Leaflet

Overview

Leaflet is an open-source JavaScript mapping library maintained by Volodymyr Agafonkin and a community of contributors under the BSD 2-Clause license. It renders interactive maps in the browser using tile layers sourced from configurable tile servers. The library itself contains no tracking code, no telemetry, and no network requests to Leaflet-controlled servers — all network activity is determined by which tile provider the operator configures (such as OpenStreetMap, Mapbox, or a self-hosted tile server).

What This Script Does

Leaflet's own code is a pure rendering library with no data collection behavior:

• No cookies set: Leaflet itself does not set any cookies. It does not read browser storage for tracking purposes.
• No tracking requests: The library makes no requests to Leaflet.js servers. There are no analytics, telemetry, or usage reporting calls embedded in the library.
• Tile requests: When a map loads, the browser fetches map tile images from whichever tile provider the operator has configured. These requests expose the visitor's IP address to the tile server operator. For OpenStreetMap tiles, this means IP addresses are visible to the OSMF infrastructure. For Mapbox tiles (api.mapbox.com), Mapbox's privacy policy applies.
• User interactions: Panning, zooming, and clicking are processed entirely client-side. Coordinates are not transmitted anywhere unless the operator has added a custom interaction handler that sends data to their own or a third-party server.
• GeoJSON loading: If the operator loads overlay data from a third-party URL, the visitor's IP address is exposed to that third-party server, but this is a configuration choice, not Leaflet behavior.

The privacy footprint of a Leaflet integration is determined almost entirely by tile provider choice, not by the library itself.

Consent & Compliance

GDPR and ePrivacy: Leaflet's own code requires no consent. However, if the operator uses a third-party tile provider that processes visitor IP addresses (such as Mapbox, Google, or HERE Maps), those providers become data processors and their data handling must be addressed in the operator's privacy notices. Tile requests to Mapbox or commercial providers are network requests that expose personal data (IP address) to a third party, which under strict GDPR interpretation may require a legitimate interest assessment or consent.

CCPA/CPRA: Leaflet itself does not collect or share personal information. Tile provider integrations may involve disclosure of IP addresses to third-party services, which operators should disclose in their privacy policies.

This vendor falls in the functional category. It is a rendering utility with no tracking behavior. The consent question applies to the tile provider, not the library.

Should You Block This Without Consent?

No.

Leaflet itself does not require consent blocking — it contains no tracking code, sets no cookies, and makes no requests to Leaflet-controlled servers. Operators using third-party tile providers (particularly commercial ones like Mapbox) should consider whether tile provider requests require disclosure or consent under their applicable privacy framework, but the Leaflet library itself is safe to load without consent gating.