Configuration Guide

OpenStreetMap is a free, open-source mapping project operated by the OpenStreetMap Foundation (OSMF), a non-profit organisation incorporated in the United Kingdom. When an OSM map is embedded on a website — whether via a simple iframe or via a JavaScript mapping library such as Leaflet.js loading map tiles from OSMF's tile servers — the visitor's browser establishes a direct connection to OSMF infrastructure at page load. OSM does not set tracking cookies in the traditional sense; however, the visitor's IP address, device type, browser information, and tile request details are transmitted to OSMF servers and logged as part of standard network access records. Unlike Google Maps, no persistent cross-session user identifier is assigned and no advertising or profiling data is collected.

There are no privacy-relevant configuration options at the OSM embed level that would materially alter this data processing profile. The only alternative — self-hosting a tile server proxy — is an infrastructure measure rather than an embed-level configuration and falls outside the scope of this guide. Map tiles are delivered via the Fastly content delivery network; Fastly, Inc. is a US-based company and is therefore subject to the CLOUD Act. OSMF itself explicitly states that no Data Controller–Data Processor relationship exists between website operators and the OSMF: the OSMF operates as an Independent Controller in its own right, and no Data Processing Agreement is available.

---

Summary Overview

---

Step 1 — OpenStreetMap Embed Configuration

Configuration — Standard

Embedding an OSM map causes the visitor's browser to send tile requests directly to OSMF's infrastructure, which is distributed across servers in the United Kingdom, Ireland, and the Netherlands. These requests include the visitor's IP address, browser and device type, operating system, and the specific tiles requested. According to the OSMF's own Services and Tile Users Privacy FAQ, the OSMF operates as an Independent Data Controller and does not process personal data on the website operator's behalf; no DPA can be concluded. Unlike Google Maps, no tracking cookies or persistent cross-session identifiers are assigned, and no data is used for advertising or profiling purposes.

Map tiles are delivered via the Fastly global CDN. Fastly, Inc. is a US-based company and the involvement of its infrastructure means that tile request data — including IP addresses — may transit servers subject to US jurisdiction and potential access by US government authorities under the CLOUD Act. OSMF's own privacy policy notes that tile cache servers are globally distributed and that the specific server handling a given request is determined by Fastly's routing logic at the time of the request. The UK, where OSMF is incorporated and where its primary servers are located, benefits from a GDPR adequacy decision, meaning transfers to the UK are treated as equivalent to EU-internal processing under current EU law.

---

Step 2 — Mapping in the Customer Panel

2.1 Configuration — Standard

Note: The OpenStreetMap Foundation operates exclusively as an Independent Controller. No Data Processing Agreement is available and no controller–processor relationship can be established. The OSMF explicitly states this in its Services and Tile Users Privacy FAQ. The legal basis for embedding OSM on a public website is therefore consent, as the website operator cannot contractually control how OSMF processes the transmitted data. Website operators should disclose the use of OSM and the resulting data transfer to the UK and US (via Fastly) in their privacy policy.

---

Step 3 — Contextual Consent Integration

Because the OSM embed connects to OSMF and Fastly servers at page load, the map element must be masked until the visitor has actively given consent. Contextual consent must be implemented in accordance with the Consenter Contextual Consent Integration Guide.