> What Mapbox GL JS sends to the United States, why embedded maps raise GDPR and ePrivacy questions and how to load Mapbox maps with proper consent. > > Canonical: https://www.flowconsent.com/en/services/other/mapbox-js Other # Mapbox.js Preferences · [Official website](https://github.com/mapbox/mapbox.js) Mapbox.js and Mapbox GL JS render interactive maps in the browser, loading tiles and telemetry from Mapbox servers in the United States, which raises GDPR data transfer questions. [Block Mapbox.js until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=other) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Other](https://www.flowconsent.com/en/services/other) - Consent Preferences - Prior consent Required - Documented cookies 2 - Third-party domains 3 - Servers United States Overview ## What does Mapbox.js do? ## **What Mapbox is** Mapbox is a location platform whose JavaScript libraries, Mapbox.js and the newer Mapbox GL JS, embed interactive maps, geocoding and routing into websites and apps. When a page loads a Mapbox map, the visitor browser requests map tiles, fonts and styles directly from Mapbox infrastructure and the library can send anonymous usage telemetry back to Mapbox. ## **Cookies and data it collects** Mapbox GL JS does not usually set browser cookies, but every map request transmits the visitor IP address, the requested location and coordinates, and technical details such as browser and device. The library also collects telemetry about map interactions unless you disable it. The IP address and location data are personal data even without a cookie. ## **GDPR and ePrivacy implications** Because no information is stored or read on the device by default, the ePrivacy consent rule for cookies may not strictly apply, but the GDPR still governs the transfer of the IP address and location data to Mapbox. Regulators such as the CNIL have treated automatically loaded third party resources, including maps, as requiring user consent when they expose data to a foreign controller. ## **Consent requirements** The safest approach is to load the Mapbox map only after the visitor has consented, for example behind a click to load placeholder. If you rely on legitimate interest instead, you must document a balancing test and offer an easy objection. Telemetry should be disabled where it is not necessary. ## **Data transfers** Mapbox is a United States company and serves tiles and processes requests from US infrastructure, so using its maps involves an international data transfer. This transfer should be covered by the EU US Data Privacy Framework, under which Mapbox can self certify, or by Standard Contractual Clauses with supplementary measures. ## **Practical compliance steps** Use a click to load wrapper so no Mapbox request fires before consent, disable telemetry in the map options, restrict your access token and document the transfer in your privacy notice. Consider a self hosted or European map alternative for pages where consent rates are low. Compliance ## Mapbox.js and the GDPR Mapbox.js is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent under Article 6(1)(a) GDPR for loading the third party map, or a carefully assessed legitimate interest - Risk level medium - Applicable regulations GDPR, ePrivacy Directive ### Impact assessment (DPIA) A DPIA is worth considering when Mapbox is used for continuous location tracking, fleet or user positioning rather than a simple static map. Assess the United States transfer, the volume of location data and whether a European alternative would reduce risk. ### Sample text for your banner > We use Mapbox to display interactive maps. Loading a map sends your IP address and location request to Mapbox in the United States. Maps load only after you accept. Cookies and trackers ## What Mapbox.js sets and contacts - Tracking method JavaScript SDK with API requests and anonymous telemetry - Server location United States - Cookieless mode available Yes - Data transferred outside the EU Map tiles, geocoding and telemetry are served from Mapbox infrastructure in the United States, so each map view sends the visitor IP address and request data to a US controller. Transfers rely on the EU US Data Privacy Framework or Standard Contractual Clauses. ### Cookies set (2) | Name | Type | Duration | Purpose | | --------------------- | ------------- | ------------------------ | ----------------------------------------------------------------------------------------------------------- | | mapbox.eventData | Local storage | Persistent until cleared | Stores an anonymous identifier and event data used by Mapbox telemetry. Can be disabled in the map options. | | mapbox.eventData.uuid | Local storage | Persistent until cleared | Holds the anonymous telemetry identifier associated with map interactions. | ### Third-party domains contacted (3) - `api.mapbox.com` - `events.mapbox.com` - `tiles.mapbox.com` Questions ## Frequently asked questions about Mapbox.js Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Does Mapbox set cookies? Mapbox GL JS does not set traditional cookies by default, but it stores an anonymous identifier in local storage for telemetry and sends your IP address with every map request. You can disable telemetry in the map configuration. ### Do I need consent for Mapbox? In most European interpretations you should obtain consent before loading a Mapbox map, because the request discloses the visitor IP address and location to a United States provider. A click to load placeholder is the cleanest way to capture this consent. ### What is the legal basis for Mapbox? You can rely on consent under Article 6(1)(a) of the GDPR, or on a documented legitimate interest under Article 6(1)(f) if the map is essential and telemetry is disabled. The ePrivacy rules are less central here because Mapbox does not store cookies by default. ### Does Mapbox transfer data to the United States? Yes, Mapbox is a US company and serves map tiles and processes requests from US infrastructure, so the visitor IP and location are transferred there. Rely on the EU US Data Privacy Framework or Standard Contractual Clauses. ### Do I need a DPIA for Mapbox? A simple decorative map rarely needs a DPIA, but continuous location tracking, fleet monitoring or user positioning at scale usually does. Assess the transfer and the sensitivity of the location data. ### How do I implement Mapbox compliantly? Gate the map behind consent, disable telemetry, restrict the access token to your domains and document the US transfer in your privacy notice. Provide a fallback such as a static image or address for users who decline. ### Are there alternatives to Mapbox? European or self hosted options include MapLibre GL with self hosted tiles, OpenStreetMap with a European tile server, and providers such as HERE or local mapping services. These can reduce or remove the United States transfer. ### How do I update my cookie policy for Mapbox? Mention that Mapbox maps load only after consent, describe the local storage telemetry identifier and the IP based location request, and disclose the transfer to the United States. Update the notice if you enable telemetry or change providers. Same category ## More services: Other [See the whole category](https://www.flowconsent.com/en/services/other) ### [Fullbay](https://www.flowconsent.com/en/services/other/fullbay) [Fullbay is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Fullbay enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Fullbay empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/other/fullbay) [Marketing](https://www.flowconsent.com/en/services/other/fullbay) · ### [Mappedin](https://www.flowconsent.com/en/services/other/mappedin) [Mappedin is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Mappedin integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Mappedin helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/other/mappedin) [Preferences](https://www.flowconsent.com/en/services/other/mappedin) · ### [AccessiBe](https://www.flowconsent.com/en/services/other/accessibe) [AccessiBe is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. AccessiBe integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, AccessiBe helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/other/accessibe) [Other](https://www.flowconsent.com/en/services/other/accessibe) · ### [ExpertRec](https://www.flowconsent.com/en/services/other/expertrec) [ExpertRec is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. ExpertRec supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, ExpertRec enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/other/expertrec) [Analytics](https://www.flowconsent.com/en/services/other/expertrec) · ### [Kiva](https://www.flowconsent.com/en/services/other/kiva) [Kiva is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Kiva supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Kiva ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/other/kiva) [Preferences](https://www.flowconsent.com/en/services/other/kiva) · ### [Lendi](https://www.flowconsent.com/en/services/other/lendi) [Lendi is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Lendi supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Lendi ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/other/lendi) [Preferences](https://www.flowconsent.com/en/services/other/lendi) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)