An individual's location data is very sensitive geoinformation. While its disclosure is necessary, e.g., to provide location-based services (LBS), it also facilitates deep insights into the lives of LBS users as well as various attacks on these users. Location privacy threats can be mitigated through privacy regulations such as the General Data Protection Regulation (GDPR), which was introduced recently and harmonises data privacy laws across Europe. While the GDPR is meant to protect users' privacy, the main problem is that it does not provide explicit guidelines for designers and developers about how to build systems that comply with it. In order to bridge this gap, we systematically analysed the legal text, carried out expert interviews, and ran a nine-week-long take-home study with four developers. We particularly focused on user-facing issues, as these have received little attention compared to technical issues. Our main contributions are a list of aspects from the legal text of the GDPR that can be tackled at the user interface level and a set of guidelines on how to realise this. Our results can help service providers, designers and developers of applications dealing with location information from human users to comply with the GDPR.using location data of their users, i.e., location-based services (LBS). Given that in the digital age "privacy goes global" [6], the impacts of the GDPR will be felt far beyond the boundaries of Europe.While this new law promises to strengthen the rights of individuals, it also poses challenges to the designers and developers of systems that process personal data (e.g., location data). On the legal level, there are questions as to how compliance can be demonstrated. On a technical level, the law introduces new requirements regarding how data is stored, processed and deleted. While these two perspectives already introduce many challenges, it is also not clear how to realise various requirements that the GDPR formulates with respect to what users should be able to control and regarding how and when certain types of information should be presented to them. Providing material to support developers implementing GDPR is critical, as non-compliant companies could be fined with up to (the greater of) 20 million Euro or 4% of their global annual turnover.Location-based services (LBS) are increasingly ubiquitous systems that deal with geo-information and process the location data of their users. In this paper, we aim to address challenges resulting from the introduction of the GDPR that relate to user interfaces of LBS. Our main contributions are as follows: (1) We systematically analysed the legal text to identify a list of aspects that can be tackled at the user interface level (UI) (Section 3); (2) In addition, we carried out interviews with experts to gain further insights into challenges arising from having to comply with the GDPR as well as into ways of addressing them (Section 4); (3) Based on the outcome of both activities, we compiled a set of guidelines for developers and desi...