Mapbox GL JS

Mapbox GL JS does not primarily use cookies. Instead it stores data in browser local storage. The key entry is mapbox.eventData, which contains an anonymous persistent identifier used for telemetry and a session token. These are written to local storage when the map initialises. Browser local storage is subject to Article 5(3) of the ePrivacy Directive in the same way as cookies, so prior consent is required before the library writes to it.

Yes, consent is generally required. When telemetry is enabled (the default), Mapbox GL JS writes an anonymous identifier to local storage on initialisation, which triggers Article 5(3) of the ePrivacy Directive. The subsequent IP address transfer to Mapbox in the US also requires a GDPR legal basis. If telemetry is programmatically disabled and the map is purely functional, some authorities may accept legitimate interest, but this is not guaranteed and varies by jurisdiction. Consent is the most straightforward and defensible approach.

Where telemetry is active, the legal basis must be consent under Article 6(1)(a) GDPR and Article 5(3) ePrivacy Directive, because writing to local storage for analytics purposes goes beyond what is strictly necessary for the map to function. Where telemetry is fully disabled, legitimate interest under Article 6(1)(f) GDPR may be arguable for the residual IP transfer from tile requests, but this requires a documented balancing test showing that the visitor's interests do not override those of the operator. The safer and more common choice remains consent.

Yes. Every map tile request and telemetry event is processed by Mapbox, Inc. in the United States, meaning the visitor IP address and interaction data are transferred to a third country under GDPR Chapter V. Mapbox relies on standard contractual clauses (SCCs) and, where applicable, the EU US Data Privacy Framework as transfer mechanisms. You must reference these safeguards in your privacy policy and ensure you have signed Mapbox's Data Processing Addendum if required for your usage tier.

A DPIA should be considered when Mapbox GL JS is used on high traffic sites, when map interactions could reveal sensitive data (e.g. health facility searches, religious site maps), or when telemetry is active and profiles large numbers of users. Key DPIA triggers include: systematic processing of location related data, international transfer to a US processor, and analytics profiling via telemetry events. Consult your DPO and supervisory authority DPIA guidance to determine whether a formal assessment is mandatory for your specific use case.

Steps for compliant implementation: (1) Block the Mapbox GL JS script via your CMP and only load it after consent is granted. (2) If pursuing legitimate interest for a functional map, call the Mapbox telemetry opt out function before map.load to disable analytics events, and document your balancing test. (3) Disclose the mapbox.eventData local storage entry in your cookie and storage policy. (4) Add Mapbox US data transfer and SCCs to your privacy policy. (5) Sign the Mapbox Data Processing Addendum. (6) Display a static placeholder before the map loads. (7) Review compliance on each Mapbox GL JS library upgrade.

If you want to avoid telemetry and US data transfers, consider: (1) Leaflet.js with OpenStreetMap tiles self hosted or served from an EU based tile provider, which avoids third party US data flows entirely. (2) MapLibre GL JS, the community maintained open source fork of Mapbox GL JS that does not include telemetry by default and does not require a Mapbox account. (3) Static map images generated server side from OSM data. (4) Mapbox GL JS with telemetry explicitly disabled and tiles proxied through your own server to avoid direct visitor to Mapbox connections. Each option has trade offs in feature richness and hosting effort.

Because Mapbox GL JS primarily uses local storage rather than cookies, your policy should be titled cookie and storage policy or similar. Add an entry for mapbox.eventData (local storage, Mapbox Inc., purpose: anonymous telemetry identifier and session token, duration: persistent until cleared). If you have disabled telemetry, note this and explain why only the tile request IP transfer remains. Reference the Mapbox US data transfer and the applicable SCCs. Review and update this entry whenever you upgrade the Mapbox GL JS library.