Privacy policy clauses for MapBox
MapBox is a mapping and location services platform that enables custom interactive maps and location-based features in web and mobile applications. Websites use MapBox to display maps, enable location searches, and provide geographic navigation functionality to users.
Free scan · No signup · Results in 60 seconds
What data MapBox collects
Your privacy policy must disclose each of the following data types when you use MapBox.
When does MapBox trigger privacy obligations?
Installation triggers immediate data flows
The moment you embed MapBox into your app or website, location data and map interaction telemetry begin flowing to Mapbox Inc, a US-based processor. This is not lazy-loaded or opt-in by default—the SDK transmits data on map render, user pan/zoom, and geocoding queries.
Which regulations activate
GDPR (EU/EEA users): If your app has any EU traffic, MapBox's collection of location data and interaction telemetry constitutes processing of personal data (GDPR Article 4). Location data is often special category data under Article 9 if it reveals user movement patterns. You must establish a lawful basis (Article 6)—consent or legitimate interest—*before* the SDK fires. You also need a Data Processing Agreement (DPA) with Mapbox Inc under Article 28.
CCPA (California users): Location data and interaction logs qualify as "personal information" under CCPA Section 1798.100. You must disclose MapBox's collection in your privacy notice and honor user opt-out rights (CCPA Section 1798.120).
