you need to know is that in Matomo,
you can extend its data collection power with specific monitoring codes,
which are the object of a documentation found on developer.matomo.org,
which is represented by, for example, personalized dimensions,
which will be information, data that you can assign to your visitors,
which allows you to know more about them.
These data do not come from the Holy Spirit, naturally,
they come because they are already probably present on your website.
For example, you have an e-commerce site,
and on your e-commerce site, a person, when creating an account,
will indicate, for example, his name and first name.
This information is stored in the database linked to your website,
and you can, through personalized dimensions,
come and collect, for example, this data,
and match it with the visit.
But this will really be an action that will be done by the website editor,
the person who controls it on the source code,
and who will decide, of his own free will, to be able to put this personal data.
Same thing with the user ID.
This is the same.
This is a code that specifically allows you to recognize the user.
But this is the same.
You can recognize the user only if he or she has given you the information.
This will typically be the case when a person is going to log in on a site.
I take for example the example of an e-commerce site.
If a person logs in on an e-commerce site,
it is that at some point, he or she will decide to create an account on your platform,
and when the person creates an account,
she will give you, or in any case you,
you will make a kind of system to be able to put an ID.
Generally, the ID will be the nickname,
that the person will have decided to create when he or she has created the account,
which will be used to create the user ID.
After that, this is more of a point of surveillance.
Be careful because the way you integrate the code into Matomo
can be done through plugins.
This is especially the case when you use, for example,
plugins already developed for WordPress to integrate Matomo,
or PrestaShop, or whatever you want.
In fact, these plugins, you have to imagine that you have integration teams,
you have developers who create specific features
that are often very requested for these CMS,
and which can automatically include the collection of personal data.
You can imagine, typically, the case of e-commerce.
You develop a store on PrestaShop,
or you develop a store on WordPress.
Naturally, if you put Matomo,
you are waiting for Matomo to collect information
about e-commerce, shopping cart, etc.
By using these plugins,
it is not said that by default,
these plugins do not directly integrate the functions of this e-commerce,
which can be considered,
in any case, this is the case, we will come back to it later,
by LACNIL as being intrusive data,
in any case, which requires the user's prior agreement to be able to collect,
since naturally, through an electronic transaction,
we can indirectly know who is the person who is hiding behind the command.
And then, naturally, in Matomo,
we can find personal data that comes up when your site is poorly designed.
We can imagine, for example, a website for which you have URLs,
and the URLs in question contain the name and first name of an individual,
or an identifier, something like that.
This is especially the case on certain sites,
when you connect to a back-office,
sometimes the developers had the bad idea of putting the user's identifier in the URL,
and when this is the case, naturally, when this URL is loaded,
it sends the information directly to Matomo.
But by default, normally, in Matomo,
the most intrusive information that you are going to get,
it will be the IP address.
All this to say that by default,
there is not much you should be afraid of
to be in compliance with the RGPD,
even if we will see it just after,
there are still a few little things that will have to be done.
On the other hand, where you should be well concerned with this RGPD problem,
this is all the diapo that I have just gone through.
Naturally, if you have specific codes,
there you get personal data,
and there you risk much more my opinion of the law,
if there are things that are...
My data is controlled by you.
So, to remember that it is very important,
in France, the RGPD application is done via the ACNIL authority.
This is not a small information,
that is to say that I made the choice today to do this conference in French,
simply because for me it is quite simple
to be able to verify the ACNIL doc and present it to you.
However, what I am telling you here for France,
it does not work naturally if you have a website
that is for a country abroad,
since when it comes to abroad,
there is no longer the ACNIL that is cold,
so you have to look at each time
which is the equivalent of the private life commission
in the country you are aiming for.
We can imagine a French company
that develops a site for Germany,
there it goes that it is not the ACNIL rule
that will have to be followed to put Matomo in conformity,
it will be directly that of the German authority.
Hence the interest during the Matomo camp
to be able to exchange with people from Germany,
it allows you to know a little more about what is being done.
For this conference, I will just talk about the Franco-French market.
So, what does ACNIL say
in relation to the conformity of Matomo with the RGPD?
If you do not collect personal data,
then you can benefit from what is called an exemption of consent,
that is to say that you are not obliged to have explicitly
a user who comes to the site,
sees a banner that says,
do you accept that your data is collected?
No, you can do without it.
This is the main reason
why webmasters come to choose Matomo.
Note here that you can benefit from an exemption.
The can is very important,
since naturally it will imply that the exemption is not automatic.
It will be necessary to do things to be able to benefit
from this authorization of data collection
without the user's prior agreement.
If you ever want to use Matomo to collect personal data,
so here we will see more of the case of the kind,
but in fact, I put Matomo on my site,
but in fact I want to collect personal data,
such as the one I presented to you earlier,
transactions and trade.
It can be information on the individual,
as I told you earlier,
it can be his IP address in full,
there you have no choice.
You will also have to obtain the consent of the users.
Here on solution number 2,
you are at the same level as if you were using Google Analytics
or any other solution that specifically needs the user's agreement.
As far as what you need to know and how to get along,
it is directly posted on the Acnil website,
on acnil.fr slash fr cookie autotraceur.
I will talk about it in a few minutes
and then show you a little bit more concretely what it looks like.
Just the troll moment of the day,
be very careful at Acnil,
be vigilant when we talk about RGPD or others,
since this is a message that I sent,
this answer is the continuation of a message
that I sent about 80 days ago.
At Acnil, I agree to say that they are not a lot of staff
and that they put time before answering.
They indicate well on their site that they currently have a lot of requests
and that they need an average of 60 days to be able to answer,
but I was quite surprised to see that I wrote to them about 80 days ago.
I received an answer on Tuesday, October 26,
my question was the following,
I did not see that Matomo was listed as an example of consent solution,
and I simply asked them
what date Matomo will be listed as consent,
and I received the answer on Tuesday, October 26,
thank you for contacting me,
I would like to inform you that the Matomo tool
no longer appears in the list of solutions
without the consent of the internet users.
Indeed, this tool has been removed
due to the lack of conformity in the new recommendations of Acnil.
Fortunately, I did my job correctly,
it turns out that it was at least a good week that Matomo was listed as consent,
there was a conformity guide that was on the Acnil website,
but it's just that the person who answered me
had not even been on the Acnil website to check the information,
so it's pretty crazy to say wow,
they took 80 days to answer,
and in addition when you need an answer, it's not good.
All this to tell you that what is called the DPO,
the Data Protection Officer,
the person in charge of respecting the private life
of users in your infrastructure,
in your institution, in your company,
you will always have to check by yourself,
there is a role of continuous surveillance
and to always dig and look for new information.
So that's all to tell you,
beware of Acnil too,
since unfortunately I think they have a lot of requests
and they don't have the opportunity to follow all the files,
but Matomo is well exempt from consent
and that's exactly what we're going to see now.
So, I'm going to share my screen,
so I'm going to have to ask the same question again, I'm sorry.
Frédéric, do you see my screen well?
Yes, actually.
We are on the Acnil website, on your side?
Yes, exactly.
Great, thank you very much.
So, the Acnil website is very well done.
You have two parts here,
I am a specialist and I am a professional.
The one that interests us is the one called I am a professional,
so you click here.
Then you go to technology
and what will interest us is Cookie and other tracers.
You click on it.
Once you are there,
you have different information blocks that are listed.
The one that interests us is the one called Cookie Solutions
for audience measurement tools.
I strongly encourage you to regularly check the Acnil website,
which has evolved quite a bit.
It's also the same on the Matomo.org website.
The RGPD, even if it dates back to 2018,
and we talked about it before,
we have information that goes on.
So, don't hesitate every time.
What was true yesterday may not necessarily be true today,
or in any case has been updated.
And there, on the Acnil website,
we have the list of different audience measurement solutions
that are exempted.
So here, I'm going to zoom in a little bit.
There, you have the list of the different solutions that are available.
And there, you have the solution of Matomo Analytics version 4.
This can also be important,
that you need version 4 to be able to be exempted.
And the configuration guide that is present here.
I'm not going to go straight into the configuration guide.
I will first present, in my opinion, what is most important.
It's the file.
That is to say, what Acnil asks for
for a software editor to be exempt from consent.
For me, it's important that you know,
because otherwise we don't necessarily understand
why certain solutions are put forward,
why some are exempted from consent and not others.
So that's the form that the software editors have to fill in.
So, AT-Internet, Matomo,
any other solution you might have in mind
to be able to have the right to be exempted from consent from users.
So you have a list of nine points to respect
to be able to edit the famous configuration guide
that I showed you earlier.
And in fact, the most important, in my opinion,
is point number one,
which directly shows that solutions such as Google Analytics
are seen badly, how they could go.
So point number one,
is deactivation of any data processing for your account,
if necessary, and regardless of the purpose to follow.
So what does it mean?
It means that if you are a software editor,
you have no choice.
Either you are a free software,
that is to say that you are a common good,
and it's not a problem, people are free to use the software
at any time they want,
or you are obliged to be a software editor
who provides a service that is paying.
In fact, you have no choice,
because a company by definition is not there
to make money.
So that's condition number one,
which is really important,
in all cases, exit Google Analytics.
In fact, they just can't even go through,
here they can't be an example of consent,
since that would mean that they provide
the service for free,
which naturally costs a lot of money
in terms of storage and data,
and it's just not possible.
Then we have all the other conditions,
which will make us open our eyes
more on the features
that we are no longer entitled to use by default
without having the consent of the users.
So that's all that's going to be
the deactivation of the user's cohort,
the limit of the IP address collection,
so the fact that we can collect
an IP address in full,
we must pseudonymize it,
deactivation of any external data import function,
so it's not possible to do data crossings,
so to be able to inject, for example,
data by default from a CRM,
to be able to have more sense
on the data we have inside Matomo,
deactivation of data exports
containing unique identifiers
or non-aggregated data,
so that's the possibility,
a little bit the opposite of this one,
it's the possibility of being able to use
Matomo data to come behind,
transform other existing information systems
to be able to exploit personal data.
Limitation of the tracer warehouse
to a domain or mobile application,
so that's what we call cross-tracking,
it's the fact of not being able to follow
a user from one site to another,
so that's particularly useful
and we understand the interest
when you visit a cooking recipe site
and you visit a car site,
and the owner of these two sites is the same,
so the possibility of knowing more about you,
the possibility of being able to target you more,
and share data between the different information systems,
even though you don't know
that it belongs to the same company behind.
Deactivation, the ability to visualize a single browser in the tool,
so that's at its point in Matomo,
that's all that's going to be the visit journal.
Any marking that allows you to retrieve personal information,
so that's going to be all identifiable,
that you can go and retrieve,
and the existence of a tool
of position functionality in the cooking,
of audience measurement,
so that's what we call Locked Out,
which probably some of you already know,
you didn't give your consent,
even if your solution is exempt from consent,
you still have to provide a mechanism of opposition.
So let's now go to Matomo specifically,
what it is for the confirmation with the RGPD,
so we have the little configuration guide
that we find here,
which is rather well done,
even though most of us
have minds that are always a little bit tortured,
we are always going to dig,
dig, dig even more,
but in the state it is really,
it already gives the right directives to follow.
So there they tell us two things,
Matomo in self-guided mode,
or Matomo in cloud mode,
for this presentation I will just consider
the self-guided part,
not the cloud part.
What changes,
and if there is the cloud part,
your DPO has above all the responsibility
to link here what we call the DPA.
This cloud version,
it is specific to the cloud
that the Matomo team proposes,
so matomo.cloud,
and naturally does not concern
other hosts that you could use,
such as Ghandi Le Fay,
Emprunt Digital Le Fay,
Digitalista B which is also in Matomo Camp,
Le Fay,
so that's why I'm not going to talk too much
about part B,
I'm going to talk more about classic relationships
that a host can have.
I think that on the contrary,
what interests us more here is really
the self-guided part,
that is, it is you who choose the server.
So, in the things to know,
to be in conformity with the new
ACNIL directive,
so this conformity guide
has nothing to do with the old one
which was on the ACNIL site
and which was mainly talking about
the old name of the solution,
certainly things that were already present
in the old guide, but there are new things
that came to be added.
So one of these things is
the deactivation of export
features.
So these export features are
relative to the little link that allows you to export
data, but also above all
it is the fact that we will no longer
have the right to use
by default the use
of the visitor's journal. This can be very annoying,
especially for analysts who do
a bit of debugging like me.
You can only have this function
if you are a super user.
So in my case, I am
a super user, so there is no problem.
So here I am in my Tomo.
If I want to respect the first
instruction that ACNIL gives me,
I will have to go here in system,
click here in general settings
and once I am in
general settings, click on
deactivate the visitor's journal
that I will find
here.
So I will have to check
these boxes.
I will first show you what the visitor's journal is
for those who do not
identify what it is.
The visitor's journal is a
super great feature that allows you
to see
what actions
the users perform.
So you have the right
to use it by default,
if you want to be exempt from consent.
I think it is rather understandable
the idea that a user who comes back
several times, who has a certain behavior,
we will be able to
identify him
and potentially identify
who he is, if we have another source of information
that tells us that someone
is outside our website, for example.
So to respect
the first criterion,
you will have to check here.
Click on
I hope it's this address.
No, it was not the right one.
Sorry, I go back
to where I was.
I will pass my story.
Registered.
It must be this one.
So there we are.
Consequences, what will it be?
It says that now that this box
is checked, Abracadabra,
the visitor's journal has disappeared.
The visitor's journal has disappeared
from this screen.
It is also the same
for the segmented log.
So if I am going to consult an archived report
and I am going to ask, for example,
here what are the users who come from Serbia,
you see that the little icon of the segmented log
has disappeared.
This is the first criterion.
Second thing to know.
Allow visitors
to refuse to be followed.
What is called Locked Out.
There is no secret about the old Matomo guide.
It has always been the case.
Even if you are exempt from consent,
you have to offer
a mechanism of opposition
to your visitor.
This is what we will find on the
Privacy Policy page,
a confidentiality page for private lives.
You have to provide
clear information
to your users.
You have to be able to offer
a mechanism of opposition.
On this confidentiality page,
you have to explain what Matomo is,
what it is used for, what data is collected.
You also have to offer the possibility
to the user, even if you collect
anonymous data on me,
I don't want you to collect it and oppose it.
It's not hard to set it up.
You just have to go here
in Matomo,
you have private life,
private life, you have users' inscriptions
and there you have a small iframe
that you can copy and paste.
If you think it's not super sexy,
because after all we are talking about an iframe,
so it's always a little annoying,
but you have the possibility
to use personalized HTML.
I don't remember
where we found it.
Implement a custom without
using JavaScript.
They put a complete example
that allows you to have the script
with the look and feel of your website.
It's generally more aesthetic.
When we have a little time to spare,
we prefer to take this solution
rather than the iframe
directly from Matomo.
Next point on our to-do list.
Check that the default parameters
of Matomo are still in place.
By default, Matomo will set up
the anonymization of the IP address.
Here we say that
check that the default parameters
are still in place because
it is not said that you do not take the baby
to someone, so the project to someone,
and that this person can have,
for X or Y reasons,
a default functioning Matomo.
At the top, you have to look
that you are at least
on this level of anonymization
and that you are not on someone
who has changed this box
and who has recovered the entire IP address.
By default, there is little chance
that it will move, but it never happens.
I don't know, someone wanted to debunk it,
to use it more on users.
Make sure that third-party cookies
and cross-domain cookies are not used.
By default, Matomo uses only
the first-party cookies, so there is no need
to take care of it.
Normally, by default,
you should not have it.
Here we reach the point
that we just mentioned.
Maybe someone did some work before you
and put in place the cross-domain
and put in place the third-party cookie part.
I will not go into too much detail.
It will be about mechanics
that you will find inside
the Matomo config file,
where it will be clearly indicated here.
For that, you have to access the server,
access the config.ini.php file,
if it is not there,
well, there is no need
to torture yourself.
There is no third-party cookie
feature that has been put in place.
Same thing for cross-domain tracking.
This is something that we will see
directly in Matomo's follow-up code.
It is a line that adds
more other things.
These are things that are rather visible,
so we can see quickly if we want to
if we are on a custom interface.
Most of the time, you will not have to
check all the same,
but in most of the Matomo that we recover,
we never have things like that.
Make sure that the user ID measure
is not used.
User ID, I had already mentioned it
in the introduction, which allows you to know
who the user is behind.
This will be installed when you have
internet or e-commerce sites.
It is the same, it is not installed
like that by the Holy Spirit.
It is that there will be a mechanic
that has been put in place.
You have to imagine that you are not allowed
to collect this data.
You will have to ask for the user's agreement
and if you have the user's agreement,
then you can use it.
We will necessarily have to call
an integration team to
set up a consent mode
so that people can
give their agreement
to have this data collected.
Point number D was a bit of a surprise.
We did not expect it.
It is the fact that e-commerce
cannot be used by default
without having the user's agreement.
You will have to deactivate
this option as long as
you do not have the user's agreement.
We are joining
what is mentioned here
for the user ID.
We will have to have a pop-up
or a information banner to say
do you accept to have information
that is collected regarding
e-commerce.
Point number E, same thing.
It is a bit of a surprise to see it
because Matomo has premium plugins
including the heat card
and the session recording
that we call
hitmap and session recording.
By default,
you have to deactivate them.
I think it is an interpretation
that is too intrusive
even if it does not collect personal data.
Let's know that Matomo
has already provided mechanisms
that allow you to remove
personal data when
you use them.
But apparently,
by default,
you have to deactivate them
as long as you do not have the user's agreement.
Point number 4 is the one
that I mentioned in the introduction.
If your site is poorly designed
and you have URLs
that already collect personal data,
you will have to put them
in conformity.
You modify your follow-up code
so that it does not collect
these identifiers in the URLs.
By chance, Matomo
provides a tool
that allows you to anonymize
the data of the past.
We can decide
to delete
data that is in the past,
in particular,
URLs
that would contain
personal data.
I do not know
if it is exactly
the URLs that
anonymize the reference.
The request parameters
on the URLs,
I think
it would be necessary
to delete them.
I'm not sure if you
can analyze
TracroData
when I look at it.
You can still
question certain columns
and analyze them.
That was what I wanted to show you
on how to put Matomo
in conformity
with the RGPD.
I see that it is already 13h42
on the diapos that I have left.
I have not yet spoken
about the consent collection.
If you collect personal data,
what should you do?
You have a doc
on Matomo
that is rarely used
because in the end,
people prefer to use Matomo
with the consent exemption
to collect data.
You have a line of code
to add,
user for consent,
how to not track,
let user opt out.
I just need to find
the URL
that I wanted.
I will not be able to find it in time.
Matomo consent type
Matomo get consent
developer
That's it.
These are the lines of code
that you will have to use
if you want to collect
the consent of the user
to have the right to collect
personal data on Hulu.
Typically, this will be the case when you
develop e-commerce tracking,
when you put the user ID in place,
etc.
As I was saying,
we are on much more advanced projects
that will be much more technical.
We will have to apply
in development.
There will be even more work
if you find
different data collection purposes.
For e-commerce tracking,
it is quite easy to justify
why you need to collect this data.
When we use the user ID,
directly tracking the user
personally,
the purposes will probably be different.
This means that you will probably have to
collect several consents,
one for each of the actions,
and which will probably
be asked at different places.
That was what I wanted to present to you.
We are at the end of this presentation.
I'm sorry, I overworked a little.
Frédéric, I don't know if there are
any questions in the chat.
At the moment, no,
but I will invite everyone
who has questions
to ask them in the chat.
I hope that
I was clear with the presentation.
What you need to remember
is that in France,
it is clearly the CNIL
that we must follow.
We apply it.
It is a very interesting security
because the day we get
something wrong,
you can take out the guide
that I showed you earlier
and say, look, I have everything
applied to the letter.
Then, what you need to understand
is that for the other case,
which is the second,
which I presented at the end
of the conference,
it is a little more delicate
than the integration to do
when we will have the interactions.
There is a question
that I put in the chat.
First of all, thank you
for asking a question.
It's super nice
and hello to you.
The question is the following.
I understand that with this configuration,
we cover the exempted measure
and the right to opposition.
In any case,
with this configuration,
the configuration
that I presented
also includes what I explained
in the introduction.
I will not talk about the RGPD
specifically in this conference.
The right to opposition is one of the
considerations in the RGPD,
but there are many others.
What I showed is just to have
the right to be exempted,
but it does not exempt you from
respecting all other rights of the RGPD,
which are the right to access information
and the right to export data.
It is a user who
asks for data portability,
who asks if you export the data.
There are many other aspects
that I did not mention
that are linked to the RGPD in general
and to Matomo.
I will talk more about the implementation
of Matomo to be exempted from consent.
The question continues.
What is the personalized classic measure
when users give their consent?
The classic measure
I call it
personalized measure.
We will collect
personal data
on the users.
It does not change much.
What changes is the code
that you have to add
to recover their consent.
It is just that it is
much more technical.
There will be two consequences.
The first consequence is that
as soon as it lands on your website,
you do not recover the data.
You do not have the right to recover it
until they give their consent.
Now they will give their consent.
To give their consent,
you have to add specific
follow-up code.
You will have to deploy efforts
to have this follow-up code
put in place.
For the rest, it does not change.
For the rest, it is like for the
exemption process of consent.
You have data collected in Matomo.
You have the right to information.
You have a data confidentiality page
that explains what is Matomo,
what it does, etc.
You have the right to opposition.
You do not have the right to portability.
You do not have the right to delete data.
This is more the classic RGPD
where you have to have your procedure
which is only in case of control
or in case of demand by a data subject,
by an individual.
You have to respect the procedure.
So, the question continues.
We start another tracker
that would contain the advanced features,
user ID, e-commerce, etc.
at the time of consent.
Yes, that's exactly it.
That's exactly it.
You understood everything in the question.
This is my question mark
and more behind on
is your follow-up code
there you have the right to
trigger everything at once.
In fact, it depends especially on what you put
in the information bannier.
In fact, the RGPD says that
you have to provide clear and precise information.
So, you can not say
in a global way
that you authorize me to collect everything on you.
In fact, your user ID has a purpose.
Your follow-up e-commerce has a purpose.
Your personalized dimensions
probably have another purpose.
Maybe the purpose is the same
but there is nothing that says it.
Anyway, it's up to you
to ask yourself the question,
with a third of what they think.
And from there,
to decide to make a global message
and the person gives you his authorization
and you send everything at once.
Or is it better to divide them?
As the RGPD says,
it's always good sense
and analysis.
For me, e-commerce clearly has
a purpose that is very different
from that of user ID.
For me, the purpose is to improve the business number
of your company.
And with user ID,
you are clearly on a functionality
that is much more intrusive.
Follow the user in a certain way
to know what's going on.
Then you can always justify it
in another way by saying
I don't use user ID,
I use user ID as a pseudonym
so I don't necessarily want to know
who is the person behind it.
All this is discussed and analyzed.
I also invite you to ask
all the other people
present at MatomoCamp
who are doing contests
around privacy
because they may have a vision
that is completely different
from the one I present.
In any case, it's the one I have at first
when I read the questions
and the answers that come to mind.
I have another question
from Abdel
that I also greet
and thank you for asking this question.
You mentioned that e-commerce
follows consent.
I was surprised to see it
and that in the new guide
of the CNIL,
it's not me who says it directly,
it's just that it's written
directly in the CNIL.
I would have preferred it not to be the case,
but they wrote it.
The CNIL therefore considers
that it is a personal data.
In any case, the CNIL considers
that it is necessary to have
the consent of the user
of the e-commerce follow-up code.
When we think about
what's behind it,
when we visualize the Matomo code,
what do we need the Matomo code
to trigger?
We keep in the Matomo doc
on the e-commerce follow-up
and in the e-commerce follow-up,
one of the information it needs is
the e-commerce order ID,
the order number.
It is clear that in the database
and you know that
it is Abdelte
who bought
such a pair of shoes,
it is by definition
a personal data.
It is in the scope
that we need
the consent of the user
to collect this personal data.
Even if the order is not linked
to a specific ID,
do you think it can evolve?
I also think that
it is a good question
that you ask
and I was a little surprised
by the fact that it was in the guide
because when you look
at what Matomo says,
in any case in the features
that Matomo offers,
you have this possibility.
Frédéric, do you see my screen well?
Yes, I see it.
What we have here is
anonymizing the order ID.
We have it here in Matomo
and generally
in private life,
we identify well
the notion of pseudonym
which is still a personal data
of anonymization which is not a personal data.
I am quite surprised
that this functionality
would not have been
retained by Acne
and the fact that
there is no
that in the end
Acne considers
that it is not enough.
I think that in my opinion,
the question to be asked,
we saw it in four days
to have an answer for an answer
that falls aside,
I think that what is more interesting
is to contact the Matomo team directly.
I found something
that was quite great
in the Matomo team doc
on the RGPD part.
Fred, excuse me,
do you still see my screen?
Yes, I confirm.
Basically, when we are in charge of the RGPD
and we are a company,
we are obliged
to have a DPO
and the Matomo team has a DPO.
I think that your question is very interesting
and that we will have to request
the DPO of the Matomo team.
They have an EU representative
who is
I think his name is Christian
no, Christophe, Christophe Boer.
They really have
a dedicated person
who is there to answer this type of question.
I think it can be
really the subject of a great question.
Thank you for asking me.
To write to him and say
you write to privacyatmatomo.org
and he says hello, hello Christophe.
I do not understand.
Normally, if we anonymize
the thing, we should
and the idea is to see
what is behind it.
Honestly, I think that legally,
you do not risk much
because you can clearly show a blank page
and say, look, it's anonymized,
it's not pseudonymized,
but it's still better to have
an answer from someone
who has more of a legal background.
So that's why, in my opinion,
I think it's maybe the reflex to have.
After the question, why didn't I do it?
Because I don't have time,
I just have to do it.
Yeah, great.
Well, listen, I'm going to take
the last question and then
after, I'll have two minutes
to breathe and do the last one.
A question from Adama.
Will Matomo not become paying in the future?
No, because by definition,
Matomo is a free software
that lives thanks to the confidence
that the community has given him.
So anyway, they, next to Matomo,
they already have their business model in place,
which is cloud, which works well,
which are the premium features
which also work well.
You have to imagine that from the moment
when you have a stab in your community,
which would be, finally, guys,
now we're making a paid software,
there you lose your value proposal,
well, you basically lose
the added value of everything
that has been renamed.
Anyway, we see it.
There is a pack of competitors
that we also tried to present
as an alternative to Matomo
by saying, hey, we have a free software.
Well, from the moment they have a minimum
of popularity, what did they do?
They said, well, finally, we have a proprietary software.
We close our source code and become paying.
So what's going on?
Their software fell into oblivion
because they killed their added value.
So in any case, I'm not
one who's on it.
And then I also think that
they have already proven it in the past.
In particular,
if you look historically,
it's a story around P-Week Pro
and formerly P-Week.
It is precisely in this spirit
that everything has been,
that I think Matomo has already proved
that they are a free software,
they remain since the people behind
in this life.
It is currently 13h57.
I thank you very much to all of you for having
attended this conference.
And then I'll see you in three minutes for a new conference
on how to develop a whole business with Matomo
which will be a conference in English.
Thank you to Frédéric for moderating this conference.
See you soon.