Embedding Google Fonts locally

If a page embeds fonts directly via fonts.googleapis.com or fonts.gstatic.com, the visitors' IP address is transmitted to Google in the USA on every visit — before any consent is even possible.

Is this a risk?

The Regional Court of Munich I awarded an affected person €100 in damages on 20 Jan 2022 (case 3 O 17493/20) because the IP address was transmitted to Google without a legal basis. This was followed by numerous cease-and-desist and demand letters. Locally served fonts do not trigger this transmission.

What you can do

• Download the required font weights from Google Fonts (e.g. via google-webfonts-helper).
• Place the files on your own server and embed them via @font-face.
• Remove all calls to fonts.googleapis.com and fonts.gstatic.com from HTML, CSS and plugins.
• In WordPress, plugins such as “OMGF” do this; afterwards, verify in the source code.

How consentglass helps

The free scan checks the delivered HTML and shows which services are embedded, whether a cookie banner is detected and whether privacy-policy and legal-notice links are present — with context for each finding. It is not a substitute for legal advice.