FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Personalization

Leaflet

Analytics

Leaflet is a lightweight open source JavaScript library for interactive maps. It sets no cookies of its own, but the map tiles it displays are fetched from a tile provider you choose, which determines the privacy impact.

Block Leaflet until consentScan my site
Overview

What does Leaflet do?

What Leaflet is

Leaflet is a widely used open source JavaScript library for building interactive maps. It is small, has no built in tracking and can be self hosted, which makes it popular as a privacy friendlier foundation for maps. Leaflet itself only handles rendering and interaction; the actual map imagery comes from a separate tile provider that you configure.

Cookies and data it collects

The Leaflet library does not set cookies or send analytics about your visitors. However, to display a map the browser must download tile images from the configured tile server, and each of those requests carries the visitor IP address and the coordinates being viewed. Whether that data leaves the European Union depends entirely on which tile provider you point Leaflet at.

GDPR and ePrivacy implications

Because Leaflet stores nothing on the device, the ePrivacy cookie consent rule usually does not apply to the library itself. The GDPR still applies to the tile requests, since the IP address sent to the tile provider is personal data. If you self host the tiles, there is no third party processing at all.

Consent requirements

When tiles are loaded from a third party server, especially one outside the EU, you should obtain consent or carry out a documented legitimate interest assessment before the map loads. If you serve tiles from your own infrastructure, no separate consent is needed for the map because no third party receives the data.

Data transfers

Leaflet creates no transfers on its own. The transfer question is decided by the tile provider: OpenStreetMap and several European providers keep data in the EU, while United States providers such as some commercial tile services involve a transfer that needs the EU US Data Privacy Framework or Standard Contractual Clauses.

Practical compliance steps

Choose a European or self hosted tile provider where possible, load the map behind consent if the provider is outside the EU, and document the provider and any transfer in your privacy notice. Avoid pulling the Leaflet library and plugins from third party CDNs that log IP addresses; host them yourself instead.

Compliance

Leaflet and the GDPR

Leaflet is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

Legal basis
Consent under Article 6(1)(a) GDPR when tiles load from a third party server, or no separate basis for fully self hosted tiles
Risk level
low
Applicable regulations
GDPR, ePrivacy Directive

Impact assessment (DPIA)

Leaflet on its own rarely triggers a DPIA. The need depends on the tile provider and on whether you add location tracking, so assess the provider, any United States transfer and the scale of location data you process.

Sample text for your banner

This page uses Leaflet to show a map. Map tiles are loaded from our tile provider, which receives your IP address. The map loads only after you accept.
Cookies and trackers

What Leaflet sets and contacts

Tracking method
Client side JavaScript library that loads map tiles from a configured tile provider
Server location
Depends on the tile provider; the Leaflet library can be self hosted or served from a CDN
Cookieless mode available
Yes

Third-party domains contacted (3)

  • tile.openstreetmap.org
  • unpkg.com
  • cdnjs.cloudflare.com
Questions

Frequently asked questions about Leaflet

Can't find your question? Write to us, we answer fast.

Does Leaflet set cookies?

No, the Leaflet library does not set cookies or store identifiers on the device. Any privacy impact comes from the tile provider you configure, not from Leaflet itself.

Do I need consent to use Leaflet?

If your tiles come from a third party server, particularly one outside the EU, you should obtain consent before the map loads because the request reveals the visitor IP address. With fully self hosted tiles, no separate consent is required.

What is the legal basis for a Leaflet map?

For third party tiles you can rely on consent under Article 6(1)(a) of the GDPR or a documented legitimate interest under Article 6(1)(f). Self hosted tiles need no special basis because no third party is involved.

Does Leaflet transfer data to the United States?

Not by itself. A US transfer only happens if you choose a United States tile provider, in which case you need the EU US Data Privacy Framework or Standard Contractual Clauses.

Do I need a DPIA for Leaflet?

A standard map rarely requires a DPIA. Consider one if you combine Leaflet with continuous location tracking or large scale profiling, and assess the tile provider and any transfer.

How do I implement Leaflet compliantly?

Prefer European or self hosted tiles, host the Leaflet library yourself rather than from a logging CDN, gate the map behind consent when a third country provider is used and document everything in your privacy notice.

Are there alternatives to Leaflet?

Leaflet is already one of the most privacy friendly choices. You can pair it with MapLibre GL, self hosted OpenStreetMap tiles or a European tile service to keep all data in the EU.

How do I update my cookie policy for Leaflet?

Strictly speaking Leaflet sets no cookies, so focus your policy on the tile provider: name it, explain that map requests share the visitor IP and disclose any transfer outside the EU. Update it if you change tile providers.

Same category

More services: Personalization

See the whole category

WiQhit

Wiqhit is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Wiqhit enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Wiqhit empowers marketing teams to achieve measurable growth.

Preferences

Hansel

Hansel is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Hansel supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Hansel ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Personalization

SiteSpect

SiteSpect is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. SiteSpect offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, SiteSpect empowers organizations to optimize strategy and maximize return on investment.

Analytics

Klangoo

Klangoo is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Klangoo provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Klangoo helps deliver the right message to the right audience at the right time.

Marketing

Peerius

Peerius is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Peerius enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Peerius empowers marketing teams to achieve measurable growth.

Preferences

Depict

Depict is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. Depict integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, Depict makes advanced AI accessible to all teams.

Preferences

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site