Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Mapbox.js and Mapbox GL JS render interactive maps in the browser, loading tiles and telemetry from Mapbox servers in the United States, which raises GDPR data transfer questions.
Mapbox is a location platform whose JavaScript libraries, Mapbox.js and the newer Mapbox GL JS, embed interactive maps, geocoding and routing into websites and apps. When a page loads a Mapbox map, the visitor browser requests map tiles, fonts and styles directly from Mapbox infrastructure and the library can send anonymous usage telemetry back to Mapbox.
Mapbox GL JS does not usually set browser cookies, but every map request transmits the visitor IP address, the requested location and coordinates, and technical details such as browser and device. The library also collects telemetry about map interactions unless you disable it. The IP address and location data are personal data even without a cookie.
Because no information is stored or read on the device by default, the ePrivacy consent rule for cookies may not strictly apply, but the GDPR still governs the transfer of the IP address and location data to Mapbox. Regulators such as the CNIL have treated automatically loaded third party resources, including maps, as requiring user consent when they expose data to a foreign controller.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
The safest approach is to load the Mapbox map only after the visitor has consented, for example behind a click to load placeholder. If you rely on legitimate interest instead, you must document a balancing test and offer an easy objection. Telemetry should be disabled where it is not necessary.
Mapbox is a United States company and serves tiles and processes requests from US infrastructure, so using its maps involves an international data transfer. This transfer should be covered by the EU US Data Privacy Framework, under which Mapbox can self certify, or by Standard Contractual Clauses with supplementary measures.
Use a click to load wrapper so no Mapbox request fires before consent, disable telemetry in the map options, restrict your access token and document the transfer in your privacy notice. Consider a self hosted or European map alternative for pages where consent rates are low.
Websites using Mapbox.js must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is worth considering when Mapbox is used for continuous location tracking, fleet or user positioning rather than a simple static map. Assess the United States transfer, the volume of location data and whether a European alternative would reduce risk.
Sample consent text
We use Mapbox to display interactive maps. Loading a map sends your IP address and location request to Mapbox in the United States. Maps load only after you accept.
Third-party domains contacted
api.mapbox.comevents.mapbox.comtiles.mapbox.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| mapbox.eventData | Local storage | Persistent until cleared | Stores an anonymous identifier and event data used by Mapbox telemetry. Can be disabled in the map options. |
| mapbox.eventData.uuid | Local storage | Persistent until cleared | Holds the anonymous telemetry identifier associated with map interactions. |
Mapbox.js uses cookies for user preferences — inform visitors with a consent banner.
Mapbox GL JS does not set traditional cookies by default, but it stores an anonymous identifier in local storage for telemetry and sends your IP address with every map request. You can disable telemetry in the map configuration.
In most European interpretations you should obtain consent before loading a Mapbox map, because the request discloses the visitor IP address and location to a United States provider. A click to load placeholder is the cleanest way to capture this consent.
You can rely on consent under Article 6(1)(a) of the GDPR, or on a documented legitimate interest under Article 6(1)(f) if the map is essential and telemetry is disabled. The ePrivacy rules are less central here because Mapbox does not store cookies by default.
Yes, Mapbox is a US company and serves map tiles and processes requests from US infrastructure, so the visitor IP and location are transferred there. Rely on the EU US Data Privacy Framework or Standard Contractual Clauses.
A simple decorative map rarely needs a DPIA, but continuous location tracking, fleet monitoring or user positioning at scale usually does. Assess the transfer and the sensitivity of the location data.
Gate the map behind consent, disable telemetry, restrict the access token to your domains and document the US transfer in your privacy notice. Provide a fallback such as a static image or address for users who decline.
European or self hosted options include MapLibre GL with self hosted tiles, OpenStreetMap with a European tile server, and providers such as HERE or local mapping services. These can reduce or remove the United States transfer.
Mention that Mapbox maps load only after consent, describe the local storage telemetry identifier and the IP based location request, and disclose the transfer to the United States. Update the notice if you enable telemetry or change providers.