Store locators and GDPR

When you embed a store locator on your website, you load content from another server: the map itself, map tiles, sometimes fonts and scripts. To your visitors it looks like part of your page. Technically, though, their browser connects to someone else's server – and personal data is transferred in the process.

Why a map transfers personal data

To deliver content, a server needs to know where to send it. So with every request it receives the visitor's IP address, usually along with browser type, operating system, language and the address of the page the map is embedded on.

According to the case law of the Court of Justice of the European Union, IP addresses are in many cases personal data. Sending them to a third party is therefore processing under the GDPR and needs a legal basis.

A well-known German ruling on a related topic shows how seriously courts take this: on 20 January 2022 the Munich Regional Court I (Landgericht München I, case 3 O 17493/20) held that passing a visitor's IP address to Google through dynamically loaded Google Fonts without consent was unlawful, and awarded the claimant damages. That case was about fonts, not maps. The underlying issue – the IP address goes to a third party on page load – is the same.

Which rules apply

In Germany, two sets of rules work together:

GDPR, Art. 6: every processing of personal data needs a legal basis. For embedded maps, the main options are consent (Art. 6(1)(a)) and legitimate interests (Art. 6(1)(f)). Opinions differ on whether legitimate interests are enough to load a map automatically. German data protection authorities tend to take a critical view of embedding third-party content without consent, especially when data goes to third countries or the provider uses it for its own purposes.

TDDDG, Section 25: the German Telecommunications Digital Services Data Protection Act – called TTDSG until May 2024 – governs access to the user's device, such as setting cookies or reading information stored in the browser. This generally requires consent unless the access is strictly necessary to provide a service the user has explicitly requested. If a map service sets cookies or uses local storage, Section 25 TDDDG has to be considered as well.

In practice, many companies take the safe route: the map only loads once the visitor agrees.

Google Maps or OpenStreetMap?

For the assessment, what matters is who receives the data and what they do with it.

• Google Maps: data may go to Google and thus to the USA. Since July 2023 there has been an EU adequacy decision for US companies certified under the EU-U.S. Data Privacy Framework. That does not answer the question of a legal basis for loading the map on your website, though.
• OpenStreetMap: the map data is open. The map tiles come from a tile server – this may be the OpenStreetMap Foundation's server or another provider. The IP address is transferred here too. Ask your store locator provider which tile server is used.

My Store Locator currently uses OpenStreetMap via Leaflet. Google Maps support is coming soon.

The two-click solution

The two-click solution is the most common way to embed maps in a privacy-friendly way:

1. Instead of the map, visitors first see a placeholder with a short notice: which service will be loaded and that data such as their IP address will be transferred.
2. Only when they click "Load map" is the connection to the map service established.

Until that click, no data flows to the map service. The click is a deliberate, informed action by the visitor.

In My Store Locator you switch this on in the embed settings with the option "Load the map only after a click (GDPR)". Consent mode works with both the iframe code and the JavaScript widget.

If you use a consent management platform, you can list the store locator there as a service instead. In that case make sure the map really loads only after consent – check this in your browser's developer tools (Network tab).

What belongs in your privacy policy

Your privacy policy should describe the store locator. Typical points:

• name and address of the store locator provider
• what data is transferred on load (IP address, browser information, page visited)
• purpose: showing your locations on a map
• legal basis (for example consent under Art. 6(1)(a) GDPR with the two-click solution)
• the tile or map service that also receives data
• whether data goes to a third country, and on what basis
• if you use the map's contact form: what it collects and what happens to the data

Generator templates are a good start but rarely fit exactly. Compare the text with how you actually embed the map.

Data processing agreement (DPA)

If a service provider processes personal data on your behalf, you need a data processing agreement under Art. 28 GDPR. For a store locator this covers, for example, enquiries visitors send through the contact form on the map, and your team's user accounts.

In My Store Locator you download the DPA in the app under "Plan & billing". More on the DPA page.

Hosting location

Where data is stored affects which additional rules apply. With providers based or hosting outside the EU, transfers to third countries need a basis under Chapter V GDPR, such as an adequacy decision or standard contractual clauses. Hosting in Germany makes this considerably simpler. My Store Locator is hosted in Germany.

Statistics without cookies

Many companies want to know how often their store locator is used. Classic analytics tools set cookies for this and usually need consent.

There is another way: My Store Locator counts map views, searches and clicks on phone numbers, directions and websites as aggregated daily totals. No cookies are set and no IP addresses are stored in the statistics. Individual visitors cannot be tracked from this data.

Checklist

• Find out which servers are contacted when the store locator loads (check the browser's Network tab)
• Decide on the legal basis and document it
• Set up the two-click solution or a consent tool
• Verify that no connection to the map service is made before the click or consent
• Add the store locator and the map service to your privacy policy
• Conclude the DPA with the provider and file it
• Check the hosting location and any third-country transfers
• Map contact form: keep required fields to a minimum, link to your privacy policy
• Update your record of processing activities
• Have your implementation reviewed by your data protection advisor

FAQ