# Google Fonts and the GDPR: self-host your fonts

> Loading Google Fonts from Google sends each visitor's IP address to Google; a Munich court awarded damages in 2022. Self-hosting fixes it in under an hour.

Source: https://cookiequiet.com/guides/google-fonts-gdpr
Published: 2026-10-20
Publisher: Cookiequiet

## Steps

1. **Inventory the font requests** In a private window, open the Network tab, filter on fonts.googleapis.com and fonts.gstatic.com, and note the families, weights and the pages or components that request them.
2. **Download the font files** Get the families from fonts.google.com, keep only the weights and styles you use, in WOFF2, and check the licence allows self-hosting (most families use the SIL Open Font License).
3. **Add the font-face rules** Declare each family in your CSS with font-display swap and a src pointing to your own domain. Subset by unicode-range if you serve several scripts.
4. **Preload the main font** Add a preload link for the file used above the fold, with the crossorigin attribute, so text renders without a flash.
5. **Remove the Google references** Delete the preconnect and stylesheet links to Google Fonts and any CSS import. Update the theme or plugin settings that add them back.
6. **Verify across the site** Browse several pages with the Network tab filtered on fonts.g and confirm nothing remains. Run a scan to double-check scripts and stylesheets on pages you did not open.

If your pages load fonts from `fonts.googleapis.com` or `fonts.gstatic.com`, every visitor's browser contacts Google before the page can render, and Google receives the visitor's IP address. On 20 January 2022 the Regional Court of Munich I (case 3 O 17493/20) held that this transfer, done without consent, violated the GDPR, ordered the website operator to stop it and awarded the visitor €100 in damages. The practical answer is not a consent dialog for fonts; it is to download the font files and serve them from your own domain, which takes less than an hour and makes the page faster.

## What the Munich court decided

The case was a civil claim by a visitor against the operator of a website that embedded Google Fonts dynamically. The court's findings, in short:

- A dynamic IP address is personal data for a website operator (the court relied on the German Federal Court of Justice's earlier case law).
- The operator could not rely on legitimate interest under article 6(1)(f) GDPR, because the fonts can be used without any connection between the visitor's browser and Google's servers: the same fonts can be served from the operator's own server.
- Passing the IP address to Google without consent therefore had no legal basis, and the visitor's loss of control over personal data, transferred to a Google server in the United States, justified non-material damages of €100 under article 82 GDPR.
- The operator was ordered to stop disclosing the visitor's IP address to Google through the fonts, under threat of a fine of up to €250,000 per violation.

The judgment is a first-instance decision of one German court about one website, and it binds nobody else. Its reasoning, however, applies to any site that loads resources from a third party when it does not have to, and it triggered a wave of demand letters. In November 2022 the data protection authority of Lower Saxony published a notice about the mass of letters from individuals and law firms demanding damages and legal costs on the strength of this ruling, and called on website operators to embed Google Fonts locally instead.

## Is consent the alternative?

Technically you could gate the font request behind the banner, but a page whose typography depends on a consent click is a poor page, and the fonts would still fall back for everyone who refuses. Since July 2023 the EU-US Data Privacy Framework provides an adequacy basis for transfers to certified US companies, which removes part of the transfer argument, but not the question of the legal basis for sending the IP address in the first place. Self-hosting removes the request, so there is nothing to justify.

## How to self-host

1. **List the families and weights you use.** Look at the `<link>` tag or the `@import` in your CSS: the URL names the families, weights and styles.
2. **Download the files.** Google Fonts offers the families for download on fonts.google.com; the licences (mostly SIL Open Font License) allow self-hosting. Keep only the weights you use, in WOFF2.
3. **Declare them in CSS** with a font-face rule per family, pointing at your own domain (the example below).
4. **Preload the main file** with `<link rel="preload" as="font" type="font/woff2" href="/fonts/inter-latin.woff2" crossorigin>` so the text renders early.
5. **Remove the Google tags**: the `<link rel="preconnect" href="https://fonts.googleapis.com">`, the stylesheet link and any `@import`.
6. **Check the whole site.** Themes, plugins, page builders, embedded forms and chat widgets often load Google Fonts on their own. Open the Network tab in a private window, filter on "fonts.g", and browse a few pages. Anything that remains comes from a third-party component that you need to configure, replace, or accept and disclose.

The declaration for step 3 looks like this:

```css
@font-face {
  font-family: "Inter";
  font-style: normal;
  font-weight: 400 700;
  font-display: swap;
  src: url("/fonts/inter-latin.woff2") format("woff2");
  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
}
```

## If you cannot self-host

Some hosted platforms and page builders load Google Fonts from Google and offer no setting to change it, and some third-party widgets bring their own fonts. In that case, check whether the platform offers a "local fonts" or "privacy" option (several added one after 2022), ask the vendor, or choose system fonts for the parts you control. Where the request remains, be honest in the privacy policy: name Google Fonts, say that the visitor's IP address is sent to Google to deliver the fonts, and state the legal basis you rely on. A disclosure does not cure the problem the Munich court identified, but silence about a known transfer is worse than an accurate description of it.

## What to write in the privacy policy once you self-host

Nothing about Google Fonts. The point of self-hosting is that the fonts become ordinary files on your own server, like your images, and no third party is involved. Remove any sentence that mentions Google Fonts from the policy when you remove the request, so that the policy and the site tell the same story.

## Related requests to check

The same reasoning applies to any resource loaded from a third party for convenience: icon fonts from a CDN, jQuery from a public CDN, Adobe Fonts (Typekit), Google Maps and reCAPTCHA. Fonts and libraries can be self-hosted. Maps and reCAPTCHA cannot, and need either consent gating ([the embed pattern](/guides/youtube-embeds-and-consent)) or a documented necessity, for example a CAPTCHA that protects a login form.

## Where the scanner helps

Cookiequiet's scanner lists stylesheets and preconnect hints along with scripts, and names Google Fonts and Adobe Fonts when it sees them, so a scan after the change confirms that nothing still points at Google. It reads the HTML as served, so a font loaded by a script after page load is only visible with the rendered-HTML option; the Network tab check above remains the final word.

## Questions

### Do I need consent to use Google Fonts?

The Munich court found that loading them from Google without consent had no legal basis, because the fonts can be served locally. Rather than ask for consent, remove the request: self-hosted fonts involve no third party at all.

### Does a German first-instance ruling matter outside Germany?

It binds only the parties, but its reasoning rests on the GDPR, which applies in every member state: an IP address is personal data, and sending it to a third party needs a legal basis. Authorities elsewhere have not contradicted it, and self-hosting is the recommendation most of them give.

### Is Adobe Fonts (Typekit) the same problem?

Yes in principle: the fonts are loaded from Adobe's servers with the visitor's IP address. Adobe's licence terms for web projects generally require loading from Adobe, so the choice is between disclosing and justifying the request or switching to fonts you can self-host.

### Will self-hosting slow my site down?

Usually the opposite. The browser skips a DNS lookup and a connection to a second domain, and you control caching and subsetting. Keep only the weights you use and preload the main file.

## Sources

- [LG München I, Endurteil vom 20.01.2022, 3 O 17493/20 (Bayern.Recht)](https://www.gesetze-bayern.de/Content/Document/Y-300-Z-BECKRS-B-2022-N-612)
- [LfD Niedersachsen, press release of 24 November 2022 on Google Fonts demand letters (PDF)](https://lfd.niedersachsen.de/download/190184)
- [Regulation (EU) 2016/679 (GDPR), articles 6 and 82](https://eur-lex.europa.eu/eli/reg/2016/679/oj)