FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Other

Mapbox.js

PreferencesOfficial website

Mapbox.js and Mapbox GL JS render interactive maps in the browser, loading tiles and telemetry from Mapbox servers in the United States, which raises GDPR data transfer questions.

Block Mapbox.js until consentScan my site
Overview

What does Mapbox.js do?

What Mapbox is

Mapbox is a location platform whose JavaScript libraries, Mapbox.js and the newer Mapbox GL JS, embed interactive maps, geocoding and routing into websites and apps. When a page loads a Mapbox map, the visitor browser requests map tiles, fonts and styles directly from Mapbox infrastructure and the library can send anonymous usage telemetry back to Mapbox.

Cookies and data it collects

Mapbox GL JS does not usually set browser cookies, but every map request transmits the visitor IP address, the requested location and coordinates, and technical details such as browser and device. The library also collects telemetry about map interactions unless you disable it. The IP address and location data are personal data even without a cookie.

GDPR and ePrivacy implications

Because no information is stored or read on the device by default, the ePrivacy consent rule for cookies may not strictly apply, but the GDPR still governs the transfer of the IP address and location data to Mapbox. Regulators such as the CNIL have treated automatically loaded third party resources, including maps, as requiring user consent when they expose data to a foreign controller.

Consent requirements

The safest approach is to load the Mapbox map only after the visitor has consented, for example behind a click to load placeholder. If you rely on legitimate interest instead, you must document a balancing test and offer an easy objection. Telemetry should be disabled where it is not necessary.

Data transfers

Mapbox is a United States company and serves tiles and processes requests from US infrastructure, so using its maps involves an international data transfer. This transfer should be covered by the EU US Data Privacy Framework, under which Mapbox can self certify, or by Standard Contractual Clauses with supplementary measures.

Practical compliance steps

Use a click to load wrapper so no Mapbox request fires before consent, disable telemetry in the map options, restrict your access token and document the transfer in your privacy notice. Consider a self hosted or European map alternative for pages where consent rates are low.

Compliance

Mapbox.js and the GDPR

Mapbox.js is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

Legal basis
Consent under Article 6(1)(a) GDPR for loading the third party map, or a carefully assessed legitimate interest
Risk level
medium
Applicable regulations
GDPR, ePrivacy Directive

Impact assessment (DPIA)

A DPIA is worth considering when Mapbox is used for continuous location tracking, fleet or user positioning rather than a simple static map. Assess the United States transfer, the volume of location data and whether a European alternative would reduce risk.

Sample text for your banner

We use Mapbox to display interactive maps. Loading a map sends your IP address and location request to Mapbox in the United States. Maps load only after you accept.
Cookies and trackers

What Mapbox.js sets and contacts

Tracking method
JavaScript SDK with API requests and anonymous telemetry
Server location
United States
Cookieless mode available
Yes
Data transferred outside the EU
Map tiles, geocoding and telemetry are served from Mapbox infrastructure in the United States, so each map view sends the visitor IP address and request data to a US controller. Transfers rely on the EU US Data Privacy Framework or Standard Contractual Clauses.

Cookies set (2)

NameTypeDurationPurpose
mapbox.eventDataLocal storagePersistent until clearedStores an anonymous identifier and event data used by Mapbox telemetry. Can be disabled in the map options.
mapbox.eventData.uuidLocal storagePersistent until clearedHolds the anonymous telemetry identifier associated with map interactions.

Third-party domains contacted (3)

  • api.mapbox.com
  • events.mapbox.com
  • tiles.mapbox.com
Questions

Frequently asked questions about Mapbox.js

Can't find your question? Write to us, we answer fast.

Does Mapbox set cookies?

Mapbox GL JS does not set traditional cookies by default, but it stores an anonymous identifier in local storage for telemetry and sends your IP address with every map request. You can disable telemetry in the map configuration.

Do I need consent for Mapbox?

In most European interpretations you should obtain consent before loading a Mapbox map, because the request discloses the visitor IP address and location to a United States provider. A click to load placeholder is the cleanest way to capture this consent.

What is the legal basis for Mapbox?

You can rely on consent under Article 6(1)(a) of the GDPR, or on a documented legitimate interest under Article 6(1)(f) if the map is essential and telemetry is disabled. The ePrivacy rules are less central here because Mapbox does not store cookies by default.

Does Mapbox transfer data to the United States?

Yes, Mapbox is a US company and serves map tiles and processes requests from US infrastructure, so the visitor IP and location are transferred there. Rely on the EU US Data Privacy Framework or Standard Contractual Clauses.

Do I need a DPIA for Mapbox?

A simple decorative map rarely needs a DPIA, but continuous location tracking, fleet monitoring or user positioning at scale usually does. Assess the transfer and the sensitivity of the location data.

How do I implement Mapbox compliantly?

Gate the map behind consent, disable telemetry, restrict the access token to your domains and document the US transfer in your privacy notice. Provide a fallback such as a static image or address for users who decline.

Are there alternatives to Mapbox?

European or self hosted options include MapLibre GL with self hosted tiles, OpenStreetMap with a European tile server, and providers such as HERE or local mapping services. These can reduce or remove the United States transfer.

How do I update my cookie policy for Mapbox?

Mention that Mapbox maps load only after consent, describe the local storage telemetry identifier and the IP based location request, and disclose the transfer to the United States. Update the notice if you enable telemetry or change providers.

Same category

More services: Other

See the whole category

Fullbay

Fullbay is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Fullbay enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Fullbay empowers marketing teams to achieve measurable growth.

Marketing

Mappedin

Mappedin is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Mappedin integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Mappedin helps organizations maintain robust websites that meet user expectations and technical requirements.

Preferences

AccessiBe

AccessiBe is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. AccessiBe integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, AccessiBe helps organizations maintain robust websites that meet user expectations and technical requirements.

Other

ExpertRec

ExpertRec is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. ExpertRec supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, ExpertRec enables informed decisions that improve experience and drive results.

Analytics

Kiva

Kiva is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Kiva supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Kiva ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Preferences

Lendi

Lendi is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Lendi supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Lendi ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Preferences

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site