CARTO Data Observatory

What the Data Observatory does

The CARTO Data Observatory is a catalogue and delivery layer for geospatial datasets, embedded in the CARTO platform. Users browse hundreds of curated datasets covering demographics, points of interest, human mobility, real estate, weather, and administrative boundaries, then subscribe and run spatial joins directly inside their cloud data warehouse (BigQuery, Snowflake, Redshift, or Databricks). Data flows server side through CARTO APIs without leaving the customer warehouse perimeter, which makes it primarily a back office analytics tool rather than a website tracker. The CARTO marketing site and product UI are the only web surfaces that load classic cookies.

Cookies and data collected

On the CARTO website and platform UI, cookies are set for authentication (session, CSRF), for product analytics (Mixpanel or Amplitude), for support chat (Intercom), and for marketing on the public site (Google Analytics 4, HubSpot, LinkedIn Insight Tag). Inside the Data Observatory itself, the data exchanged is mostly aggregated statistical or geographic data, not personal data. Personal data appears only in account profiles, billing, support tickets, and audit logs of who subscribed to which dataset and when.

GDPR and ePrivacy implications

For paid customers, the lawful basis is contract performance under Article 6(1)(b) GDPR. Strictly necessary session cookies are exempt under Article 5(3) ePrivacy. All marketing, analytics, and support cookies on the carto.com website and on dashboards require prior, freely given, specific, informed, and unambiguous consent. CARTO acts as a processor for customer account data and as a controller for its own marketing site. Customers must sign the CARTO DPA and review the sub-processor list.

Datasets, licences, and personal data

Most datasets in the Data Observatory are aggregated to administrative units (NUTS regions, postal codes, hexagons, census blocks) and contain no directly identifiable personal data. Some mobility, telco, or geomarketing datasets may be derived from personal data and licensed under specific terms. Customers must read each dataset licence, identify whether the source is GDPR personal data, and document the lawful basis for combining it with their own data, especially when joining customer level identifiers.

International data transfers

CARTO operates from Spain and the United States and uses AWS and Google Cloud as infrastructure providers. EU customers can request EU only deployment for the platform tenant, but support and corporate functions involve US staff and tools. Transfers rely on Standard Contractual Clauses, the EU US Data Privacy Framework where the partner is certified, and supplementary measures (encryption, role based access). A Transfer Impact Assessment is required for the operational metadata flow.

Practical compliance steps

Sign the CARTO DPA, attach the SCC and DPF documentation, and pick the EU region for sensitive deployments. Configure SSO, role based access, and audit logging. Enforce a cookie banner on your CARTO dashboards if exposed to end users, and treat the carto.com marketing site cookies as opt in. Read each Data Observatory dataset licence, document the lawful basis for any join with personal data, and align retention with internal policies.