• Badge: ⚠️ Caution
• Red Flags:
  • RF1 — Own advertising / cross-service profiling
  • RF2 — High-risk third-country exposure without meaningful mitigation
• Risk Indicators:
  • Own-purpose data use; intrusive tracking; high-risk international transfers

Key Facts: Embedding Google Maps transmits visitor IP, device data, and identifiers to Google US servers on every page load, before any user interaction. Google uses this data as part of its broader advertising and analytics ecosystem. Austrian DPA and German courts have held that Google Maps sets advertising cookies which cannot be justified as strictly necessary, meaning opt-in consent is required before the map loads. No purely EU-hosted alternative with equivalent functionality is offered.

Framework Note (v2.2): FRAMEWORK NOTE (v2.2): RF2 (high-risk third-country exposure) is recorded here as a significant risk factor and lowers the domain E score. Under the revised framework, RF2 alone does not trigger Caution — the Caution badge for this service is driven by RF1 / RF3 / RF4 (as noted above). The US transfer risk (where applicable) is covered by DPF participation and/or SCCs, which GDPR treats as a compliant transfer mechanism.

Quellen:

• Google Maps Platform Terms of Service (cloud.google.com/maps-platform/terms)
• Google Privacy Policy
• Complianz GDPR analysis of Google Maps (complianz.io/google-maps-gdpr)
• German Landgericht analysis.

• Unlock additional website features

• TPP Notified?: Not yet notified
• Decision Contested?: [nicht dokumentiert]