Embedding Google Maps in a data-protection-compliant way

An iframe from google.com/maps or the Maps JavaScript loads resources from Google (USA) when the page opens and can set identifiers.

When embedding Google Maps there are two technically different routes with the same data protection problem: the simple iframe (google.com/maps/embed) and the Maps JavaScript API with its own API key. Both load resources from Google servers in the USA on page view, transmitting the IP address, and can set identifiers. An interactive map is rarely strictly necessary for the basic function of the page — so § 25 (1) TDDDG applies.

The clean standard solution is the two-click embed: until the click, only a local preview image or a schematic graphic of the address is shown, and only afterwards does the real map load. There are ready-made blocks for WordPress, TYPO3 and the common site builders; it is important that the preview image is local and does not itself call Google's Static Maps API.

Anyone who does not need the interactivity is often better off with an alternative: a simple "Plan route" link (opens Google Maps or Apple Maps in a new tab), a static, self-generated map graphic or an OpenStreetMap embed via a data-minimising provider such as the uMap or MapLibre solution. These variants transmit no data to Google on page view.

Is this a risk?

The map request is usually not strictly necessary for the basic function of the site, so § 25 (1) TDDDG applies. Without consent or a two-click solution there is no basis; the US transfer must also be justified.

What you can do

• Two-click solution: static preview, the map loads only after a click.
• Alternatively use a data-minimising map (e.g. OpenStreetMap).
• With an active embed: obtain consent, name Google as recipient.

Häufige Fragen

Is the "enhanced privacy mode" enough for Google Maps?

Unlike YouTube, there is no official privacy mode for Google Maps. The embed always transmits data to Google on page view — only a two-click solution or an alternative avoids that.

Is a two-click solution really necessary?

It is the simplest way to do without consent. Alternatively, the map can be included in a consent tool and loaded only after agreement — but then the page needs a banner anyway.

What about the Maps JavaScript API and the API key?

The API key changes nothing about the data protection situation: the API still loads from Google servers in the USA. The key only serves billing and quota.

Which alternative is the most data-minimising?

A plain link to the map application or a locally stored static graphic. Both trigger no connection to Google on page view.

How consentglass helps

The free scan checks the delivered HTML and shows which services are embedded, whether a cookie banner is detected and whether privacy-policy and legal-notice links are present — with context for each finding. It is not a substitute for legal advice.