LowChecked on every planEU
Fonts loaded from Google or Adobe
Is it a GDPR problem to load Google Fonts from Google’s servers?
It’s a risk in the EU. Loading fonts from fonts.googleapis.com or Adobe’s use.typekit.net sends every visitor’s IP address to that company before any choice. A Munich court awarded damages for it in 2022. Host the font files on your own site instead: they look the same and send nothing.
Why it matters
A German court ordered a site owner to pay damages because Google Fonts sent a visitor’s IP address to Google without consent, and warning letters followed. Fonts you host yourself look the same and send nothing.
How to fix it
- Download the fonts and serve them from your own site (Google Fonts allows this; tools such as google-webfonts-helper make the files).
- Remove the fonts.googleapis.com or use.typekit.net link from your theme, and check that nothing else still loads them.
The law behind this rule
EUGDPR Art. 6: a lawful basis for sending personal data (an IP address) to a third party
EUMunich Regional Court, 3 O 17493/20 (20 Jan 2022): damages for sending a visitor’s IP address to Google through Google Fonts without consent
A plain summary, not legal advice.