Replacing Google Maps: privacy-compliant map alternatives

An embedded Google Map loads scripts and fonts from Google servers in the USA on page load and transmits the IP address in the process. Without consent this is not permitted under Section 25(1) TDDDG. There are several ways to do entirely without this call.

The core of the problem is that every standard integration of Google Maps — whether via iframe, JavaScript API or the “embed a map” code — establishes a connection to Google servers when the page loads. In the process the IP address and browser characteristics are transmitted, and depending on the integration cookies or local storage entries may be set. For most websites an interactive map is not “strictly necessary” within the meaning of the TDDDG, so prior consent would be needed.

The simplest solution is often to drop the interactivity entirely. Anyone who only wants to show a location can get by with a static image (screenshot of the map, stored locally) and a link “Open in Google Maps” or “Get directions”. The link only transmits data on click — and then to a service the user actively opens. This variant is low-barrier, fast and legally unproblematic.

Anyone who needs real interactivity will find a data-frugal alternative in OpenStreetMap-based solutions. Libraries such as Leaflet or MapLibre GL render the map in the browser; the map tiles come from a tile server. The choice of this server is decisive: there are providers with servers in the EU and without tracking. A self-hosted tile server is the most privacy-friendly but most demanding option. In any case, the network tab should be checked to see where the tile requests actually go.

Is this a risk?

Even the “restricted” Google Maps embed via the Embed API loads resources from google.com on page load. Anyone who wants to show maps without consent has to switch to a two-click solution, a static map image or a data-frugal map service with EU hosting.

What you can do

• For a plain address display: a self-created static map image plus a text link “Get directions” (opens the user's map app).
• For interactive maps without a US transfer: OpenStreetMap via a data-frugal provider (e.g. MapLibre GL with an EU tile server, uMap or a self-hosted Leaflet setup).
• If Google Maps has to stay: two-click embedding — only a local preview until the click, and only then the real map loads.
• Name the chosen map service in the privacy policy (provider, purpose, legal basis, any third-country transfer).

Häufige Fragen

Is Google's “map in safe mode” GDPR-compliant?

No. Unlike YouTube, there is no genuine privacy-friendly mode for Google Maps. Every Google Maps integration transmits data to Google on page load.

Is a static map image enough?

For a plain location display, yes. A locally stored image plus a link to the map app is the simplest consent-free solution. Important: the image must not itself be loaded from Google's Static Maps API.

Does OpenStreetMap transmit data to the USA?

That depends on the tile server. The official OSM tile servers are in Europe; commercial OSM providers and CDNs may be located elsewhere. Before use, the specific tile host should be checked in the network tab.

Do I still have to put an OSM map in the privacy policy?

Yes. Even if there is no third-country transfer, IP addresses are transmitted to the tile server operator when the tiles load. Provider, purpose and legal basis belong in the policy.

How consentglass helps

The free scan checks the delivered HTML and shows which services are embedded, whether a cookie banner is detected and whether privacy-policy and legal-notice links are present — with context for each finding. It is not a substitute for legal advice.