I am currently working on a project where we are using Google Maps to display some data by using the client-side JS API to manually add the points on to the map once the user has clicked on a button.
It has been suggested that using Google Maps may leak our data to Google, and I would like to understand the possibility of this.
Does Google have a way to obtain all the points that are plotted on the map?
According to Google maps API's Terms of Service agreement, Google has a right to obtain information from you, when you use Maps JavaScript API. Basically, when using the JavaScript Maps API, the following information is sent to Google:
- Map size and location for retrieving map tiles and copyrights
- Addresses for geocoding
- Direction and Elevation requests
- Locations around which to search for Places
- KML when using KmlLayer
Source: Google Maps FAQs
By adding javascript files from an external domain, you also give the owner of that domain control over your web page. However, you can isolate the part the js has access to with sandboxed iframes, that are widely supported.
But even with isolation, if you add the points via their api, google has still access to them. A solution would be to draw the points in a transparent overlay, but that is very hacky.
If you are very concerned about your point data, you should set up an openstreetmap tile server and access it with leaflet.
