What the SDK sends, and where

This page lists the data the SDK sends from your users' browsers, and where it goes, for your privacy notice and your records of processing (GDPR Articles 13 and 30).

In short, the SDK talks to api.tomtom.com, or to your proxy, and sends only what each map view and service call needs.

What the SDK does not do

The SDK sends no telemetry, meaning no analytics, beacons or usage reports of its own.
It writes nothing to browser storage: cookies, localStorage, sessionStorage, IndexedDB or the Cache API.
Core, Services and Map never look up the location with navigator.geolocation. A position only reaches the SDK when your code passes one in.
It doesn't read the user agent, screen, hardware or WebGL details to fingerprint a device.

What goes to api.tomtom.com

When the browser calls TomTom directly, every request reaches TomTom with the user's IP address, as any HTTP request does. In proxy mode, the same data passes through your proxy first, which changes the address TomTom sees. TomTom also receives:

When	What TomTom receives
Every map view	The style document, then the tiles, sprites and glyphs for the area on screen. Tile coordinates (`z/x/y`) show roughly which area the user is looking at.
Search, geocoding and autocomplete	The query text, any position or area you bias the results with, and the area of a geometry search or the route of an along-route search
Reverse geocoding	The position, and the heading if you pass one
Routing and reachable range	The origin, destination and waypoints, plus the vehicle parameters you set: weight, heading and restrictions such as a maximum speed
Traffic incident details	The bounding box or incident IDs
Traffic area analytics	The area's geometry, and the dates, hours and road classes you ask for
Place details, geometry data	The place or geometry IDs
Every service call, and every map request except images	A `tomtom-user-agent` header holding the SDK name and version (`MapsSDKJS/<version>`)
Every request, except in proxy mode	Your API key, in a `TomTom-Api-Key` header or a `key=` URL parameter (which is which)

The header and the key are separate:

The tomtom-user-agent header carries no API key and nothing about the user. Every user of a given SDK version sends the same value. Agent Toolkit plugin requests carry MapsSDKJS-AgentToolkit/<version> instead, with the plugin's version. To turn it off, set sendUserAgentHeader: false.
The API key identifies your application, not the end user. In proxy mode, the browser sends no key at all, and your proxy adds it on the way to TomTom.

What travels in URLs

Some of this data goes in the URL instead of the request body. The path holds:

the geocoding, search and autocomplete query text, as the last segment (…/search/<query>.json)
the tile coordinates (z/x/y)

The query string holds:

the reverse geocoding position
geo-bias lat and lon, or the bias area
the traffic incident bounding box, or up to five incident IDs (more go in the request body)
the place and geometry IDs
the key= parameter on map resources and traffic area analytics, unless you use proxy mode

URLs end up in places a request body doesn't: server access logs, CDN logs, proxy logs and error trackers. Strip query strings, and the path segments above, from any logs you keep, or redact these values before you store them.

Proxy mode and cookies

In proxy mode, the SDK sends every request with credentials: 'include'. The session cookie your proxy issues then travels with every service call and tile request.

The SDK never sets or reads that cookie. Your proxy does, so list it in your cookie notice as one of yours.

TomTom then sees your proxy's IP address instead of the user's, unless your proxy forwards it, for example in an X-Forwarded-For header. The rest of what this page lists still reaches TomTom, through your proxy.

Third parties

Core, Services and Map contact no third party. These cases depend on you:

The SDK applies the MapLibre CSS from its own bundle. If you load that CSS, an image or a marker icon from a CDN instead, that CDN sees your users' IP addresses. Serve them from your own origin, or bundle them.
The Landmarks 3D plugin decodes its KTX2 textures with the transcoder bundled in the plugin. If you set a transcoderPath, that request goes to the host you name.
Map Theme's deriveMapColorsFromImage loads the image URL you pass it, so that image's host sees your users' IP addresses.

The Agent Toolkit plugin sends data to more places than these. What the agent sends, and where covers it.

Next steps

Proxying your API calls - Keep the API key and TomTom's address off the page.
Request options and errors - Per-call overrides, cancellation and error codes.
Where your API key runs - Which data stays on your server and which reaches the browser.