Embedded Maps Load Before the Choice: The Consent Leak in Every Footer

A Google Maps embed is an iframe, and an iframe loads when the page loads. The moment the page renders, the browser requests the map from Google, and Google's cookies, including NID, are set or read before the visitor has seen the banner, let alone answered it. The map sits below the fold, in the footer, where nobody thinks of it as tracking, and it tracks from the first byte.

Article 5(3) of the ePrivacy Directive requires prior consent for storing or accessing information on a visitor's device, unless the storage is strictly necessary for a service the visitor explicitly requested. A map in the footer is not a service the visitor requested. It is a decoration that phones home, and the consent banner is irrelevant if the map already fired.

The footer map phones home on load

The Maps iframe sets Google cookies and sends the visitor's IP address to Google on load, with no click and no choice. The cookies are not the only problem: the request itself tells Google that this visitor loaded this page at this time, which is tracking by any honest definition. A consent banner that appears after the map has loaded is a banner that arrived too late.

The same leak applies to every third-party embed that loads on page render: videos, social feeds, chat widgets, calendars. The map is the most common because every local business site has one, and it is the least audited because it sits in the footer. Audit the footer first, because that is where the leak hides.

What actually fires

The fix is a click-to-load facade: a static image of the map, or a screenshot, with a button that says load the map. The real iframe loads only after the visitor clicks, and the click is the consent moment. The map still works, the visitor still gets directions, and the cookies stop firing before consent. The same pattern works for videos, social feeds, and any embed that loads third-party cookies.

Wire the facade to the consent categories, not just to the click. If the visitor already accepted marketing cookies, the facade can load the map immediately. If they rejected them, the facade stays, and the map never loads. The click is the fallback for the visitor who has not decided yet. Either way, nothing fires before the choice.

The facade pattern

Open the page with cookies cleared and the network tab open, and watch for requests to google.com before you touch the banner. If they appear, the leak is live. Then accept marketing cookies, reload, and watch the map load. Then reject them, reload, and confirm the map stays a facade. Three loads, three answers, and the test takes two minutes.

Keep reading: After Withdrawal, When May the Banner Ask Again?, Consent Opt-In Rates: What a Good Number Looks Like, and What It Hides.

Test it with the network tab open

Check the mobile page separately, because footers behave differently on small screens, and a map that is below the fold on desktop may load above it on mobile. The leak does not care about the fold. It cares about the load, and the load happens either way.

Frequently asked questions

Does a Google Maps embed set cookies before consent?

Yes. The iframe loads Google cookies, including NID, on page load, before the visitor answers the banner.

What is a click-to-load facade?

A static image that replaces the embed until the visitor clicks. The real service loads only after that click, which is the consent moment.

Is a map embed covered by the ePrivacy Directive?

Yes. Article 5(3) requires prior consent for storing or accessing information on a visitor's device, unless it is strictly necessary.

Can I keep the map and still be compliant?

Yes, with a facade: load the live map only after the visitor accepts the relevant category, or clicks to load it.