In January 2022 a regional court in Munich ordered a website operator to pay €100 to a visitor because the site loaded a font from Google’s servers, which passed the visitor’s IP address to Google without consent. The sum is trivial. What followed was not: a wave of automated warning letters in Germany and Austria, sent to thousands of site owners at a few hundred euros each.
This is not legal advice, and one regional court is not a supreme authority. But the reasoning is worth understanding, because it is simple and because the fix is simple.
What the ruling actually turned on
An IP address is personal data under the GDPR. When a page tells a browser to fetch a file from another company’s server, the browser sends that address to that company, and the site operator has caused it to happen. The court found there was no legal basis for that transfer, because the operator could trivially have avoided it by hosting the file themselves.
That last clause is what makes the argument work. The defence for most third-party requests is necessity — you cannot run a payment without a payment processor. A font is not like that. Copying the file onto your own server takes ten minutes, so "we had no alternative" is not available.
How far this reaches
It is a first-instance decision from one German court and does not bind anybody outside that case. But the reasoning applies to any embedded third-party resource that discloses a visitor’s address without consent, and data protection authorities elsewhere in the EEA have made broadly similar noises. Treating it as settled law would be wrong; treating it as a warning about a whole category of embeds is reasonable.
The fix
Download the font and serve it from your own domain. No request leaves your server, no address is disclosed, and there is nothing to ask consent for. Every font on this site has a WOFF2 button on its page for exactly this — the file is the complete font, ready to upload. The self-hosting guide has the CSS.
Two things to check while you are there. A stylesheet link to fonts.googleapis.com is the obvious one. The less obvious one is a theme or plugin loading fonts on your behalf — on WordPress sites that is where most of the warning letters landed, because the site owner had no idea it was happening.
The performance argument changed too
It used to be that a font CDN was faster, because a visitor who had already loaded that file on another site got it from cache. Browsers ended that in 2020 by partitioning their caches per site. The shared cache is gone; what remains of the CDN is an extra DNS lookup, an extra TLS handshake and an extra round trip before the download even starts.
So self-hosting is now the faster option and the private one at the same time. That is unusual enough to be worth noticing — the two considerations normally pull against each other.
What the licence says about it
Every font here is under the SIL Open Font License or similar, which explicitly permits redistribution and bundling. Copying the file onto your own server, including a commercial one, is exactly what the licence is for. The only condition is that the licence file travels with the font — it is inside every download. What the OFL allows covers the rest.
What counts as self-hosted
Self-hosted means the browser fetches the font from a domain you control, and makes no request to anybody else for it. That is a narrower test than it sounds, and sites fail it in three predictable ways.
- A stylesheet that still contains an @import or a link to a third-party font service, left behind when the fonts were copied locally.
- A theme, page builder or plugin that adds its own font call. Plenty do, invisibly, and an update can put one back.
- An embedded widget — a map, a chat box, a video player, an analytics script — that loads its own fonts from elsewhere.
The check is the same for all three: open the browser’s developer tools, look at the network list, and filter it by the domain you are trying to avoid. Nothing should appear. It takes ten seconds and it is the only evidence that matters.
The font is the easy one
A font request sends an IP address, and that is what the German ruling turned on. The same page usually also embeds a video player, a tag manager, a chat widget and a social button, each of which sends rather more than an IP address and several of which set cookies. Fixing the font and leaving those in place solves the smallest part of the problem.
Take the opportunity to list every third party the page actually contacts, then decide about each one deliberately. Most sites find two or three they had forgotten and one they cannot justify.
Write it down
Whatever you decide, record it: which fonts you serve, from where, and when the third-party call was removed. A privacy policy that says "we do not load fonts from third parties" is a claim somebody may check, and the network list is the proof. The licence side is the easy half — every family here may be downloaded, hosted and served from your own domain, which is exactly what the Open Font License permits.
The mechanics of moving the files, including the two lines of CSS that usually go wrong, are in how to self-host a font. Every font page on this site has the complete web font ready to download, with a Latin-only cut beside it for pages that only ever set one alphabet.