FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Other

OpenStreetMap

PreferencesOfficial website

OpenStreetMap (OSM) is the leading open data project for geographic data, operated by the non profit OpenStreetMap Foundation in the United Kingdom. The free OSM tile server and its EU commercial mirrors set no cookies and respect strict privacy policies.

Block OpenStreetMap until consentScan my site
Overview

What does OpenStreetMap do?

What OpenStreetMap is

OpenStreetMap is the largest collaborative open geographic database, founded in 2004 and operated by the OpenStreetMap Foundation, a non profit registered in the United Kingdom. The database is built by more than 10 million contributors editing roads, buildings, footpaths and points of interest under the Open Database License (ODbL). It powers public maps on government, education, news, tourism and ecommerce websites and is the data source behind Mapbox, MapTiler, Stadia Maps, Apple Maps, Facebook Maps and many others.

The standard tile server and its privacy posture

The standard tile server (tile.openstreetmap.org) is hosted on bare metal infrastructure in the UK (Imperial College London), Germany (Hetzner Falkenstein) and the Netherlands. No cookies are set. The visitor IP is processed only to deliver the requested tiles and to enforce the OSMF tile usage policy (no scraping, no commercial heavy use). Logs are kept for a maximum of 14 days then anonymised. The OSMF privacy policy is available at osmfoundation.org and is reviewed yearly by the OSMF Operations Working Group.

Tile usage policy and commercial mirrors

The free tile server is intended for low traffic personal or educational use. Commercial sites should use one of the EU based mirrors: Stadia Maps (Sweden), MapTiler (Switzerland), Geoapify (Germany), OSM France (Paris), Tracestrack (Estonia) or self host with OpenMapTiles, TileServer GL or Protomaps PMTiles. All these options keep OSM as the data source while distributing the rendering load and providing commercial support, attribution requirements and an SLA.

GDPR and ePrivacy implications

OpenStreetMap fits the strictly necessary exemption of ePrivacy art. 5(3) because no cookie is set. Legitimate interest under GDPR art. 6(1)(f) covers the routing IP processing. The Munich Google Fonts ruling does not apply because the data stays in the European Economic Area or in the UK, which benefits from a Commission adequacy decision since 2021. No DPIA is required for the standard use case. Nominatim (the OSM geocoder) shares the same posture, with the additional consideration that search queries containing personal addresses are processed by the OSMF in the EU and UK.

Recommended setup for European publishers

Use Leaflet or MapLibre GL JS as the JavaScript library, point the tile URL to an EU based commercial mirror or self host using Protomaps PMTiles for full control, attribute OpenStreetMap as required by the ODbL license, list the chosen tile provider as a sub processor in the privacy notice and document the EU residency. For geocoding, use a dedicated EU based provider like Geoapify, Photon (Komoot, self hosted) or MapTiler rather than hammering the free Nominatim service.

Compliance

OpenStreetMap and the GDPR

Legal basis
Legitimate interest of the publisher in displaying a map (GDPR art. 6(1)(f)) and the technically necessary exemption for the network call to fetch the requested tile under ePrivacy art. 5(3). The standard OSM tile server sets no cookies; it logs the IP for a short period (capped at 14 days per the OSMF policy) to monitor abuse and capacity. The Munich Google Fonts ruling does not apply because the data flow stays in the European Economic Area or in the UK with adequacy decision.
Risk level
low
Applicable regulations
GDPR, UK GDPR, ePrivacy Directive, CNIL guidance on web maps, UK Data Protection Act 2018, EU Commission UK adequacy decision (2021), German TTDSG

Impact assessment (DPIA)

A DPIA is not required for OpenStreetMap because the data flow is minimal (IP for routing, no cookies, no tracking). A DPIA may be recommended only if you operate a high traffic site that hammers the free OSM tile server (which violates the tile usage policy) or if you embed third party geocoding (Nominatim heavy use, Photon, Geoapify) that may transmit search queries containing personal addresses.

Sample text for your banner

Our website displays maps powered by OpenStreetMap, an open data project operated by the OpenStreetMap Foundation (United Kingdom non profit). The map tiles come from EU based servers (UK, Germany, Netherlands) and no cookies are written. Your IP address is processed only for routing and not used for tracking. No consent is required.
Cookies and trackers

What OpenStreetMap sets and contacts

Tracking method
open_data_geographic_database_with_free_tile_server_and_optional_third_party_renderers
Server location
OpenStreetMap is operated by the OpenStreetMap Foundation, a non profit registered in the United Kingdom. The main openstreetmap.org website and the standard tile server (tile.openstreetmap.org) are hosted on bare metal infrastructure in the United Kingdom (Imperial College London), Germany (Falkenstein, Hetzner) and the Netherlands. European tile renderers are operated by associations like OSM France (Paris), OSM Germany (Karlsruhe) and Stadia Maps (Sweden) as commercial alternatives.
Cookieless mode available
Yes

Cookies set (1)

NameTypeDurationPurpose
none on tile.openstreetmap.orgFirst party (OpenStreetMap tile server)N/AThe standard OSM tile server sets no cookies. The osm_session cookie is set only when a user logs into the openstreetmap.org editing interface, which is not the case for embedded maps

Third-party domains contacted (7)

  • openstreetmap.org
  • tile.openstreetmap.org
  • a.tile.openstreetmap.org
  • b.tile.openstreetmap.org
  • c.tile.openstreetmap.org
  • nominatim.openstreetmap.org
  • osmfoundation.org
Questions

Frequently asked questions about OpenStreetMap

Can't find your question? Write to us, we answer fast.

What cookies does OpenStreetMap set?

None on the standard tile server. The openstreetmap.org main site sets a session cookie (osm_session) only when the visitor logs into the editing interface; the tile.openstreetmap.org endpoint used for embedding maps sets no cookie.

Is consent required for OpenStreetMap?

No. The standard tile server sets no cookies, the data flow stays inside the European Economic Area (or in the UK under adequacy) and the IP is logged briefly only for tile usage policy enforcement. No consent banner is required.

What is the legal basis for OpenStreetMap?

Legitimate interest of the publisher (GDPR art. 6(1)(f)) to render the map and contract (art. 6(1)(b)) when the map is necessary to deliver the requested service. The strictly necessary exemption of ePrivacy art. 5(3) applies because nothing is stored on the visitor device.

Are data transferred outside the EU?

No. The standard tile server is hosted on bare metal in the UK (Imperial College London), Germany (Hetzner Falkenstein) and the Netherlands. The UK benefits from a Commission adequacy decision. Commercial mirrors are also EU based (Stadia in Sweden, MapTiler in Switzerland, Geoapify in Germany, OSM France in Paris).

Do I need a DPIA for OpenStreetMap?

No for the standard use case. A DPIA is recommended only if you saturate the free tile server (violation of the tile usage policy) or use Nominatim at high volume with freeform queries containing personal addresses.

How do I use OpenStreetMap compliantly?

Use Leaflet or MapLibre GL JS, point the tile URL to an EU based commercial mirror (Stadia Maps, MapTiler, Geoapify) for production traffic, attribute OpenStreetMap as required by the ODbL license, list the chosen tile provider in the privacy notice, and self host with Protomaps PMTiles if you need full data control.

What are the alternatives to OpenStreetMap?

Mapbox (US, commercial), Apple Maps via MapKit JS, Google Maps Platform, HERE Maps (Netherlands, commercial), TomTom Maps (Netherlands, commercial), Bing Maps (US). For open data with EU residency, OpenStreetMap is the gold standard.

How do I update my cookie policy after adding OpenStreetMap?

State that the map is powered by OpenStreetMap data and rendered by the chosen tile provider. List the tile provider as a sub processor with its EU location. Confirm no cookies are set and no data is transferred outside the EU. Add the ODbL attribution required by the licence.

Same category

More services: Other

See the whole category

iHomefinder IDX

iHomefinder IDX is a versatile web technology that supports digital platforms with specialized functionality and enhanced capabilities. It provides robust tools and services that integrate with modern websites and applications seamlessly. iHomefinder IDX is designed to improve operational efficiency, user experience, and digital performance. Trusted by developers and businesses alike, iHomefinder IDX offers reliable solutions that scale with organizational needs and evolving web standards.

Preferences

Bugzilla

Bugzilla is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Bugzilla integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Bugzilla helps organizations maintain robust websites that meet user expectations and technical requirements.

Preferences

Microsoft 365

Microsoft 365 is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Microsoft 365 integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Microsoft 365 helps organizations maintain robust websites that meet user expectations and technical requirements.

Other

SpeedOf.Me

SpeedOf.Me is an integration and connectivity platform that enables businesses to connect web applications, APIs, and services seamlessly. It provides pre-built connectors, webhook management, and data synchronization. SpeedOf.Me supports real-time data flow between marketing, sales, and operational tools, eliminating data silos and manual processes. With visual workflow builders and robust API management, SpeedOf.Me helps create unified digital ecosystems that drive efficiency.

Analytics

WP Job Openings

WP Job Openings is a human resources and recruitment platform that streamlines hiring, onboarding, and talent management processes. It provides applicant tracking, job board integration, employee management, and performance review tools. WP Job Openings automates repetitive HR tasks, enabling teams to focus on strategic initiatives. With self-service portals, analytics dashboards, and compliance management, WP Job Openings helps organizations attract, retain, and develop top talent efficiently.

Other

MapTiler

Maptiler is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Maptiler supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Maptiler ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Preferences

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site