Hosting Google Fonts yourself instead of loading them remotely

When a website links a font through an address like fonts.googleapis.com, the font file loads not from the site's own server but directly from a Google server. To fetch that file, the visitor's browser contacts Google itself and transmits the visitor's IP address in the process, and this happens before the visitor has clicked anything on the page.

Within the European Union an IP address counts as personal data, because together with other information it can identify a specific person. Passing that IP address to a third party server therefore needs a legal basis, and the convenience of a good looking font does not count as one.

On 20 January 2022 the Regional Court of Munich I, ruling on case 3 O 17493/20, awarded a website visitor 100 euro in damages under Article 82 of the GDPR. The reason was that the website had transmitted the visitor's IP address to Google without consent.

The court drew a line between two ways of loading a font. Dynamic loading means the file is fetched from a third party server on every single page view. Local loading means the file sits on the site's own server and no external request is made. The complaint in this case concerned the dynamic method.

After the ruling, letters demanding the same 100 euro went out across Germany in large numbers, some of them apparently sent automatically without the supposed data subject ever having visited the site in question. A genuine claim is not always easy to tell apart from a mass mailing at first glance, so reacting in haste is rarely a good idea.

You can check your own site in a couple of minutes without any special tools. Open the page in a browser, press F12, switch to the network tab and reload. If requests to fonts.googleapis.com or fonts.gstatic.com show up, fonts are loading from an outside server.

Moving fonts onto your own server works like this. The font files get downloaded and placed alongside the site's other files, the stylesheet gains a font-face rule pointing at that local path, and the old line referencing Google is removed. On WordPress that line often comes from the theme or a plugin rather than from the site owner's own settings, so it is worth checking the network tab again after the change and after every theme update.

Other embedded elements follow the same pattern. Maps, video players, spam protection and scripts pulled from third party content delivery networks transmit the visitor's IP address the same way whenever they are loaded directly from an outside server, before any consent has been given.

If a letter has already arrived, the sensible order is to fix the underlying cause on the site first and only then assess the claim itself. Paying on the strength of the first letter and signing an enclosed cease and desist declaration without a lawyer looking at it first can end up costing more than the amount being demanded.

Local fonts carry a practical side benefit too, the page no longer waits on a response from a third party domain and renders its text sooner.

This text explains the technical and legal background and does not replace legal advice. Assessing a specific letter and a specific website always depends on the details of the case.