Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Leaflet is a lightweight open source JavaScript library for interactive maps. It sets no cookies of its own, but the map tiles it displays are fetched from a tile provider you choose, which determines the privacy impact.
Leaflet is a widely used open source JavaScript library for building interactive maps. It is small, has no built in tracking and can be self hosted, which makes it popular as a privacy friendlier foundation for maps. Leaflet itself only handles rendering and interaction; the actual map imagery comes from a separate tile provider that you configure.
The Leaflet library does not set cookies or send analytics about your visitors. However, to display a map the browser must download tile images from the configured tile server, and each of those requests carries the visitor IP address and the coordinates being viewed. Whether that data leaves the European Union depends entirely on which tile provider you point Leaflet at.
Because Leaflet stores nothing on the device, the ePrivacy cookie consent rule usually does not apply to the library itself. The GDPR still applies to the tile requests, since the IP address sent to the tile provider is personal data. If you self host the tiles, there is no third party processing at all.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
When tiles are loaded from a third party server, especially one outside the EU, you should obtain consent or carry out a documented legitimate interest assessment before the map loads. If you serve tiles from your own infrastructure, no separate consent is needed for the map because no third party receives the data.
Leaflet creates no transfers on its own. The transfer question is decided by the tile provider: OpenStreetMap and several European providers keep data in the EU, while United States providers such as some commercial tile services involve a transfer that needs the EU US Data Privacy Framework or Standard Contractual Clauses.
Choose a European or self hosted tile provider where possible, load the map behind consent if the provider is outside the EU, and document the provider and any transfer in your privacy notice. Avoid pulling the Leaflet library and plugins from third party CDNs that log IP addresses; host them yourself instead.
Websites using Leaflet must obtain user consent under GDPR regulations.
DPIA considerations
Leaflet on its own rarely triggers a DPIA. The need depends on the tile provider and on whether you add location tracking, so assess the provider, any United States transfer and the scale of location data you process.
Sample consent text
This page uses Leaflet to show a map. Map tiles are loaded from our tile provider, which receives your IP address. The map loads only after you accept.
Third-party domains contacted
tile.openstreetmap.orgunpkg.comcdnjs.cloudflare.comLeaflet collects user analytics data — you legally need a consent banner. Try FlowConsent free.
No, the Leaflet library does not set cookies or store identifiers on the device. Any privacy impact comes from the tile provider you configure, not from Leaflet itself.
If your tiles come from a third party server, particularly one outside the EU, you should obtain consent before the map loads because the request reveals the visitor IP address. With fully self hosted tiles, no separate consent is required.
For third party tiles you can rely on consent under Article 6(1)(a) of the GDPR or a documented legitimate interest under Article 6(1)(f). Self hosted tiles need no special basis because no third party is involved.
Not by itself. A US transfer only happens if you choose a United States tile provider, in which case you need the EU US Data Privacy Framework or Standard Contractual Clauses.
A standard map rarely requires a DPIA. Consider one if you combine Leaflet with continuous location tracking or large scale profiling, and assess the tile provider and any transfer.
Prefer European or self hosted tiles, host the Leaflet library yourself rather than from a logging CDN, gate the map behind consent when a third country provider is used and document everything in your privacy notice.
Leaflet is already one of the most privacy friendly choices. You can pair it with MapLibre GL, self hosted OpenStreetMap tiles or a European tile service to keep all data in the EU.
Strictly speaking Leaflet sets no cookies, so focus your policy on the tile provider: name it, explain that map requests share the visitor IP and disclose any transfer outside the EU. Update it if you change tile providers.