Apple MapKit JS
Apple MapKit JS is the official JavaScript SDK that lets a website embed interactive Apple Maps with tiles, geocoding, search and routing, authenticated via a developer issued JWT.
What does Apple MapKit JS do?
Apple MapKit JS is the JavaScript implementation of Apple's mapping SDK. It mirrors the native MapKit API used by iOS and macOS apps and lets web developers embed Apple Maps with interactive tiles, search, geocoding, directions, and overlays. It is positioned by Apple as a privacy oriented alternative to Google Maps and Mapbox, with a free monthly quota for most websites.
What Apple MapKit JS does
You authenticate calls by generating a short lived JSON Web Token signed with a private key from your Apple Developer account. The JWT is passed to mapkit.init. The SDK then loads tiles from cdn.apple-mapkit.com, fetches search results and routes from api.apple-mapkit.com, and renders the map. MapKit JS does not require a user logged into Apple ID.
Cookies and data collected
Apple MapKit JS is largely cookieless on the loading page. Apple servers however receive the user IP, the user agent, the JWT (including your developer team ID and your origin), the tile coordinates, the search query, and the route coordinates. If you use the browser Geolocation API, precise GPS coordinates can be sent to Apple after explicit user authorisation.
GDPR and ePrivacy implications
IP addresses and geolocation are personal data. Even though MapKit JS does not rely on third party cookies, it loads scripts from Apple servers, which qualifies as access to terminal equipment for transmission purposes that go beyond what is strictly necessary. EU regulators commonly require prior consent for embedded maps. Apple acts as an independent controller for service improvement, in addition to being a processor for the requested map functionality.
Data transfers to the United States
Apple Inc is a US company and runs Apple Maps Server with EU and US infrastructure. Transfers are covered by the EU-US Data Privacy Framework (Apple is certified) and by Standard Contractual Clauses. Document the transfer in your record of processing activities.
How to embed it compliantly
Use a click to load placeholder mentioning Apple Maps, Apple Inc and the US transfer. Block mapkit.js loading by default in your CMP. Generate short lived JWTs server side, do not embed long lived secrets in the page, and ensure the origin claim restricts the JWT to your domains. Disclose Apple Maps in your privacy notice with the categories of data and the transfer mechanism.
Apple MapKit JS and the GDPR
Apple MapKit JS is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.
- Legal basis
- Consent (Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy Directive) for the embed; legitimate interest possible only for strictly necessary tiles in some contexts
- Risk level
- medium
- Applicable regulations
- GDPR, ePrivacy Directive, EU-US Data Privacy Framework, Apple Developer Program License Agreement
Impact assessment (DPIA)
A DPIA is recommended on consumer journeys that combine MapKit JS with precise geolocation, especially when the map is loaded on every page. Document the JWT chain, the storage of search queries by Apple, the transfer mechanism, and the option to use a privacy friendly fallback map.
Sample text for your banner
We embed Apple Maps (MapKit JS) to display locations and routes. The map loads from Apple and processes your IP and approximate location on Apple servers in the EU and the United States. We only enable it after you accept the maps and embeds category in our cookie banner.
What Apple MapKit JS sets and contacts
- Tracking method
- JavaScript SDK that loads tiles, geocoding and routing from Apple Maps Server, authenticated by a JWT generated from your MapKit developer key
- Server location
- Apple infrastructure operated globally with EU presence; tile and search requests routed through Apple data centres, signed JWT validated server side
- Cookieless mode available
- Yes
- Data transferred outside the EU
- Apple Maps Server is operated by Apple Inc (US). Map tile requests, geocoding and search queries are processed by Apple infrastructure that includes EU and US data centres. Transfers rely on the EU-US Data Privacy Framework (Apple is certified) and on Standard Contractual Clauses with a Transfer Impact Assessment.
Cookies set (2)
| Name | Type | Duration | Purpose |
|---|---|---|---|
| mk_token | localStorage | Session | Caches the developer issued JSON Web Token used to authenticate MapKit JS calls during the page session. |
| mk_locale | localStorage | 30 days | Stores the resolved locale and unit preferences used by MapKit JS to localise tiles and search results. |
Third-party domains contacted (4)
cdn.apple-mapkit.comapi.apple-mapkit.comsat-cdn.apple-mapkit.commaps.apple.com
Frequently asked questions about Apple MapKit JS
Can't find your question? Write to us, we answer fast.
What cookies does Apple MapKit JS set?
MapKit JS is largely cookieless on the host page, which makes it appealing for privacy minded sites. Apple servers still receive technical metadata such as IP, user agent, JWT claims and search queries on every tile or API call.
Does Apple MapKit JS require GDPR consent?
In most cases yes. Loading scripts from cdn.apple-mapkit.com is access to terminal equipment that goes beyond what is strictly necessary, and IP and queries are processed by a US provider. EU regulators commonly require prior consent for embedded maps.
What is the legal basis for processing?
Consent under Article 6(1)(a) GDPR is the safest legal basis. Legitimate interest can be considered only when the map is strictly necessary to deliver the user request (for example, a delivery address picker), with a documented balancing test.
Are data transferred outside the EU?
Apple Maps Server is operated globally by Apple Inc, with EU and US presence. Transfers rely on the EU-US Data Privacy Framework and on Standard Contractual Clauses. A Transfer Impact Assessment is recommended.
Do I need a DPIA?
A DPIA is recommended when MapKit JS is combined with precise geolocation, on consumer journeys at scale, or alongside other tracking. Document the JWT chain, the data sent to Apple, and the impact on data minimisation.
How do I embed Apple MapKit JS compliantly?
Use a click to load placeholder, gate mapkit.js behind consent in your CMP, generate short lived JWTs server side, restrict the origin claim to your domains, and disclose Apple Maps in your privacy notice. Provide a static fallback if the user declines consent.
Are there alternatives to Apple MapKit JS?
Alternatives include Google Maps, Mapbox, MapTiler, HERE Maps, Leaflet with OpenStreetMap tiles, and protomaps for fully self hosted vector tiles. MapTiler and protomaps support EU only hosting and are often the best fit for European audiences.
How do I update my cookie policy for Apple MapKit JS?
Even without third party cookies, list Apple MapKit JS as a third party embed, explain that IP and search queries are processed by Apple in the EU and the US, describe the JWT mechanism, and link to Apple's privacy policy.
Atlassian Jira Issue Collector
Atlassian Jira Issue Collector is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Atlassian Jira Issue Collector supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Atlassian Jira Issue Collector ensures your website delivers a smooth, uninterrupted experience to.
Taiga
Taiga is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Taiga supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Taiga ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.
Whitelabel MD
Whitelabel MD is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Whitelabel MD supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Whitelabel MD ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.
Blesta
Blesta is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Blesta enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Blesta empowers marketing teams to achieve measurable growth.
ExpertRec
ExpertRec is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. ExpertRec supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, ExpertRec enables informed decisions that improve experience and drive results.
Survale
Survale is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Survale supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Survale ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.
Make your site compliant today.
Free up to 25,000 sessions a month. No credit card, no commitment.