Google Fonts and GDPR: self-host your fonts

Why a font sends the IP address without a cookie

A web font is a file, like an image. When the page requests it from Google, the visitor's browser does the fetching: first a stylesheet from fonts.googleapis.com, then the font files from fonts.gstatic.com. Each request carries the visitor's IP address, the name of their browser and, in most cases, the address of the site it comes from.

No cookie is involved. Google says so in the Google Fonts FAQ: use of the API is unauthenticated, and visitors send it no cookies. That is what keeps the request out of sight: a cookie inventory does not show it, yet the IP address has already gone.

The EU Court of Justice ruled on October 19, 2016, in the Breyer judgment (C-582/14), that a dynamic IP address is personal data for a website operator that has legal means to have the person identified. The Munich court relied on that judgment.

Munich, January 20, 2022: three grounds, 100 euros in damages

The case is number 3 O 17493/20 at the Regional Court of Munich I (Landgericht München I). A visitor complained that a website operator had sent his IP address to Google several times, through the fonts the page loaded. The court found for him:

• a dynamic IP address is personal data, since the operator has, in principle, legal means to identify the person;
• legitimate interest does not justify the request, since Google Fonts can be used without the page contacting a Google server;
• the visitor had not consented, and his address went to a Google server in the United States, a country whose level of protection was not recognized as adequate at the time.

The operator was ordered to stop sending this visitor's IP address to Google, under penalty of a fine of up to 250,000 euros per violation, to tell him what data about him was processed, and to pay him 100 euros in damages. The court pointed to the visitor's loss of control over his data and the discomfort it caused him.

A German ruling, in a context that has changed

The judgment comes from a regional court and settles a dispute between two parties. It does not bind courts in other countries, and it is not a ruling of the EU Court of Justice.

Transfers to the United States have also looked different since July 10, 2023. The EU-US Data Privacy Framework recognizes adequate protection for companies on its official list, which includes Google LLC. The framework is under appeal before the EU Court of Justice, and it covers the transfer: the Munich ruling also rested on the legal basis for the request itself.

In Germany, the ruling was followed by mass warning letters sent to website owners, offering an out-of-court settlement. In December 2022, Berlin prosecutors had a lawyer and his client searched on suspicion of attempted extortion and fraud in more than two thousand cases. If a letter like this reaches you, have a lawyer read it before you pay anything.

Self-host your fonts, then check the rest

The fix is within your reach, or your developer's. In this order, from the quickest to the longest:

1. Ask your web agency or developer whether your pages load fonts from Google's servers, and which ones. On every page, not just the home page: a page built on a different template can load others.
2. Have those fonts served from your own domain. The fonts in the Google Fonts catalog are published under open licenses: the visitor sees the same font, and their browser no longer contacts Google to display it. When the font was picked in the theme settings, the fix is often simple.
3. Look for the requests nobody chose. A theme, a plugin or a page builder can load a font from Google without anyone deciding to, and some embedded widgets load their own. The component then has to be configured or replaced: that is where the fix becomes a project.
4. Have the check done again after each theme or plugin update: an update can bring the request back.

Fonts are only one of the services that receive your visitors' IP addresses. The guide on data transfers outside the EU during a visit covers the others: analytics, videos, maps, bot protection.

Finding every call to fonts.gstatic.com, even inside a theme

This percentage covers about 30 websites we audited between August 14, 2026 and September 24, 2026, the ones where this point could be checked. Many were audited because a defect showed up quickly, so the figure describes our audits, not websites in general. This figure counts every service the pages call (analytics, videos, bot protection, fonts), not just Google Fonts.

To find out for your site, the audit opens your pages in a browser, without touching the consent banner, and scrolls to the bottom so that lazy-loaded elements load too. It records every service the browser contacts, whatever part of the site makes the request: theme, plugin or embedded widget. A request to fonts.googleapis.com or fonts.gstatic.com is filed under Google Fonts. Since Google is subject to US law, that destination counts as outside the EU, and the visitor's browser has sent it their IP address.

The request also counts toward the share of your third-party services held by the large US platforms, which the report measures separately. The finding covers the destination and what it receives; it does not assess the legal basis for your processing. Google's listing under the EU-US framework is not measured by the audit: the methodology note mentions it as a possible answer, without concluding that the finding falls away.

The fonts on this site are served that way. Its heading font, Space Mono, comes from the Google Fonts catalog under the SIL Open Font License, and its files are served from our domain. Body text uses the fonts already installed on the visitor's device.