The essentials
- A font loaded from fonts.googleapis.com sends the visitor's IP address to Google.
- The Regional Court of Munich I awarded damages for it in January 2022 (3 O 17493/20).
- The fix is simple: serve the font files from your own domain.
The ruling
On 20 January 2022 the Regional Court of Munich I (LG München I, case 3 O 17493/20) held that a website which loaded Google Fonts dynamically from Google's servers passed the visitor's IP address to Google without a legal basis. The court awarded 100 euros in damages and ordered the operator to stop.
Why it matters
An IP address is personal data for the website operator (Court of Justice of the EU, Breyer, C-582/14, 2016). The fonts could have been served from the operator's own server, so the transfer was not necessary. The ruling was followed by a wave of warning letters in Germany in 2022.
The fix
Download the font files (the commonly used ones have open licences) and serve them from your own domain. The page looks the same and no request reaches Google. The same reasoning applies to other assets loaded from third-party servers: scripts, icons, maps and videos.
How to check a site
Look for requests to fonts.googleapis.com and fonts.gstatic.com on every page, not only the homepage: themes and plugins often load them on some templates only, and a page builder may add them back after an update.
Checklist
- No request to fonts.googleapis.com or fonts.gstatic.com on any page, including checkout and blog templates.
- Font files (.woff2) served from your own domain, with their licence respected.
- The CSS of themes, plugins and page builders checked for imports of Google Fonts.
- The same check for other third-party assets: icons, maps, video embeds.
Sources
- LG München I, judgment of 20 January 2022, 3 O 17493/20.
- CJEU, 19 October 2016, Breyer, C-582/14 (IP addresses as personal data).
- Article 6(1) GDPR (lawfulness of processing).
General information, not legal advice. Have your specific situation reviewed by your DPO or counsel.