Google Fonts, GDPR and IP addresses: how to avoid the demand letter

If your website loads Google Fonts straight from Google's servers, every visitor's browser sends its IP address to Google before the page even finishes loading, and under the GDPR that can count as sharing personal data without a legal basis. A German court has already awarded damages for exactly this, and it set off a wave of demand letters. The fix is simple: host the same font files on your own server (or use a system font stack) so no font request ever leaves your domain. It usually makes the site faster too.

This is general information, not legal advice. If you have received a demand letter or a regulator complaint, talk to a qualified attorney before you pay or reply.

What actually happens when Google Fonts load

The common way to add a Google Font is a <link> tag or a CSS @import that points at fonts.googleapis.com. That stylesheet then tells the browser to download the font files from fonts.gstatic.com. Both requests go from the visitor's browser to Google, and like any web request they carry the visitor's IP address.

Under the GDPR, an IP address can be personal data. Sending it to a third party needs a legal basis, such as consent or a "legitimate interest." Courts have asked whether a site has a legitimate interest in using Google's servers for something it could easily do itself.

The court cases, in plain English

Munich, January 2022. The Munich Regional Court (LG München I, case 3 O 17493/20) ruled on 20 January 2022 that a website broke the GDPR by sending a visitor's dynamic IP address to Google through Google Fonts without his consent. According to activemind.legal's summary, the court awarded him EUR 100 in damages, ordered the operator to stop, and rejected the legitimate interest argument because the same fonts can be used without contacting Google (by hosting them locally).

The 2022 letter wave. After that ruling, people used crawlers to find sites with dynamically loaded Google Fonts and mailed demand letters across Germany and Austria, typically asking for about EUR 170 to settle. Der Betrieb reports that on 30 March 2023 the same Munich court (case 4 O 13063/22) found these claims abusive: the "visitor" was a crawler, the situation was deliberately set up, there was no real damage, and the goal was profit. The court found at least 100,000 letters had gone out. Berlin prosecutors opened an investigation into the people behind the letters, Martin Ismail and lawyer Kilian Lenard, including on suspicion of fraud, and about 2,000 recipients reportedly paid.

The EU Court of Justice, 2025 to now. Germany's Federal Court of Justice (BGH) took up a case brought by a site operator who paid EUR 170 on 25 October 2022 and wanted the money back. PPC Land reports the BGH referred questions to the EU Court of Justice in a decision dated 28 August 2025 (case C-654/25). The two big questions: is a dynamic IP address personal data when the company receiving it cannot identify the user, and can damages be refused when someone deliberately triggers violations to collect money?

The Advocate General's opinion, November 2026. On 5 November 2026, Advocate General Maciej Szpunar gave his opinion, as reported by MLex and explained by Captain Compliance. In short:

The takeaway: the opinion is good news against bot-driven shakedowns, but it does not say loading Google Fonts from Google is fine. A real visitor can still complain, and so can a data protection regulator. Self-hosting removes the issue for the cost of an afternoon.

Does this apply to US websites?

Sometimes. Article 3 of the GDPR covers businesses outside the EU when they offer goods or services to people in the EU or monitor their behavior there. If you sell to Europe, ship there, price in euros or run ads aimed at EU users, assume the GDPR applies. A US roofer with the occasional visitor from Paris is far less exposed, though nothing stops a letter from being mailed.

US laws are not the main driver here. The CCPA and other state privacy laws do treat IP addresses as personal information, but they mostly work on notice and opt-out rules, many have revenue or volume thresholds that small businesses fall under, and the Google Fonts lawsuits came out of Europe. Our guide on whether you need a privacy policy and cookie banner covers the US side in more detail.

How to check your site

You do not need any special tools. Pick whichever method fits your setup.

1. Browser DevTools. Open your site in Chrome or Firefox, press F12, and go to the Network tab. Check "Disable cache," reload the page, and type fonts.g in the filter box. Any request to fonts.googleapis.com or fonts.gstatic.com means the browser is calling Google. Repeat on a few page types (home, blog post, contact page), since some fonts only load on certain templates.
2. View source. Right click, choose View Page Source, and search for googleapis and gstatic. Also look for <link rel="preconnect" href="https://fonts.gstatic.com">, which is a sign Google Fonts are in use.
3. WordPress themes and page builders. Many themes and builders load Google Fonts by default. Elementor's help center says its "Load Google Fonts Locally" option is under Elementor > Editor > Settings > Performance, and it is off by default since version 3.32.1. Many themes have a similar setting. If yours does not, a plugin like OMGF (Optimize My Google Fonts) can download the fonts and rewrite the requests. Recheck DevTools afterward, since other plugins can add fonts too.
4. Embeds. Google Maps embeds, YouTube players and reCAPTCHA can pull Google Fonts and other Google resources inside their own frames. These will show up in the Network tab even after you self-host your own fonts.

How to fix it

Self-host the fonts. Download the font files in woff2 format (only the weights you actually use), put them in your project, and load them with @font-face:

@font-face {
  font-family: "Inter";
  src: url("/fonts/inter-400.woff2") format("woff2");
  font-weight: 400;
  font-style: normal;
  font-display: swap;
}

font-display: swap shows a fallback font right away and swaps in yours when it loads, so text never disappears. Then preload the main font in the <head> so the browser grabs it early:

<link rel="preload" href="/fonts/inter-400.woff2" as="font" type="font/woff2" crossorigin>

Delete the old Google <link> tags, any @import url("https://fonts.googleapis.com/...") lines, and preconnects to the Google font domains.

In Next.js, use next/font. The Next.js docs say next/font/google downloads Google Fonts at build time and serves them from your own domain, with no requests from the browser to Google. If your site already uses it, you are covered for your own fonts.

Use Fontsource. Fontsource publishes open source fonts, including the Google Fonts library, as npm packages (for example @fontsource/inter). Install it, import it once, and your bundler serves the files from your site.

Or skip web fonts entirely. A system font stack such as font-family: system-ui, -apple-system, "Segoe UI", Roboto, sans-serif; uses fonts already on the visitor's device. No download, no third party, and it is the fastest option. More on why that matters in our website speed guide.

Other third-party calls with the same problem

Fonts are the famous example, but the same logic applies to anything a page loads from someone else's server before the visitor agrees:

A copy-paste prompt for AI-built websites

If your site was built with Lovable, Bolt, v0, Replit, Cursor or Claude Code, vibe coding tools often add Google Fonts with a quick <link> tag. Paste this into your AI tool:

Audit this project for third-party font loading and switch everything to self-hosted fonts.

1. Search the whole project (index.html, layout files, components, CSS, SCSS,
   JS/TS, tailwind.config, framework config, and any CMS or theme settings)
   for requests to fonts.googleapis.com, fonts.gstatic.com, and any other
   third-party font or CDN host (for example use.typekit.net,
   cdn.jsdelivr.net, unpkg.com, cdnjs.cloudflare.com, fonts.bunny.net).
2. For each Google or third-party font, list the exact families, weights and
   styles in use. Download only those as .woff2 files into the project
   (for example /public/fonts) and include each font's license file.
3. Replace every <link> tag and CSS @import for those fonts with local
   @font-face rules that use font-display: swap.
4. Add a <link rel="preload" as="font" type="font/woff2" crossorigin> for the
   main body font only.
5. Remove all preconnect and dns-prefetch tags for fonts.googleapis.com and
   fonts.gstatic.com.
6. Keep the font-family names the same so the design does not change. Update
   tailwind.config (theme.fontFamily) if it references the fonts.
7. If the project uses next/font/google or next/font/local, leave it in place.
   It already self-hosts at build time. Do not replace it.
8. Do NOT remove or change other third-party requests. Instead, list every
   other request the site makes to an outside domain on page load (maps,
   video embeds, analytics, tag managers, captcha, chat widgets, CDNs) with
   the file where each one is added.
9. Report back with: a list of every file you changed and what changed, the
   font files you added, the third-party list from step 8, and step by step
   instructions for verifying in Chrome DevTools (Network tab, Disable cache,
   reload, filter for "fonts.g" and confirm zero results).

Once it reports back, run this follow-up:

Verify the font change. Search the full project again, including built
output if it exists, for "googleapis", "gstatic" and "@import url(http".
Confirm there are zero matches outside of comments and documentation.
Confirm every font-family used in CSS has a matching local @font-face or a
next/font definition. List anything you find and fix it without changing
the design.

Then check DevTools yourself, since AI tools tend to say "done" a little too fast. For more on cleaning up an AI-built site, see how to secure a DIY AI-built website and vibe coding a business website.

The short version

Loading Google Fonts from Google sends your visitors' IP addresses to Google. A Munich court called that a GDPR violation in 2022, a crawler-driven letter wave followed, and the EU's top court is now weighing in. The Advocate General's November 2026 opinion pushes back on bot-driven claims, but it does not make the practice safe. Self-host your fonts, use next/font or Fontsource, or switch to system fonts, then check the Network tab. Make sure your privacy policy lists the third parties you still use. If you want a second set of eyes on what your site loads, get in touch.

Sources

• activemind.legal: Google Fonts ruling of the Munich Regional Court
• Der Betrieb: Google Fonts Abmahnwelle war rechtsmissbräuchlich
• PPC Land: German court asks EU to clarify IP address data protection rules
• MLex: Websites should not owe damages for induced data law breaches
• Captain Compliance: Google Fonts, Advocate General Szpunar and dynamic IP addresses
• Elementor Help Center: Elementor and Google fonts
• Next.js docs: Fonts
• Fontsource
• GDPR Article 3: Territorial scope