In January 2022 a regional court in Munich ordered a website operator to pay €100 to a visitor because the site loaded a font from Google’s servers, which passed the visitor’s IP address to Google without consent. The sum is trivial. What followed was not: a wave of automated warning letters in Germany and Austria, sent to thousands of site owners at a few hundred euros each.
This is not legal advice, and one regional court is not a supreme authority. But the reasoning is worth understanding, because it is simple and because the fix is simple.
What the ruling actually turned on
An IP address is personal data under the GDPR. When a page tells a browser to fetch a file from another company’s server, the browser sends that address to that company, and the site operator has caused it to happen. The court found there was no legal basis for that transfer, because the operator could trivially have avoided it by hosting the file themselves.
That last clause is what makes the argument work. The defence for most third-party requests is necessity — you cannot run a payment without a payment processor. A font is not like that. Copying the file onto your own server takes ten minutes, so "we had no alternative" is not available.
How far this reaches
It is a first-instance decision from one German court and does not bind anybody outside that case. But the reasoning applies to any embedded third-party resource that discloses a visitor’s address without consent, and data protection authorities elsewhere in the EEA have made broadly similar noises. Treating it as settled law would be wrong; treating it as a warning about a whole category of embeds is reasonable.
The fix
Download the font and serve it from your own domain. No request leaves your server, no address is disclosed, and there is nothing to ask consent for. Every font on this site has a WOFF2 button on its page for exactly this — the file is the complete font, ready to upload. The self-hosting guide has the CSS.
Two things to check while you are there. A stylesheet link to fonts.googleapis.com is the obvious one. The less obvious one is a theme or plugin loading fonts on your behalf — on WordPress sites that is where most of the warning letters landed, because the site owner had no idea it was happening.
The performance argument changed too
It used to be that a font CDN was faster, because a visitor who had already loaded that file on another site got it from cache. Browsers ended that in 2020 by partitioning their caches per site. The shared cache is gone; what remains of the CDN is an extra DNS lookup, an extra TLS handshake and an extra round trip before the download even starts.
So self-hosting is now the faster option and the private one at the same time. That is unusual enough to be worth noticing — the two considerations normally pull against each other.
What the licence says about it
Every font here is under the SIL Open Font License or similar, which explicitly permits redistribution and bundling. Copying the file onto your own server, including a commercial one, is exactly what the licence is for. The only condition is that the licence file travels with the font — it is inside every download. What the OFL allows covers the rest.