On this page
The Munich ruling of January 2022
On 20 January 2022 the Regional Court of Munich I (Landgericht München I, case 3 O 17493/20) ordered the operator of a website to pay a visitor 100 euros in damages and to stop passing his IP address to Google. The site embedded Google Fonts the usual way: a line of code that makes every visitor's browser fetch the font from Google's servers. The court found that this disclosed the visitor's dynamic IP address, which is personal data, to Google without consent and without a legitimate interest, because the site could have hosted the font itself. It added that the transfer to a company in the United States made the loss of control worse.
The amount was small; the reach was not. In the months that followed, website owners across Germany received letters demanding around 100 euros in damages plus fees, citing the ruling. Most of them had never heard of the problem, because the embed code is what Google's own site hands out. The ruling bound only the parties, but the reasoning applies wherever the GDPR does, and it has never been contradicted by a higher German court on the core point.
The lesson for any site with visitors in the EU: a resource loaded from a third party's server is a transfer of the visitor's IP address to that third party. Fonts are the best known example, not the only one; the same goes for icon libraries, scripts and maps loaded from a CDN you do not control. What GDPR asks of a site beyond fonts is set out in GDPR for US companies and in do I need a cookie banner.
One page, two ways to load the same font
Loaded from Google
the embed code from fonts.google.com
- example.com/ (the page)your domain
- fonts.googleapis.com/css2?family=Inter
- fonts.gstatic.com/s/inter/v13/...woff2
- example.com/styles.cssyour domain
What reaches a server other than yours
Needs consent in the EU before the request, per the Munich ruling of 20 January 2022.
Hosted on your own domain
the same font files, downloaded once and served by you
- example.com/ (the page)your domain
- example.com/fonts/inter.woff2your domain
- example.com/styles.cssyour domain
What reaches a server other than yours
- nothing
No request to a third party, so nothing to consent to. The licence of most Google Fonts allows it.
What a browser's Network tab shows on first load. Google says it does not use Fonts API data to profile users; the court ruled on the transfer of the IP address itself.
Checking your own site in one minute
- Open your site in Chrome, Edge or Firefox and press F12 to open the developer tools.
- Go to the Network tab and reload the page.
- Type `fonts.g` in the filter box.
- If you see requests to fonts.googleapis.com or fonts.gstatic.com, your site loads fonts from Google.
Repeat it on a few templates: the home page, a product page, the checkout, the blog. A plugin or a single embedded widget often loads its own fonts on one page only. In the Elements tab, a `link` tag pointing at fonts.googleapis.com in the page head is the source.
| What you find | What it means | The fix |
|---|---|---|
| Requests to fonts.googleapis.com and fonts.gstatic.com | fonts loaded from Google on every view | download the files and serve them yourself |
| Requests only to your own domain with .woff2 files | fonts already self-hosted | nothing to do |
| Requests to another font CDN | the same issue with another company | self-host those too, if the licence allows it |
| Font requests only after the cookie banner is accepted | consent-based loading | works, but self-hosting is simpler and faster |
How to host Google Fonts yourself
The fonts in Google's library are released under open licences, mostly the SIL Open Font License, which allows you to download them and serve them from your own server.
- WordPressMany themes have a setting to load fonts locally; otherwise a local-fonts plugin downloads them for you. Check afterwards with the Network tab, because page builders sometimes load fonts again on their own.
- ShopifyShopify serves its theme fonts from its own CDN, not from Google; custom code that adds a Google Fonts link brings the problem back.
- A custom siteDownload the font files in WOFF2, put them on your server, and declare them with @font-face in your stylesheet. Frameworks such as Next.js do this at build time: next/font downloads the font when the site is built and serves it from your domain, with no request to Google at all.
Self-hosting also tends to make the page faster, because the browser does not open a connection to another domain before it can draw the text. How much that matters is in our guide to website speed.
Why it matters more for Germany
Germany has a culture of warning letters (Abmahnungen) that most other EU countries lack: competitors, associations and sometimes individuals can send a formal demand with costs attached. A small, visible technical flaw that a script can detect on thousands of sites is exactly what such letters target. If you sell to German customers, the font fix sits next to the Impressum and the cookie banner on the list of things a German visitor, or a German lawyer, checks first.
Fonts, the GDPR and fines
Can I get fined for using Google Fonts?
A regulator could act, but the real risk so far came from damages claims and warning letters after the Munich ruling, typically around 100 euros plus fees per letter. Self-hosting removes the basis for both.
Is Google Fonts allowed in the EU at all?
Yes. The fonts themselves are fine and free to use. The issue is only the request to Google's servers when a page loads; serve the same files from your own domain and the issue is gone.
Does Google use font requests to track visitors?
Google says the Fonts API sets no cookies and that it does not use the data to profile users or target ads. The Munich court ruled on the transfer of the IP address itself, whatever Google does with it.
Do Adobe Fonts or other font services have the same problem?
Any font loaded from a third party's server sends that server the visitor's IP address. Check each service's terms, and self-host where the licence allows it.