GDPR check for Webflow

Webflow sites are served via infrastructure in the USA (AWS, Fastly) and embed fonts as well as optional analytics and form functions.

Is this a risk?

Google Fonts and Adobe Fonts are loaded externally by default in Webflow — the visitor's IP goes to Google or Adobe with no legal basis. Webflow's own analytics and embedded elements require consent under § 25 (1) TDDDG; the general hosting transfer to the USA must be justified.

What you can do

• Self-host fonts: upload the font files and embed them as a “custom font” instead of via Google/Adobe.
• Embed a consent tool via custom code that runs embedded scripts only after agreement.
• Check forms and their forwarding; conclude a data processing agreement with Webflow.
• Name Webflow as host, the US transfer and the transfer basis in the privacy policy.

How consentglass helps

The free scan checks the delivered HTML and shows which services are embedded, whether a cookie banner is detected and whether privacy-policy and legal-notice links are present — with context for each finding. It is not a substitute for legal advice.