Google Fonts, analytics and tracking before consent (GDPR/ePrivacy)

Fonts

Loading fonts from a third-party server transmits the visitor’s IP address to that server. The Regional Court of Munich I (a German court) ruled on 20 January 2022 that embedding Google Fonts from Google’s servers without consent unlawfully transmits the visitor’s IP address (case 3 O 17493/20). You avoid this by hosting the font yourself.

Tracking and cookies in the EU

Article 5(3) of the ePrivacy Directive (2002/58/EC) requires consent before information is stored on, or read from, a user’s device. The exception is what is strictly necessary to provide a service the user has explicitly asked for. The provision does not list audience measurement as an exception.

The Court of Justice of the EU confirmed in Planet49 (C-673/17) that consent for cookies must be given actively; a pre-ticked box is not enough.

If you operate from Germany

§ 25 of the TDDDG implements Article 5(3) of the ePrivacy Directive in Germany. Even without cookies, consent can be required if a script reads information from the device.

Common mistakes

These mistakes follow from the judgment and the text of the law:

• Loading Google Fonts from Google’s servers. The Regional Court Munich I held on 20 January 2022 that, without consent, this was an unlawful transfer of the dynamic IP address to Google in the US; the legitimate interest did not carry. It granted an injunction and EUR 100 damages under Article 82 GDPR. This is the decision of a single regional court in one case.
• Adding a consent banner while scripts already load. Under § 25(1) TDDDG, storing or accessing information is permitted only with consent based on clear and comprehensive information.
• Assuming only cookies are affected. The provision speaks of “storage of information in the terminal equipment” and “access to information already stored in the terminal equipment”.
• Reading the exception too widely. Paragraph 2 no. 2 applies only where storage or access is strictly necessary so that a digital service the user has expressly requested can be provided.

Example: a font without a request to Google

Next.js downloads Google Fonts at build time and serves them from your own domain; according to the docs, the browser then sends no requests to Google:

import { Geist } from 'next/font/google'

const geist = Geist({ subsets: ['latin'] })

Other tools

With other tools you serve the font file yourself; how that works is described in their docs.

How to check

Open the developer tools, tab “Network”, reload the page without giving consent, and look for requests to other domains.

Frequently asked questions