Does your site load fonts straight from Google?
We load your page, look at every address the browser fetches from someone else’s server, and tell you which of them hand over your visitors’ IP addresses before anybody has agreed to anything.
PASTE YOUR SITE'S ADDRESSIf your site embeds a font from fonts.googleapis.com or fonts.gstatic.com, every visitor’s browser opens a connection to Google on page load. The IP address goes along with it, without anyone being asked. In 2022 the Regional Court of Munich I treated that as an infringement of personality rights and awarded a claimant 100 euros in damages (judgment of 20 January 2022, case 3 O 17493/20).
A wave of warning letters followed, some from law firms, some from pure mass-warning operations. Many of those were themselves an abuse of process, and courts later said so. None of that changes the technical position: the address goes out before anyone could consent.
The fix is unglamorous. Download the font once, put it next to your own site, serve it from there. Then nothing leaves your server at all, and the page gets faster as a side effect.
Sites that load fonts from Google usually load more from outside: an analytics script, an embedded map, a YouTube video, a chat widget, an ad pixel. Each one sees the same IP address, and for analytics and advertising tools § 25 TDDDG applies as well: anything stored on or read from the device needs consent first.
So we do not only show Google Fonts, we show every third-party address that fires on page load, sorted by what it does. Trackers without a consent tool are reported separately.
Every connection your page opens to another domain on load, fonts included, and whether a consent tool exists before the first of them fires. We only read, we change nothing, and we do not store your page content.
Every visitor's address is sent to Google on each visit; often flagged since a 2022 Munich court ruling. General information.
Only if the font is genuinely loaded after consent. Most banners change nothing about load behaviour, so the address has long since been transmitted by the time anyone clicks. Self-hosting solves it at the root.
Download the font files, put them in your project folder and reference them from your CSS with @font-face instead of linking to Google. In most builders it is enough to instruct it to embed the font locally.
Yes, same pattern and usually more pronounced, because those also set cookies. Both should load only after consent, typically behind a two-click solution.
The 2022 and 2023 wave has died down and many of those letters were an abuse of process. The risk today is smaller but not zero, and the change takes minutes.
Everything legal on this page is general information with a pointer to the rule it comes from. Deckproof does not assess your individual case and does not give legal advice.