Google Fonts and the GDPR: self-host your fonts

If your pages load fonts from fonts.googleapis.com or fonts.gstatic.com, every visitor's browser contacts Google before the page can render, and Google receives the visitor's IP address. On 20 January 2022 the Regional Court of Munich I (case 3 O 17493/20) held that this transfer, done without consent, violated the GDPR, ordered the website operator to stop it and awarded the visitor €100 in damages. The practical answer is not a consent dialog for fonts; it is to download the font files and serve them from your own domain, which takes less than an hour and makes the page faster.

What the Munich court decided

The case was a civil claim by a visitor against the operator of a website that embedded Google Fonts dynamically. The court's findings, in short:

• A dynamic IP address is personal data for a website operator (the court relied on the German Federal Court of Justice's earlier case law).
• The operator could not rely on legitimate interest under article 6(1)(f) GDPR, because the fonts can be used without any connection between the visitor's browser and Google's servers: the same fonts can be served from the operator's own server.
• Passing the IP address to Google without consent therefore had no legal basis, and the visitor's loss of control over personal data, transferred to a Google server in the United States, justified non-material damages of €100 under article 82 GDPR.
• The operator was ordered to stop disclosing the visitor's IP address to Google through the fonts, under threat of a fine of up to €250,000 per violation.

The judgment is a first-instance decision of one German court about one website, and it binds nobody else. Its reasoning, however, applies to any site that loads resources from a third party when it does not have to, and it triggered a wave of demand letters. In November 2022 the data protection authority of Lower Saxony published a notice about the mass of letters from individuals and law firms demanding damages and legal costs on the strength of this ruling, and called on website operators to embed Google Fonts locally instead.

Is consent the alternative?

Technically you could gate the font request behind the banner, but a page whose typography depends on a consent click is a poor page, and the fonts would still fall back for everyone who refuses. Since July 2023 the EU-US Data Privacy Framework provides an adequacy basis for transfers to certified US companies, which removes part of the transfer argument, but not the question of the legal basis for sending the IP address in the first place. Self-hosting removes the request, so there is nothing to justify.

How to self-host

1. List the families and weights you use. Look at the <link> tag or the @import in your CSS: the URL names the families, weights and styles.
2. Download the files. Google Fonts offers the families for download on fonts.google.com; the licences (mostly SIL Open Font License) allow self-hosting. Keep only the weights you use, in WOFF2.
3. Declare them in CSS with a font-face rule per family, pointing at your own domain (the example below).
4. Preload the main file with <link rel="preload" as="font" type="font/woff2" href="/fonts/inter-latin.woff2" crossorigin> so the text renders early.
5. Remove the Google tags: the <link rel="preconnect" href="https://fonts.googleapis.com">, the stylesheet link and any @import.
6. Check the whole site. Themes, plugins, page builders, embedded forms and chat widgets often load Google Fonts on their own. Open the Network tab in a private window, filter on "fonts.g", and browse a few pages. Anything that remains comes from a third-party component that you need to configure, replace, or accept and disclose.

The declaration for step 3 looks like this:

css
@font-face {
  font-family: "Inter";
  font-style: normal;
  font-weight: 400 700;
  font-display: swap;
  src: url("/fonts/inter-latin.woff2") format("woff2");
  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
}

If you cannot self-host

Some hosted platforms and page builders load Google Fonts from Google and offer no setting to change it, and some third-party widgets bring their own fonts. In that case, check whether the platform offers a "local fonts" or "privacy" option (several added one after 2022), ask the vendor, or choose system fonts for the parts you control. Where the request remains, be honest in the privacy policy: name Google Fonts, say that the visitor's IP address is sent to Google to deliver the fonts, and state the legal basis you rely on. A disclosure does not cure the problem the Munich court identified, but silence about a known transfer is worse than an accurate description of it.

What to write in the privacy policy once you self-host

Nothing about Google Fonts. The point of self-hosting is that the fonts become ordinary files on your own server, like your images, and no third party is involved. Remove any sentence that mentions Google Fonts from the policy when you remove the request, so that the policy and the site tell the same story.

Related requests to check

The same reasoning applies to any resource loaded from a third party for convenience: icon fonts from a CDN, jQuery from a public CDN, Adobe Fonts (Typekit), Google Maps and reCAPTCHA. Fonts and libraries can be self-hosted. Maps and reCAPTCHA cannot, and need either consent gating (the embed pattern) or a documented necessity, for example a CAPTCHA that protects a login form.

Where the scanner helps

Cookiequiet's scanner lists stylesheets and preconnect hints along with scripts, and names Google Fonts and Adobe Fonts when it sees them, so a scan after the change confirms that nothing still points at Google. It reads the HTML as served, so a font loaded by a script after page load is only visible with the rendered-HTML option; the Network tab check above remains the final word.