Replacing Google Maps: privacy-compliant map alternatives

An embedded Google Map may transmit data to Google as soon as a page loads. Whether prior consent is needed depends in part on the specific access to terminal equipment and its necessity. The GDPR legal basis and any international transfer must be assessed separately.

The core of the problem is that every standard integration of Google Maps — whether via iframe, JavaScript API or the “embed a map” code — establishes a connection to Google servers when the page loads. In the process the IP address and browser characteristics are transmitted, and depending on the integration cookies or local storage entries may be set. For most websites an interactive map is not “strictly necessary” within the meaning of the TDDDG, so prior consent would be needed.

The simplest solution is often to drop the interactivity entirely. Anyone who only wants to show a location can get by with a static image (screenshot of the map, stored locally) and a link “Open in Google Maps” or “Get directions”. The link only transmits data on click — and then to a service the user actively opens. A locally stored map image avoids fetching the image externally. Usage rights, required attribution and an accessible description still need checking; the image is not automatically a lawful solution.

Anyone who needs real interactivity will find a data-frugal alternative in OpenStreetMap-based solutions. Libraries such as Leaflet or MapLibre GL render the map in the browser; the map tiles come from a tile server. The choice of this server is decisive: there are providers with servers in the EU and without tracking. A self-hosted tile server is the most privacy-friendly but most demanding option. In any case, the network tab should be checked to see where the tile requests actually go.

Is this a risk?

Even the “restricted” Google Maps embed via the Embed API loads resources from google.com on page load. Anyone who wants to show maps without consent has to switch to a two-click solution, a static map image or a data-frugal map service with EU hosting.

What you can do

• For a plain address display: a self-created static map image plus a text link “Get directions” (opens the user's map app).
• For interactive maps without a US transfer: OpenStreetMap via a data-frugal provider (e.g. MapLibre GL with an EU tile server, uMap or a self-hosted Leaflet setup).
• If Google Maps has to stay: two-click embedding — only a local preview until the click, and only then the real map loads.
• Name the chosen map service in the privacy policy (provider, purpose, legal basis, any third-country transfer).

Häufige Fragen

Is Google's “map in safe mode” GDPR-compliant?

An embedded Google Map may transmit data to Google as soon as a page loads. Whether prior consent is needed depends in part on the specific access to terminal equipment and its necessity. The GDPR legal basis and any international transfer must be assessed separately.

Is a static map image enough?

A locally stored map image avoids fetching the image externally. Usage rights, required attribution and an accessible description still need checking; the image is not automatically a lawful solution.

Does OpenStreetMap transmit data to the USA?

That depends on the tile server. The official OSM tile servers are in Europe; commercial OSM providers and CDNs may be located elsewhere. Before use, the specific tile host should be checked in the network tab.

Do I still have to put an OSM map in the privacy policy?

Yes. Even if there is no third-country transfer, IP addresses are transmitted to the tile server operator when the tiles load. Provider, purpose and legal basis belong in the policy.

How consentglass helps

The free scan checks the delivered HTML and shows which services are embedded, whether a cookie banner is detected and whether privacy-policy and legal-notice links are present — with context for each finding. It is not a substitute for legal advice.