Google Fonts, Analytics and the GDPR

Google Fonts: the case that is easy to solve

If Google Fonts are loaded from the provider's servers, the visitor's IP address is transmitted when the page is opened. A regional court in Munich ruled in 2022 that doing this without consent constitutes an infringement of personal rights and awarded damages.

The ruling was followed by a wave of cease-and-desist letters, many of which were questionable. The legal assessment in individual cases is still not uniform today, but the dispute can be avoided completely.

The solution: host fonts locally. Download the files, put them on your own server, include them via CSS. No external request, no IP transmission, no consent needed.

This takes about fifteen minutes and has two side effects: the site gets faster because an external connection is eliminated, and the fonts load more reliably.

The same applies to other external resources that are quietly loaded along with the page: icon libraries, JavaScript libraries from third-party servers, embedded maps.

The test that takes two minutes

If Google Fonts are loaded from the provider's servers, the visitor's IP address is transmitted when the page is opened. A regional court in Munich ruled in 2022 that doing this without consent constitutes an infringement of personal rights and awarded damages.

The ruling was followed by a wave of cease-and-desist letters, many of which were questionable. The legal assessment in individual cases is still not uniform today, but the dispute can be avoided completely.

The solution: host fonts locally. Download the files, put them on your own server, include them via CSS. No external request, no IP transmission, no consent needed.

This takes about fifteen minutes and has two side effects: the site gets faster because an external connection is eliminated, and the fonts load more reliably.

The same applies to other external resources that are quietly loaded along with the page: icon libraries, JavaScript libraries from third-party servers, embedded maps.

Google Analytics: the situation has become less clear

Two levels apply to analytics tools.

Consent. Analytics accesses the device and is not technically necessary. Under § 25 TDDDG, consent is required, regardless of any questions about data transfer.

Data transfer to the US. Since July 2023, the basis here has been the EU-US Data Privacy Framework: an adequacy decision by the Commission that certified US providers could rely on.

This framework is now under considerable legal pressure. A US Supreme Court decision from June 2026 on the independence of the Federal Trade Commission has called a central pillar of the agreement into question. What happens next (review by the Commission, proceedings before the CJEU or an amendment) is open.

What this means in practice: if you use US services, you should check the current status before relying on the framework, and at least know the alternatives. A reliable assessment for an individual case belongs with a specialist lawyer. This article is not legal advice.

The European alternatives

For audience measurement, there are providers with servers in the EU, some without device access and therefore without a consent requirement.

What these tools deliver: page views, visitor numbers, referral sources, devices, countries, most popular pages, bounce behavior. For the vast majority of company websites, that fully covers the need.

What they don't deliver: cross-device user tracking, linking with ad accounts, very granular audience analysis. If you run extensive paid campaigns, you will hit limits.

The side effect that is often overlooked: without a consent requirement, all visitors are counted, not just those who agreed. With rejection rates in the double digits, the numbers are more complete as a result, and therefore more useful than patchy analytics with more features.

The switch typically takes half a day, including carrying over the most important metrics as benchmarks.

The other services that get loaded along with the page

Analytics and fonts are the best-known cases. A typical company website has several more.

Embedded videos. Load data when the page is opened, even if nobody plays them. Solution: a preview image, load the video only after a click.

Map services. The same principle. On a contact page, an image with a link to route planning is often enough.

Icon and script libraries from third-party servers. Host them locally, just like fonts.

Chat and booking tools. Check where the servers are and whether they only load after consent.

Social media embeds. A link instead of an embed solves the problem and is usually faster too.

The test: open the developer tools in your browser, Network tab, reload the page and look at the list of domains called, before any consent. Anything that shows up there and isn't your own domain needs to be checked.

The order of implementation

1. Inventory. Network analysis for all page types: homepage, service page, blog article, contact page. A list of all external domains.

2. Host fonts locally. The fastest point with the best ratio of effort to impact.

3. Move everything that loads before consent. The most common and most serious finding. Nothing may load before consent, except what is technically necessary.

4. Cut what isn't needed. Forgotten tools, duplicate analytics services, old tracking codes from campaigns. Many websites have more of these than expected.

5. Replace embeds. Switch videos and maps to load on click.

6. Review analytics. Do you need the features you are accepting legal uncertainty for?

7. Update the privacy policy. It has to match what the site actually does. Naming services you don't use is just as wrong as leaving some out.

The benchmark that saves work

Legal assessments change. Rulings come, adequacy decisions wobble, supervisory authorities change their assessment. If you build your website around whatever the current legal situation is, you are constantly rebuilding.

There is a benchmark that is more stable: How many external services does your website call?

Every service is a dependency: legally, technically and in load time. A website with three external connections has three risks. One with thirty has thirty, most of which nobody is aware of.

The practical consequence is unspectacular: with every new tool, pause for a minute and ask whether the benefit is worth the dependency. For most chat windows, review widgets and analytics add-ons, the answer is no.

This is not a legal strategy but a technical one. But it works more reliably than any adjustment to the latest ruling.