What is the `_pk_id.*` cookie?it needs consent first

Set by Matomo (Matomo (InnoCraft Ltd.)). Expires after 13 months.

Block it until the visitor opts in

Under the ePrivacy Directive (Art. 5(3)) and GDPR, _pk_id.* may only be set after the visitor accepts analytics cookies.

Purpose

Stores a unique visitor ID and a few details about the visitor.

Self-hosted Matomo can be exempt from consent in some countries (e.g. France, under CNIL rules) when configured for audience measurement only. By default it needs consent.

Cookie details

Cookie name: _pk_id.*
Service: Matomo
Provider: Matomo (InnoCraft Ltd.)
Category: Analytics
Duration: 13 months
Consent: Required — opt-in

GDPR requirements

Analytics cookies help website owners understand how visitors interact with websites by collecting and reporting information anonymously. Consent is required under GDPR.

For _pk_id.* to be compliant, it must be:

Not set on the first visit — not even for a fraction of a second
A consent banner is shown, and the visitor actively accepts analytics cookies
Stays blocked if the visitor rejects or ignores the banner
Listed in your cookie policy with its name, purpose and retention period
Removed or invalidated when the visitor withdraws consent

How to handle it

1
Block it by default
Configure your consent platform (CMP) or tag manager so Matomo doesn't load until the visitor accepts analytics cookies.
2
Map it to a consent category
Put it under “Analytics” in your CMP configuration.
3
List it in your cookie policy
Name, purpose, provider (Matomo (InnoCraft Ltd.)) and expiry (13 months).
4
Sign a DPA
Have a Data Processing Agreement with Matomo (InnoCraft Ltd.) covering the data this cookie collects.
5
Verify it works
In a private window, reject cookies and confirm _pk_id.* is not set.