Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
OpenLayers is an open source JavaScript library for rendering interactive maps in the browser. It is not a tracker and sets no cookies of its own. Its privacy impact comes entirely from the tile provider you configure, so self hosted tiles can make it essentially privacy neutral.
OpenLayers is a free, open source JavaScript library that renders interactive maps inside a web page. It draws tiles, vector data and overlays on the client side and gives developers full control over the map. Unlike a hosted mapping service, OpenLayers is just code that runs in the visitor browser, so it has no servers of its own and collects nothing by itself.
OpenLayers sets no cookies and stores no personal data of its own. It may use the browser cache for tiles, which is normal browser behaviour. The privacy question is entirely about the tile or data source you configure. When the map fetches tiles from a remote provider, the visitor browser sends its IP address and request details to that provider, and that provider, not OpenLayers, determines what is collected.
Because OpenLayers itself stores nothing on the device, Article 5(3) of the ePrivacy Directive is not triggered by the library. It can be triggered by a third party tile provider if that provider sets cookies. Under the GDPR, the only personal data in play is the visitor IP address that reaches the tile provider, so your obligations follow the provider you choose rather than the library.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
If you self host the tiles or use an EU based source that sets no cookies, you can usually rely on legitimate interest and no consent banner is needed for the map. If you point OpenLayers at a third party tile service that receives the visitor IP or sets cookies, you should obtain consent before the map loads. Precise geolocation through the browser always requires explicit consent.
OpenLayers sends nothing anywhere on its own, so any transfer outside the EEA depends only on the tile source. Self hosted tiles keep all data on your own infrastructure. A common public source such as the OpenStreetMap tile servers is operated within Europe. A tile provider based outside the EEA would receive the visitor IP and may process it in a third country, which you would need to assess and disclose.
Decide where your tiles come from and document it, because that decision drives your obligations. Prefer self hosted or EU based tiles to keep the map privacy neutral and avoid consent. If you must use a third party provider, place the map behind consent, name the provider in your privacy notice, and request browser geolocation only on a clear user action.
Websites using OpenLayers must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is generally not required for OpenLayers itself, since the library processes no personal data and sets no cookies. The assessment should focus on the tile provider you choose. Self hosted or EU tiles present minimal risk, while a third country tile provider or large scale geolocation use would warrant a documented assessment of the IP transfer and any profiling.
Sample consent text
This map is drawn by OpenLayers in your browser. Map tiles are loaded from our chosen provider, which receives your IP address. Do you consent to load the map?
Third-party domains contacted
tile.openstreetmap.orgcdn.jsdelivr.netopenlayers.orgCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| No cookies from the library | None | Not applicable | OpenLayers sets no cookies of its own. It uses only the standard browser cache for map tiles. Any cookies depend entirely on the third party tile provider you configure. |
| Tile provider cookies | Depends on provider | Depends on provider | If you configure a third party tile service, that provider may set its own cookies. These must be documented separately according to the provider you choose. |
This service may collect user data. Ensure GDPR compliance with FlowConsent.
None. OpenLayers is a client side library that sets no cookies of its own and only uses the normal browser cache for tiles. Any cookies come from the third party tile provider you choose to load tiles from.
It depends on the tiles. With self hosted or EU based tiles that set no cookies, no consent is needed and you can rely on legitimate interest. With a third party tile provider that receives the visitor IP or sets cookies, you should obtain consent before the map loads.
For self hosted or EU tiles the basis is legitimate interest under Article 6(1)(f) GDPR. When a third country tile provider receives the visitor IP or sets cookies, the basis shifts to consent under Article 6(1)(a) and Article 5(3) ePrivacy.
OpenLayers itself transfers nothing. A transfer only happens if your tile provider is outside the EEA, in which case the visitor IP reaches that provider. Self hosted tiles or the European OpenStreetMap servers avoid any such transfer.
Generally no, because the library processes no personal data and sets no cookies. A documented assessment is only warranted around the tile provider, for example a third country provider or large scale geolocation use.
Choose your tile source deliberately, prefer self hosted or EU tiles, and document the choice. If you use a third party provider, put the map behind consent, name the provider in your privacy notice, and request geolocation only on a user action.
Leaflet is a lighter open source map library with a similar privacy profile, also depending on the tile source. Hosted services such as TomTom Maps offer more built in features but share more data, so the trade off is control versus convenience.
If you use self hosted or EU tiles with no cookies, you may only need to note that maps are rendered locally. If a third party tile provider is used, list any cookies it sets, name the provider, and disclose that the map sends your IP to that provider.