GDPR check for Squarespace

Squarespace (a US company) serves pages via its own infrastructure, brings its own analytics and loads fonts from Google Fonts and Adobe Fonts (Typekit).

Is this a risk?

Squarespace Analytics, the optional cookie banner and integrations such as Google Analytics or Meta Pixel set identifiers that require consent under § 25 (1) TDDDG. The font embedding transmits the IP to Google/Adobe. The data transfer to the USA must be justified.

What you can do

• In the “Cookies & Visitor Data” area, enable the cookie banner and block non-necessary cookies until consent.
• Where possible choose system fonts instead of Google/Adobe Fonts; reduce external font calls.
• Load additional integrations (GA, Pixel) via code injection only after consent.
• Conclude a data processing agreement with Squarespace, name the US transfer in the privacy policy.

How consentglass helps

The free scan checks the delivered HTML and shows which services are embedded, whether a cookie banner is detected and whether privacy-policy and legal-notice links are present — with context for each finding. It is not a substitute for legal advice.