The Store Locator That Pings Google Before Consent: Maps Are Trackers Too
A visitor opens the contact page to find the nearest store. The page loads a map. The map sends the visitor IP address to Google, sets cookies, and starts tracking the visit, all before the visitor has consented to anything. The banner never saw it happen, because the map is not a cookie. It is an embed, and embeds do not wait for banners.
Maps are trackers with a useful interface, the same way chat widgets are trackers with a friendly bubble. A Google Maps embed loads scripts from Google domains, sends the visitor IP address, and sets cookies. The visitor did not ask for a map to track them. They asked where the store is. The site answered with a tracking call.
The YouTube lesson applies to maps
The video embed problem is well understood by now. A standard YouTube embed loads tracking cookies from google.com and youtube.com before any viewer interaction, and the privacy-enhanced embed, youtube-nocookie.com, still transmits the visitor IP address to Google on load, because the browser has to establish a connection to fetch the player. The FlowConsent guide on YouTube nocookie makes the point plainly: the privacy claim applies strictly to the moment before interaction, and as soon as the visitor clicks play, Google sets the same cookie family as the regular embed. The Ignite guide adds that a click on play does not constitute consent, and that the video must only load after explicit consent, through a banner or a two-click solution.
Maps work the same way. The embed loads on page load, the IP address goes to Google on the first request, and the cookies follow on interaction. There is no nocookie version of Google Maps that changes this. The French CNIL, the German data protection conference, and the Spanish AEPD generally consider that any embed referencing Google requires prior consent, because of the IP transfer and the high probability of interaction. A store locator is not exempt because it is useful. The map is a Google service, and Google services track.
The facade that actually works
The fix is the two-click solution, the same pattern that works for video. The page shows a static image of the map, or a simple list of addresses, with a clear notice that the map is delivered by Google and a button that says show map. The real embed loads only after the visitor clicks. The visitor who wants the map gets it. The visitor who does not click never sends their IP address to Google. The consent platform records the choice the same way it records any other.
The lazy version of this is a facade that loads the map anyway after a delay, or a placeholder that still pings Google for a thumbnail. That is not a facade. It is a delay. The test is simple: load the page with the network tab open and reject everything first. If any request goes to a Google domain before the visitor clicks show map, the facade is leaking, and the page is tracking before consent.
What to check on your own site
List every embed on the site, not just videos. Maps, social feeds, review widgets, booking calendars, and payment forms all load third-party scripts, and each one is a consent decision the team probably never made. Check each one the same way: fresh browser, reject everything, network tab open, and look for requests to third-party domains before any interaction.
Then fix the worst one first, which is usually the map on the contact page, because it sits on a page every visitor touches and it loads on every visit. Replace it with a static image and a list of addresses, with a show map button that loads the real embed on click. The visitor experience barely changes. The tracking stops. And the consent record finally covers the whole page, not just the parts the banner could see.
Keep reading: the embedded video consent facade, first-party vs third-party cookies, and the route-change consent recheck cover the nearby cases in this series.
Frequently asked questions
Does a Google Maps embed need consent?
Yes, if it loads third-party scripts and sends the visitor IP address to Google before consent. Regulators including the CNIL and the German data protection conference generally consider that any embed referencing Google requires prior consent, because of the IP transfer.
Is there a privacy-enhanced version of Google Maps like youtube-nocookie?
No. YouTube has a nocookie embed mode, and even that still transmits the visitor IP address on load. Google Maps has no equivalent. The defensible pattern is a two-click solution: a static image and a show map button that loads the real embed only after the visitor clicks.
Does a click on play or show map count as consent?
No. A click on play does not constitute consent to tracking. Consent has to be explicit and informed, which means the visitor has to know what they are agreeing to before the embed loads, not after.
What other embeds should I check?
Every embed on the site: social feeds, review widgets, booking calendars, payment forms, and chat widgets. Each one loads third-party scripts, and each one is a consent decision the team probably never made. Check them all with a fresh browser and the network tab open.