Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Mapbox GL JS is an open source JavaScript library for rendering interactive vector maps in the browser. It requests map tiles and styles from Mapbox servers and by default sends usage telemetry to Mapbox, storing an anonymous identifier in browser local storage. The IP exposure and telemetry trigger GDPR and ePrivacy compliance obligations.
Mapbox GL JS is an open source JavaScript library published by Mapbox that renders interactive vector maps directly in the browser using WebGL. It requests map tiles, style definitions and glyph resources from Mapbox infrastructure servers (api.mapbox.com and a.tiles.mapbox.com) using an access token provided by the developer. By default, version 2 and later of the library also sends telemetry events to events.mapbox.com, including map load events, approximate visitor location and device information. Mapbox uses this telemetry data for billing and analytics. The library stores an anonymous identifier and telemetry preferences in browser local storage rather than classic cookies.
Every map tile request sends the visitor's IP address and the requested tile coordinates to Mapbox servers in the United States. The library stores a persistent anonymous identifier under the key mapbox.eventData in browser local storage, along with telemetry preferences and session tokens. Telemetry events sent to events.mapbox.com may include the map load count, approximate geographic location derived from the IP, browser and device characteristics. Mapbox sets few or no traditional cookies; the primary storage mechanism is local storage, which is nonetheless subject to Article 5(3) of the ePrivacy Directive.
Using Mapbox GL JS creates several compliance obligations. Under Article 5(3) of the ePrivacy Directive, writing to or reading from browser local storage requires prior informed consent, because local storage is terminal equipment storage. Under GDPR, the IP address transferred with every tile request constitutes personal data processed by Mapbox in the US, requiring a legal basis and appropriate transfer safeguards. The telemetry function adds an analytics dimension: profiling map usage through events sent to Mapbox is processing of personal data for Mapbox's own purposes, which requires either consent or a documented legitimate interest with a balancing test.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Consent is required before loading Mapbox GL JS when telemetry is enabled, since the library writes to local storage on initialisation. If the developer disables telemetry programmatically (using the mapbox.telemetry opt out mechanism) and the map is strictly functional, some data protection authorities may accept legitimate interest as the basis, provided the IP transfer is disclosed and a balancing test is documented. However, consent remains the safest legal basis and is strongly recommended for public facing websites serving EU visitors. The consent must be freely given, specific and withdrawable.
All map tile requests and telemetry events are processed by Mapbox, Inc. in the United States. This is an international data transfer under GDPR Chapter V. Mapbox relies on standard contractual clauses as the primary transfer mechanism and, where it qualifies, the EU US Data Privacy Framework. Website operators using Mapbox GL JS must reference these transfer safeguards in their privacy policy, identify Mapbox as a data processor or controller (depending on the data flow), and sign Mapbox Data Processing Terms where required.
To implement Mapbox GL JS in a GDPR compliant manner: (1) Block the Mapbox script in your consent management platform and load it only after the visitor grants map or analytics consent. (2) If you choose legitimate interest for a functional map, disable telemetry using the Mapbox opt out API before map initialisation and document your balancing test. (3) Disclose Mapbox local storage use (mapbox.eventData) in your cookie and storage policy with its purpose and persistence. (4) Reference Mapbox US data transfer and standard contractual clauses in your privacy policy. (5) Sign Mapbox Data Processing Terms and keep a copy in your DPA records. (6) Revisit the legal basis if you upgrade the Mapbox GL JS version, as telemetry behaviours may change.
Websites using Mapbox GL JS must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA should be considered where Mapbox GL JS is used on high traffic sites or in contexts where map interactions reveal sensitive information (e.g. health or location related services). Key risk areas include: (1) systematic transmission of visitor IP addresses to Mapbox in the United States with every tile request; (2) telemetry events sent to events.mapbox.com that log map interactions and approximate location; (3) an anonymous persistent identifier stored in local storage that can profile map usage patterns over time. Controllers should evaluate whether telemetry can be disabled and document the decision, whether the IP transfer is covered by adequate safeguards (SCCs), and whether the legitimate interest basis is tenable if telemetry is fully switched off.
Sample consent text
We use Mapbox to display interactive maps on this page. Mapbox will receive your IP address and may store an anonymous identifier in your browser. Do you agree to load the interactive map? [Load Map] [No thanks]
Third-party domains contacted
api.mapbox.comevents.mapbox.coma.tiles.mapbox.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| mapbox.eventData | Functional / Analytics (local storage) | Persistent (local storage) | Anonymous telemetry identifier and session token stored by Mapbox GL JS to send usage events to events.mapbox.com |
| mapbox.eventData.uuid | Functional (local storage) | Persistent (local storage) | Anonymous UUID used to identify the browser session for Mapbox telemetry purposes |
| mapbox.token | Functional (session storage) | Session | Cached Mapbox access token used for authenticated tile and API requests during the browser session |
Mapbox GL JS uses cookies for user preferences — inform visitors with a consent banner.
Mapbox GL JS does not primarily use cookies. Instead it stores data in browser local storage. The key entry is mapbox.eventData, which contains an anonymous persistent identifier used for telemetry and a session token. These are written to local storage when the map initialises. Browser local storage is subject to Article 5(3) of the ePrivacy Directive in the same way as cookies, so prior consent is required before the library writes to it.
Yes, consent is generally required. When telemetry is enabled (the default), Mapbox GL JS writes an anonymous identifier to local storage on initialisation, which triggers Article 5(3) of the ePrivacy Directive. The subsequent IP address transfer to Mapbox in the US also requires a GDPR legal basis. If telemetry is programmatically disabled and the map is purely functional, some authorities may accept legitimate interest, but this is not guaranteed and varies by jurisdiction. Consent is the most straightforward and defensible approach.
Where telemetry is active, the legal basis must be consent under Article 6(1)(a) GDPR and Article 5(3) ePrivacy Directive, because writing to local storage for analytics purposes goes beyond what is strictly necessary for the map to function. Where telemetry is fully disabled, legitimate interest under Article 6(1)(f) GDPR may be arguable for the residual IP transfer from tile requests, but this requires a documented balancing test showing that the visitor's interests do not override those of the operator. The safer and more common choice remains consent.
Yes. Every map tile request and telemetry event is processed by Mapbox, Inc. in the United States, meaning the visitor IP address and interaction data are transferred to a third country under GDPR Chapter V. Mapbox relies on standard contractual clauses (SCCs) and, where applicable, the EU US Data Privacy Framework as transfer mechanisms. You must reference these safeguards in your privacy policy and ensure you have signed Mapbox's Data Processing Addendum if required for your usage tier.
A DPIA should be considered when Mapbox GL JS is used on high traffic sites, when map interactions could reveal sensitive data (e.g. health facility searches, religious site maps), or when telemetry is active and profiles large numbers of users. Key DPIA triggers include: systematic processing of location related data, international transfer to a US processor, and analytics profiling via telemetry events. Consult your DPO and supervisory authority DPIA guidance to determine whether a formal assessment is mandatory for your specific use case.
Steps for compliant implementation: (1) Block the Mapbox GL JS script via your CMP and only load it after consent is granted. (2) If pursuing legitimate interest for a functional map, call the Mapbox telemetry opt out function before map.load to disable analytics events, and document your balancing test. (3) Disclose the mapbox.eventData local storage entry in your cookie and storage policy. (4) Add Mapbox US data transfer and SCCs to your privacy policy. (5) Sign the Mapbox Data Processing Addendum. (6) Display a static placeholder before the map loads. (7) Review compliance on each Mapbox GL JS library upgrade.
If you want to avoid telemetry and US data transfers, consider: (1) Leaflet.js with OpenStreetMap tiles self hosted or served from an EU based tile provider, which avoids third party US data flows entirely. (2) MapLibre GL JS, the community maintained open source fork of Mapbox GL JS that does not include telemetry by default and does not require a Mapbox account. (3) Static map images generated server side from OSM data. (4) Mapbox GL JS with telemetry explicitly disabled and tiles proxied through your own server to avoid direct visitor to Mapbox connections. Each option has trade offs in feature richness and hosting effort.
Because Mapbox GL JS primarily uses local storage rather than cookies, your policy should be titled cookie and storage policy or similar. Add an entry for mapbox.eventData (local storage, Mapbox Inc., purpose: anonymous telemetry identifier and session token, duration: persistent until cleared). If you have disabled telemetry, note this and explain why only the tile request IP transfer remains. Reference the Mapbox US data transfer and the applicable SCCs. Review and update this entry whenever you upgrade the Mapbox GL JS library.