Consent for Embedded Maps: The Script That Loads Before the Click

Put a Google Map on your contact page and the map does its work before the visitor does anything. The iframe loads, the scripts load, and Google sets its cookies and reads the visitor's IP address, all before the visitor has seen the banner, let alone clicked it. The consent check that happens after the map loads is not a check. It is a record of something that already happened, and the visitor's choice, whatever it turns out to be, cannot undo the data that left the browser when the page loaded.

The embed is the transfer

An embedded map is not a picture. It is a live connection to Google's servers, and the connection starts when the iframe loads. Google receives the visitor's IP address, the page URL, and the browser details, and it sets cookies that identify the visitor across sites. The EDPB's Guidelines 05/2020 are clear that consent has to come before the processing, and processing that starts on page load cannot be consented to after page load. The two-click solution is the standard fix: show a static image of the map, or a placeholder with a button, and load the real map only after the visitor clicks to accept. The click is the consent, and the map does not load until it happens.

The mistake is treating the map as content rather than as a third-party service. A contact page with an embedded map looks like a page with a picture on it, and the team that added it thought about the address, not the data flow. The data flow is the problem: the map is a Google service running inside your page, and the visitor's data goes to Google the moment the page renders. The same failure applies to any embed that phones home on load, and maps are the most common one, because every contact page has one and almost nobody configured it with consent in mind. The Complianz guide on Google Maps and GDPR makes the point directly: the map must be blocked until consent, and the block has to happen at the script level, not as a notice on top of a map that already loaded.

Block the script, not the map

The fix has to happen before the iframe exists in the DOM. A consent banner that appears over a map that already loaded is decoration. The CMP has to prevent the map script from loading until the visitor accepts the relevant purpose, and the placeholder has to say what will happen when they click: that the map will load and that Google will receive their data. A placeholder that says "click to load the map" without saying what loading it means is a consent request without information, and it fails the same informed-consent test as the untranslated banner. YouTube embeds have the same failure: the video that phones home before play, because the iframe loads its scripts on page load. Live chat widgets do it too: the script that loads before choice, and the choice that arrives after the data already left.

Test it with the network tab open

Clear your cookies, open the contact page with the network tab open, and watch what loads before you touch the banner. If you see requests to google.com or gstatic.com, the map loaded before consent, and the fix has not been applied. If you see only the placeholder, the block works. The test takes two minutes and it is the test a regulator runs with the same tools, because the network tab does not lie about what loaded and when. Run it after every change to the contact page, because the map gets re-added by the next person who edits the page, and the consent block does not survive a copy-paste.

Document which embeds are blocked and which purpose each one needs. The map needs the marketing or functional purpose your CMP defines for it, and the record should say so. A map blocked for the wrong purpose is a map blocked for no reason, and a map that loads without any purpose is a transfer without a basis.

Frequently asked questions

Why does an embedded map need consent before it loads?

Because the map is a live connection to Google's servers, not a picture. The iframe loads scripts, Google receives the visitor's IP address and page URL, and cookies are set, all on page load. Consent has to come before that processing, so the map must be blocked until the visitor accepts.

What is the two-click solution for maps?

Show a static image or a placeholder with a button, and load the real map only after the visitor clicks to accept. The click is the consent. The placeholder should say what loading the map means, that Google will receive the visitor's data, so the choice is informed.

Is a consent banner over a loaded map enough?

No. If the map already loaded, the data already left the browser, and the banner is decoration. The CMP has to prevent the map script from loading until consent, at the script level, before the iframe exists in the page.

How do I test whether my map loads before consent?

Clear your cookies, open the contact page with the browser's network tab open, and watch what loads before you touch the banner. Requests to google.com or gstatic.com mean the map loaded before consent. Only the placeholder should load until the visitor clicks.