When teams evaluate a mapping API for GDPR, they are usually asking three concrete questions: does the provider track my end users, what does it log, and where are requests processed. Stadia Maps documents its answers to all three. Per the EU endpoints documentation, Stadia Maps is "confident that our privacy practices and procedures satisfy GDPR requirements by default," and offers EU-only endpoints for teams that need a guarantee that requests never leave the European Union.

This page covers what Stadia Maps does. It is not legal advice, and it does not assess whether any particular application is compliant.

Key Takeaways

  • Stadia Maps does not track end users, build behavioral profiles, resell data, or use data for ad targeting.
  • Map tiles and API calls are cookie-less, stateless, and anonymous by default. There are no third-party cookies or tracking pixels on any service.
  • EU-only endpoints route all requests to servers in Frankfurt and Paris, and PII is scrubbed at the network edge.
  • Switching to EU endpoints is a hostname change: tiles-eu.stadiamaps.com and api-eu.stadiamaps.com.
  • Stadia Maps publishes a Data Processing Addendum and a Privacy Policy covering what is collected and why.

What Does a Mapping API Actually Collect?

The privacy question that matters for most teams is not what the provider promises, but what the integration technically does. Some location SDKs generate telemetry from user actions regardless of what your own application logs.

Per the Stadia Maps privacy commitment, the platform is built so that:

  • There are no client-side scripts that phone home
  • There are no third-party cookies or tracking pixels on any service
  • There are no user-identifying headers or geolocation sniffing
  • Map tiles and API calls are cookie-less, stateless, and anonymous by default
  • Geocoding and search are query-based, not session-based
  • Routing and navigation does not store location history
  • Maps do not log identifying info

What Stadia Maps does collect is limited to operating and securing the infrastructure, preventing abuse and fraud, and debugging service issues. Per the privacy commitment page, Stadia Maps "never collect s or store s location data tied to individual users." The Privacy Policy covers the specifics.

What Are EU-Only Endpoints?

Some teams need more than a policy commitment. They need a guarantee that network requests are handled inside a specific jurisdiction, either because of internal policy, a customer contract, or a regulator.

Stadia Maps offers EU-only endpoints for exactly that case. Per the documentation:

  • Requests connect exclusively to two servers positioned in the European Union: Frankfurt, Germany and Paris, France.
  • Stadia Maps systems scrub PII at the network's edge, so any request that must ultimately be handled by internal services in other regions is managed privately.

This is offered as an option rather than a default, because the standard endpoints already operate under the same privacy practices. EU endpoints exist for teams that need the jurisdictional guarantee on top.

How Do You Use the EU Endpoints?

Switching is a hostname change. No code restructuring, no separate account.

For map tiles and styles, replace tiles.stadiamaps.com with tiles-eu.stadiamaps.com:

https://tiles-eu.stadiamaps.com/styles/alidade_smooth.json

For routing, geocoding, time zone, and other API services, replace api.stadiamaps.com with api-eu.stadiamaps.com:

https://api-eu.stadiamaps.com/geocoding/v2/search?text=Union+Square

Every official Stadia Maps SDK accepts a base path or host override, so the change is typically one line. Full examples for TypeScript, Python, Kotlin, Swift, PHP, and cURL are in the EU endpoints documentation.

What About Self-Hosting?

For teams whose requirements go beyond endpoint jurisdiction, Stadia Maps offers On-Prem and Embedded Solutions. Running tiles and APIs inside your own infrastructure means location requests never reach a third party at all.

That is a heavier lift than switching a hostname, but it is the option that exists when a compliance requirement cannot be satisfied by a vendor commitment.

What Documentation Is Available for Compliance Review?

Procurement and legal teams generally ask for artifacts rather than marketing claims. Stadia Maps publishes:

For requirements not covered by the standard documents, Stadia Maps works directly with teams on tailored arrangements. The support page has contact options.

Where This Page Stops

Worth being direct about the limits of what a vendor page can tell you.

  • This is not legal advice. Whether your application is GDPR-compliant depends on what data you collect, your lawful basis, your own retention practices, and factors that have nothing to do with your mapping provider.
  • A compliant provider does not make your application compliant. The mapping API is one processor in your stack. Your own data handling is the larger question.
  • Requirements vary by use case and jurisdiction. A consumer app, a healthcare platform, and a government contractor face different obligations from the same regulation.
  • Verify rather than take a vendor's word. Read the DPA and the Privacy Policy. If a specific control matters to you, ask about it directly before you build.

For anything beyond what is documented, talk to counsel who knows your use case.

Common Compliance-Driven Use Cases

Teams that end up on EU endpoints or self-hosted deployments usually have a specific driver.

  • EU-based products with internal policy or customer contracts requiring data residency.
  • Healthcare and health-adjacent apps where location can be combined with other fields to become sensitive.
  • Financial services operating under sector rules on top of general privacy regulation.
  • Government and public sector with procurement requirements around data handling and jurisdiction.
  • Enterprise B2B software where the customer's own compliance review extends to subprocessors.
  • Consumer apps positioning on privacy where tracking by a vendor would undercut the product's own promise.

Frequently Asked Questions

Does Stadia Maps track end users?

No. Per the Stadia Maps privacy commitment, there is no user tracking, no behavioral profiling, and no data reselling or ad targeting. Map tiles and API calls are cookie-less, stateless, and anonymous by default, with no client-side scripts that phone home and no third-party cookies or tracking pixels on any service.

What are Stadia Maps EU endpoints?

EU endpoints are alternate hostnames that route all requests to servers located in the European Union, specifically Frankfurt, Germany and Paris, France. Stadia Maps systems scrub PII at the network edge, so any request ultimately handled by internal services in other regions is managed privately. Use tiles-eu.stadiamaps.com for map tiles and api-eu.stadiamaps.com for API services.

How do I switch to Stadia Maps EU endpoints?

Replace tiles.stadiamaps.com with tiles-eu.stadiamaps.com for map tiles and styles, and api.stadiamaps.com with api-eu.stadiamaps.com for routing, geocoding, time zone, and other API services. Every official Stadia Maps SDK accepts a base path or host override, so the change is typically one line of configuration.

What data does Stadia Maps collect?

Stadia Maps collects only the minimal data necessary to operate and secure its infrastructure, prevent abuse and fraud, and debug service issues. Per the privacy commitment page, Stadia Maps never collects or stores location data tied to individual users. Full details are in the Privacy Policy.

Does Stadia Maps offer a Data Processing Addendum?

Yes. Stadia Maps publishes a Data Processing Addendum alongside its Privacy Policy and Terms of Service. For requirements not covered by the standard documents, Stadia Maps works directly with teams on tailored arrangements.

Can I self-host Stadia Maps for compliance reasons?

Yes. Stadia Maps offers On-Prem and Embedded Solutions for teams whose requirements go beyond endpoint jurisdiction. Running tiles and APIs inside your own infrastructure means location requests never reach a third party.

Where to Go Next

From the Blog

More on privacy and location data from the Stadia Maps blog:

Privacy and Compliance