Earlier quoted context omitted.
> it can be used without requiring to collect the user's consent (since Matomo doesn't use the data for its own purpose) This is not how the GDPR works. If you are collecting personal data, or if you are dropping analytics cookies on someone's device, you need consent. No ifs or buts.
You should apply to the CNIL since you seem to know GDPR better than they do. ( https://www.cnil.fr/fr/cookies-solutions-pour-les-outils-de-... ) I never said no personal data were collected but, if configure properly , the processing of data falls within the legitimate interest basis.
https://github.com/LINCnil/Guide-RGPD-du-developpeur/commit/...
/edit Ignore me. I appear to have misunderstood the changes when I last read this. Sorry