> Embedding Mapbox under GDPR: consent for Mapbox GL JS telemetry, US data transfers, EU tile delivery, disabling telemetry, click to load and the DPA. > > Canonical: https://www.flowconsent.com/en/services/other/mapbox Other # Mapbox Preferences Mapbox is a leading commercial provider of vector maps, geocoding and navigation. The Mapbox GL JS SDK transmits the visitor IP and an anonymised telemetry signal to Mapbox US servers. Consent is required in the EU; the SDK telemetry can be disabled. [Block Mapbox until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=other) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Other](https://www.flowconsent.com/en/services/other) - Consent Preferences - Prior consent Required - Documented cookies 2 - Third-party domains 7 - Servers Mapbox is operated by Mapbox Inc., a US company headquartered in Washington DC. The Mapbox platform runs on Amazon Web Services with primary regions in the United States (us-east-1) and Europe (eu-west-1 Ireland). Vector tile delivery uses a global CDN with European edge nodes. The Mapbox Account API, the Mapbox Studio editor and the Map Matching API run from the US data centres; EU customers can request EU residency for tile delivery but not for the corporate control plane. Overview ## What does Mapbox do? ## **What Mapbox is** Mapbox is a leading commercial provider of vector maps, geocoding, navigation and location based developer services. The product line covers Mapbox GL JS (web map SDK), Mapbox Studio (visual style editor), Mapbox Geocoding API, Mapbox Directions API, Mapbox Map Matching, Static Images, Navigation SDK for mobile, Search Box and the Boundaries tilesets. Mapbox vector tiles render server side from OpenStreetMap, OpenAddresses and proprietary datasets combined. ## **What data the SDK transmits** At map initialisation, Mapbox GL JS sends the visitor IP, the user agent, the referrer URL, the access token and the requested tile coordinates to api.mapbox.com. By default the SDK also sends anonymised telemetry data (movement samples, viewport changes) to events.mapbox.com to improve the Mapbox products. The telemetry can be disabled with map.setConfigProperty(basemap, telemetry, false) or by setting the EventManager to disabled. Local storage is used to remember the user choice of opting out from the Mapbox attribution telemetry. ## **GDPR consent and ePrivacy** Loading the Mapbox SDK with default telemetry requires prior consent under GDPR art. 6(1)(a) and ePrivacy art. 5(3) because the SDK writes a local storage entry, sends anonymised telemetry and transfers the IP to the United States. When telemetry is disabled and only tiles are fetched, legitimate interest can be argued for the map necessary to deliver the requested service, but the Munich Google Fonts ruling logic applies because the IP still goes to a US server. A click to load wrapper is the recommended pattern. ## **Data residency and US transfers** Mapbox runs the api.mapbox.com endpoint from the US by default. EU customers on enterprise plans can request EU tile delivery, but the account API, the events API and the Mapbox Studio remain US based. Mapbox is certified under the EU US Data Privacy Framework with 2021 SCCs as fallback. A Transfer Impact Assessment must be on file. Mapbox publishes its sub processor list and an audit report (SOC 2 type II). ## **Compliant integration pattern** Disable the Mapbox telemetry at SDK initialisation, use a click to load wrapper, integrate with a TCF v2.2 CMP, request EU tile delivery on the enterprise plan, list Mapbox as a sub processor in the privacy notice, sign the Mapbox DPA, mention the Data Privacy Framework certification, and consider migrating to MapLibre GL JS with an EU tile provider (Stadia, MapTiler) for full EU residency. Compliance ## Mapbox and the GDPR Mapbox is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent under GDPR art. 6(1)(a) and ePrivacy art. 5(3) for the Mapbox GL JS map because the SDK telemetry collects anonymised location samples by default and the visitor IP is transferred to the United States. The mapbox-telemetry flag can be disabled at SDK initialisation, reducing the data flow to the tile request itself; in that case legitimate interest plus a click to load wrapper can be defended. The Munich Google Fonts ruling logic applies given the US infrastructure. - Risk level medium - Applicable regulations GDPR, ePrivacy Directive, CNIL guidance on web maps, EU US Data Privacy Framework, Munich Google Fonts ruling logic, German TTDSG, AEPD geolocation guidelines ### Impact assessment (DPIA) A DPIA is recommended for any Mapbox deployment in the EU because the SDK transmits the visitor IP, the access token and the anonymised telemetry signal to Mapbox US infrastructure. The DPIA should cover the Mapbox SDK telemetry toggle, the use of the Mapbox Geocoding or Directions API (which may contain freeform addresses), the EU tile delivery option, the integration with a CMP and the Mapbox Data Privacy Framework certification. ### Sample text for your banner > Our website displays maps powered by Mapbox, operated by Mapbox Inc. (United States). When the map loads, the Mapbox GL JS SDK transmits your IP address, your user agent and the access token to Mapbox servers in the United States and sends anonymised telemetry to improve the service. With your consent we activate the map; refusing displays a static fallback image. Data is processed under the EU US Data Privacy Framework. Cookies and trackers ## What Mapbox sets and contacts - Tracking method commercial\_map\_service\_with\_javascript\_sdk\_vector\_tiles\_geocoding\_and\_analytics\_telemetry - Server location Mapbox is operated by Mapbox Inc., a US company headquartered in Washington DC. The Mapbox platform runs on Amazon Web Services with primary regions in the United States (us-east-1) and Europe (eu-west-1 Ireland). Vector tile delivery uses a global CDN with European edge nodes. The Mapbox Account API, the Mapbox Studio editor and the Map Matching API run from the US data centres; EU customers can request EU residency for tile delivery but not for the corporate control plane. - Data transferred outside the EU Mapbox Inc. is US headquartered. Every Mapbox GL JS or Mapbox SDK request transmits the visitor IP, the user agent and the access token to Mapbox servers in the United States. Mapbox is certified under the EU US Data Privacy Framework and uses the 2021 Standard Contractual Clauses as fallback. Telemetry data (anonymised aggregate movements when the Mapbox SDK telemetry is enabled) is processed in the US to improve the Mapbox products. ### Cookies set (2) | Name | Type | Duration | Purpose | | --------------------------------------- | ---------------------------------------------------------------- | ---------- | ---------------------------------------------------------------------------------------------------------------------- | | mapbox.attribution.show (Local Storage) | First party (Mapbox GL JS local storage) | Persistent | Stores the visitor choice to dismiss the Mapbox attribution telemetry banner | | mapbox.eventData.uuid (Local Storage) | First party (Mapbox GL JS local storage, when telemetry enabled) | Persistent | Stores a UUID used by the Mapbox SDK to deduplicate anonymous telemetry events; only present when telemetry is enabled | ### Third-party domains contacted (7) - `api.mapbox.com` - `events.mapbox.com` - `a.tiles.mapbox.com` - `b.tiles.mapbox.com` - `c.tiles.mapbox.com` - `d.tiles.mapbox.com` - `mapbox.com` Questions ## Frequently asked questions about Mapbox Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does Mapbox set? Mapbox does not set classic cookies. Mapbox GL JS stores a local storage entry for the attribution telemetry opt out. The map sends the IP and an anonymised telemetry signal to events.mapbox.com unless telemetry is disabled at SDK initialisation. ### Is consent required for Mapbox? Yes with default settings, because the SDK telemetry transmits anonymised location samples and the IP to Mapbox US servers. If telemetry is disabled and only tiles are fetched, the Munich Google Fonts ruling logic still suggests consent because the IP goes to a US server. ### What is the legal basis for Mapbox? Consent (GDPR art. 6(1)(a)) for the default SDK with telemetry. Legitimate interest (art. 6(1)(f)) is defensible only when telemetry is disabled, the map is essential to the service, a balancing test is documented and Data Privacy Framework is in place. ### Are data transferred to the United States? Yes by default. api.mapbox.com and events.mapbox.com are operated from the US. EU tile delivery is available on enterprise plans but the account and events endpoints remain US. Mapbox is certified under the EU US Data Privacy Framework with SCCs 2021 fallback. ### Do I need a DPIA for Mapbox? Recommended in most cases because of the persistent US transfer and the telemetry. The DPIA should document the SDK telemetry toggle, the use of Geocoding or Directions APIs that may contain freeform addresses and the EU tile delivery option. ### How do I implement Mapbox compliantly? Disable telemetry at SDK initialisation, use a click to load wrapper, integrate with a TCF v2.2 CMP, request EU tile delivery on enterprise, sign the Mapbox DPA, list Mapbox in the privacy notice, and consider migrating to MapLibre GL JS with an EU tile provider for full EU residency. ### What are the alternatives to Mapbox? MapLibre GL JS (open source fork of Mapbox GL JS) with EU tile providers like Stadia Maps, MapTiler, Geoapify or CARTO Madrid. Other EU options: Leaflet with OpenStreetMap tiles, OpenLayers. For commercial parity in the US camp: Google Maps Platform, Apple MapKit JS, Microsoft Azure Maps. ### How do I update my cookie policy after adding Mapbox? List Mapbox Inc. as a sub processor, declare the local storage entry for telemetry opt out, mention the IP transfer to api.mapbox.com and events.mapbox.com in the United States under the Data Privacy Framework, link to the Mapbox Privacy Policy and provide a DSAR contact. Same category ## More services: Other [See the whole category](https://www.flowconsent.com/en/services/other) ### [TeamUnify](https://www.flowconsent.com/en/services/other/teamunify) [TeamUnify is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. TeamUnify enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, TeamUnify empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/other/teamunify) [Marketing](https://www.flowconsent.com/en/services/other/teamunify) · ### [Job Board Fire](https://www.flowconsent.com/en/services/other/job-board-fire) [Job Board Fire is a human resources and recruitment platform that streamlines hiring, onboarding, and talent management processes. It provides applicant tracking, job board integration, employee management, and performance review tools. Job Board Fire automates repetitive HR tasks, enabling teams to focus on strategic initiatives. With self-service portals, analytics dashboards, and compliance management, Job Board Fire helps organizations attract, retain, and develop top talent efficiently.](https://www.flowconsent.com/en/services/other/job-board-fire) [Preferences](https://www.flowconsent.com/en/services/other/job-board-fire) · ### [Data8](https://www.flowconsent.com/en/services/other/data8) [Data8 is a data management and processing platform that helps businesses collect, organize, and activate their data assets. It provides data integration, transformation, and governance tools for reliable pipelines. Data8 supports real-time and batch processing, quality monitoring, and compliance management. With connectors to major data sources and destinations, Data8 enables organizations to unify their data infrastructure and drive informed decision making.](https://www.flowconsent.com/en/services/other/data8) [Other](https://www.flowconsent.com/en/services/other/data8) · ### [MindStudio](https://www.flowconsent.com/en/services/other/mindstudio) [MindStudio is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. MindStudio integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, MindStudio makes advanced AI accessible to all teams.](https://www.flowconsent.com/en/services/other/mindstudio) [Analytics](https://www.flowconsent.com/en/services/other/mindstudio) · ### [Showdigs](https://www.flowconsent.com/en/services/other/showdigs) [Showdigs is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Showdigs enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Showdigs empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/other/showdigs) [Marketing](https://www.flowconsent.com/en/services/other/showdigs) · ### [FAST ESP](https://www.flowconsent.com/en/services/other/fast-esp) [FAST ESP is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. FAST ESP offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, FAST ESP empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/other/fast-esp) [Analytics](https://www.flowconsent.com/en/services/other/fast-esp) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)