Google Maps

Overview

Google Maps is the dominant web mapping service used by websites to embed interactive maps, provide location search, display store locators, and integrate geocoding or routing functionality through the Maps JavaScript API.

What This Script Does

The Google Maps JavaScript API loads from maps.googleapis.com and renders interactive map tiles, markers, and overlays within designated page elements. Depending on the implementation, it may use the following APIs:

• Maps JavaScript API: Renders map tiles, handles zoom/pan interactions, displays markers and info windows.
• Places API: Provides address autocomplete, place details, and business information.
• Geocoding API: Converts addresses to coordinates and vice versa.
• Directions API: Calculates routes and travel times.

Cookies: Google Maps may set cookies including NID (google.com, 6-month expiry) used to store preferences and CONSENT cookies. When a visitor interacts with the map, session cookies manage map state. If the visitor is signed into a Google account, additional account-related cookies may be present.

Data transmitted: Each map tile request transmits the visitor's IP address, viewport coordinates, zoom level, and User-Agent. If Places or Geocoding APIs are used, search queries and coordinates are sent to Google's servers. The Maps API requires an API key that identifies your Google Cloud project.

JavaScript execution: The Maps API loads and executes substantial JavaScript. It accesses the DOM to render map elements and may use geolocation APIs (with browser permission) if location-based features are enabled.

Consent & Compliance

Google Maps falls under the functional consent category. It provides user-requested functionality (viewing a map, finding directions, searching for locations) rather than analytics or advertising.

Under GDPR, the primary concerns are:

• IP address transmission to Google (a US-based processor), addressed by the EU-US Data Privacy Framework.
• Cookies set by the Maps embed. The NID cookie stores preferences and is not strictly necessary.
• If geolocation is used, explicit browser-level permission is required in addition to consent.

Under ePrivacy, cookies set by the map embed for preference storage may require consent, even though the map itself serves a functional purpose.

Under CCPA, the data transmitted to Google through Maps does not typically constitute "sale" or "sharing" for advertising, but is subject to standard personal information protections.

Should You Block This Without Consent?

Conditional. Google Maps serves a functional purpose but sets cookies and transmits data to Google. The approach depends on your compliance posture:

• Conservative: Block the live Google Maps embed until functional consent is obtained. Show a static map image or placeholder with a click-to-load interaction.
• Moderate: Load Google Maps under legitimate interest for functional purposes, noting that it sets some non-essential cookies.
• If using geolocation features: Always require explicit consent, as geolocation involves sensitive data.

Many consent management platforms treat Google Maps as functional and load it without marketing consent, while providing a fallback image for strict-consent scenarios.