FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Other

CARTO Analytics

UnclassifiedOfficial website

CARTO Analytics is a location intelligence platform that runs spatial analytics on maps and can process visitor location and behavioural data.

Block CARTO Analytics until consentScan my site
Overview

What does CARTO Analytics do?

What CARTO Analytics is

CARTO Analytics is a location intelligence and geospatial analytics platform with roots in Spain and the United States. It lets organisations visualise and analyse spatial data on interactive maps, combining business data with geographic context. Companies use it to understand where customers are, how they move and which locations perform best.

What data and cookies it collects

When embedded in a public facing site or app, CARTO can process location data such as coordinates, IP based geolocation and movement patterns, alongside behavioural events tied to map interactions. It may set functional cookies to keep map sessions and preferences, and it loads tiles and API resources from its own domains. Location data is particularly sensitive because it can reveal home, work and routine.

GDPR and ePrivacy implications

Location and behavioural analytics fall squarely within the GDPR, and precise location is treated as high risk personal data. The ePrivacy Directive also requires prior consent before non essential cookies or trackers are placed on a visitor device. Because spatial data can single out individuals, you must apply data minimisation and clear transparency about what is collected and why.

Consent requirements

For behavioural and location analytics you should obtain freely given, specific, informed and unambiguous consent before CARTO begins processing visitor data. Load the analytics layer only after the visitor opts in through your consent banner, and provide an equally easy way to withdraw. Aggregated, non identifying spatial analysis may rely on legitimate interest, but only after a documented balancing test.

Data transfers and hosting

CARTO can be deployed in European Union regions, but data may also be processed in the United States depending on your configuration. Transfers to the United States should rely on the EU US Data Privacy Framework where the vendor is certified, or on Standard Contractual Clauses with supplementary measures. Confirm your hosting region in the contract and keep the data processing agreement on file.

Practical compliance steps

Map every CARTO data flow, choose an EU region where possible and reduce location precision to the minimum you need. Gate the analytics layer behind consent, document a legitimate interest assessment for any aggregated use and complete a data protection impact assessment. Finally, list CARTO in your privacy policy and cookie notice, and record the signed data processing agreement.

Compliance

CARTO Analytics and the GDPR

CARTO Analytics is classified as “Unclassified”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

Legal basis
Consent under Article 6(1)(a) GDPR for behavioural and location analytics, with legitimate interest under Article 6(1)(f) possible for aggregated, non identifying spatial analysis
Risk level
high
Applicable regulations
GDPR, ePrivacy Directive, EU US Data Privacy Framework

Impact assessment (DPIA)

A data protection impact assessment is strongly recommended because CARTO can process precise location data, which is considered sensitive and high risk. Assess the granularity of location collection, the potential for re identification and any transfers to the United States.

Sample text for your banner

We use CARTO Analytics to analyse location and usage data on interactive maps so we can improve our services. These insights may involve processing in the United States. Do you consent?
Cookies and trackers

What CARTO Analytics sets and contacts

Tracking method
JavaScript SDK, map tiles and API calls; location data processing with optional behavioural event tracking
Server location
European Union and United States (configurable cloud regions on AWS and Google Cloud)
Cookieless mode available
Yes
Data transferred outside the EU
Depending on the chosen deployment region, location and usage data may be processed in the United States. Transfers rely on the EU US Data Privacy Framework where applicable and Standard Contractual Clauses with supplementary measures.

Cookies set (2)

NameTypeDurationPurpose
carto_sessionFunctionalSessionMaintains the interactive map session and viewport state while the visitor browses.
carto_prefsFunctional1 yearStores map display and layer preferences so the view is remembered on return.

Third-party domains contacted (4)

  • carto.com
  • api.carto.com
  • gateway.carto.com
  • tiles.carto.com
Questions

Frequently asked questions about CARTO Analytics

Can't find your question? Write to us, we answer fast.

Does CARTO Analytics set cookies?

When embedded in a public site, CARTO can set functional cookies to keep map sessions and user preferences, and it may process IP based geolocation. The exact cookies depend on your configuration, so run a cookie scan before publishing.

Is consent required to use CARTO Analytics?

Yes. For behavioural and location analytics you need prior, freely given consent before CARTO processes visitor data. Load the analytics layer only after the visitor opts in through your consent banner.

What is the legal basis for CARTO Analytics?

The primary legal basis is consent under Article 6(1)(a) GDPR. Aggregated, non identifying spatial analysis may rely on legitimate interest under Article 6(1)(f), but only after a documented balancing test.

Does CARTO transfer data to the United States?

It can, depending on the deployment region you choose. Where data reaches the United States, rely on the EU US Data Privacy Framework if the vendor is certified, or on Standard Contractual Clauses with supplementary measures.

Do I need a DPIA for CARTO Analytics?

A data protection impact assessment is strongly recommended because precise location data is high risk. Assess the granularity of collection, the risk of re identification and any transfers outside the European Union.

How do I implement CARTO Analytics compliantly?

Choose an EU region where possible, minimise location precision, gate the analytics layer behind consent and document a legitimate interest assessment for aggregated use. Keep the signed data processing agreement and list CARTO in your privacy and cookie notices.

What are the alternatives to CARTO Analytics?

EU hosted geospatial and analytics tools such as privacy focused mapping platforms can reduce transfer risk. Whichever you choose, apply the same consent, minimisation and documentation principles.

How do I update my cookie policy for CARTO?

Add CARTO to the analytics or location category in your cookie notice, describe the data it processes, state the retention period and disclose any United States processing. Update the notice whenever your configuration changes.

Same category

More services: Other

See the whole category

TidyCal

TidyCal is a user preference and personalization service that helps websites deliver customized experiences based on individual visitor settings and choices. It manages preferences for content display, communication channels, and interaction styles. TidyCal integrates with website platforms to remember and apply user choices consistently across sessions. With privacy-compliant preference storage, TidyCal enhances satisfaction by ensuring tailored browsing experiences for every visitor.

Preferences

Paradox

Paradox is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. Paradox integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, Paradox makes advanced AI accessible to all teams.

Preferences

AudioEye

AudioEye is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. AudioEye supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, AudioEye ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Other

ServiceM8

ServiceM8 is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. ServiceM8 provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, ServiceM8 helps deliver the right message to the right audience at the right time.

Marketing

RhinoFit

RhinoFit is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. RhinoFit supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, RhinoFit ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Other

Flourish

Flourish is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Flourish integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Flourish helps organizations maintain robust websites that meet user expectations and technical requirements.

Analytics

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site