> Google Fonts and the GDPR: the 2022 Munich court ruling on IP transfers to Google, why loading from the CDN is risky and how to self host the fonts. > > Canonical: https://www.flowconsent.com/en/services/fonts/google-fonts Fonts # Google Fonts Essential · [Official website](https://fonts.google.com) Google Fonts is a free font hosting service from Google. When loaded from the Google Fonts CDN, visitor IP addresses are transmitted to Google's US servers, a data transfer ruled unlawful by the Munich Regional Court in January 2022. The solution is simple: download the font files and self-host them on your own server. Self-hosted Google Fonts have zero GDPR implications. Tools like google-webfonts-helper make the download and CSS setup trivial. [Block Google Fonts until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=fonts) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Fonts](https://www.flowconsent.com/en/services/fonts) - Consent Essential - Prior consent Not required - Documented cookies 1 - Third-party domains 2 - Servers United States (Google CDN infrastructure) Overview ## What does Google Fonts do? ## **What is Google Fonts?** Google Fonts is a free library of open-source fonts that can be used on websites either by loading from Google's CDN or by downloading and self-hosting the font files. The library contains over 1,400 font families including widely-used fonts like Roboto, Open Sans, Lato, Montserrat, Poppins, and Oswald. Fonts loaded from the CDN are served from fonts.googleapis.com (CSS) and fonts.gstatic.com (font files). ## **The 2022 Munich court ruling** On 20 January 2022, the Landgericht München I (Munich Regional Court, case 3 O 17493/20) ruled that a website operator violated GDPR by dynamically loading Google Fonts from the CDN. The court found that transmitting the visitor's IP address to Google's US servers without a lawful basis constituted unlawful processing. The court awarded 100 EUR in damages to the plaintiff and ordered the website to stop dynamic Google Fonts loading. This ruling established a clear precedent applicable across Germany and influenced DPA guidance in other EU member states. ## **The self-hosting solution** Self-hosting Google Fonts is simple and completely resolves the GDPR issue: download the font files from fonts.google.com or use google-webfonts-helper (gwfh.mranftl.com) which generates the complete @font-face CSS and provides a zip of the font files. Host the files on your own server or CDN. Replace the Google Fonts link tags with @font-face CSS declarations. Verify in browser developer tools that no requests go to fonts.googleapis.com or fonts.gstatic.com. ## **Performance benefits of self-hosting** Beyond GDPR compliance, self-hosting fonts often improves page load performance by eliminating cross-origin DNS lookups and TLS handshakes to Google's servers. Combine with font-display: swap, woff2 format, and preload hints for optimal loading. Self-hosting is both the compliant and the performant choice. ## **Practical compliance steps** Download font files and host on your own server. Replace link tags pointing to fonts.googleapis.com with self-hosted @font-face CSS. Remove preconnect tags for Google Fonts CDN. Verify no Google Fonts CDN requests in browser developer tools. This single action resolves the GDPR font issue entirely with no ongoing maintenance. Compliance ## Google Fonts and the GDPR - Legal basis Self-hosted Google Fonts: no consent required, no GDPR implications. CDN-loaded Google Fonts: the Munich court ruled consent is required before fonts load from Google CDN. Legitimate interest was rejected as the legal basis. Self-hosting is the recommended compliant approach: download font files and serve from your own domain. - Risk level medium - Applicable regulations GDPR, ePrivacy Directive. Landgericht München I January 2022 ruling. German DPA guidance on Google Fonts. ### Impact assessment (DPIA) A DPIA is not required for self-hosted Google Fonts. For CDN-loaded Google Fonts, the Munich court ruling indicates non-compliance without consent: self-hosting is the recommended resolution. ### Sample text for your banner > This website loads fonts from Google Fonts CDN. Google may process your IP address on US servers when loading these fonts. Accept functional cookies to load Google Fonts, or the website will use system fonts instead. Cookies and trackers ## What Google Fonts sets and contacts - Tracking method Google Fonts CDN API request, IP address logging by Google servers, browser metadata collection - Server location United States (Google CDN infrastructure) - Cookieless mode available Yes - Data transferred outside the EU When fonts are loaded from the Google Fonts CDN (fonts.googleapis.com), visitor IP addresses are transmitted to and logged by Google servers in the US. This constitutes personal data transfer under GDPR. Self-hosting font files on your own server eliminates this transfer entirely. The Landgericht München I ruled in January 2022 that loading Google Fonts via CDN without consent violates GDPR. ### Cookies set (1) | Name | Type | Duration | Purpose | | ---- | ---------- | -------- | ------------------------------------------------------------------------------------------------ | | NID | persistent | 6 months | Google NID cookie set when loading fonts from Google Fonts CDN, eliminated by self-hosting fonts | ### Third-party domains contacted (2) - `fonts.googleapis.com` - `fonts.gstatic.com` Questions ## Frequently asked questions about Google Fonts Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Are Google Fonts GDPR compliant when loaded from CDN? No, according to the January 2022 Munich Regional Court ruling and multiple German DPA guidance documents. Loading Google Fonts from the CDN transmits visitor IP addresses to Google's US servers without a lawful basis. Self-hosting is the compliant solution. ### What did the Munich court ruling say about Google Fonts? The Landgericht München I ruled on 20 January 2022 (case 3 O 17493/20) that dynamically loading Google Fonts from Google's CDN violates GDPR. The court found that the IP address transmission constituted unlawful personal data transfer and awarded 100 EUR in damages. The ruling has prompted tens of thousands of European websites to switch to self-hosted fonts. ### How do I self-host Google Fonts? 1\) Visit google-webfonts-helper.herokuapp.com, select your fonts and weights, download the zip file, 2) Upload font files to your server (e.g. /fonts/ directory), 3) Copy the generated @font-face CSS into your stylesheet, 4) Remove the Google Fonts link tags and preconnect tags from your HTML, 5) Verify no requests to fonts.googleapis.com or fonts.gstatic.com in browser developer tools. ### Does self-hosting Google Fonts affect performance? Self-hosted fonts typically load faster or equally to CDN fonts because they eliminate cross-origin DNS lookup and TLS handshake to Google's servers. Use woff2 format (best compression), font-display: swap (prevents invisible text during load), and rel=preload for critical fonts. The performance argument for using the CDN is largely a myth. ### Do Google Fonts set cookies? CDN-loaded Google Fonts do not set cookies but do transmit IP addresses to Google. The GDPR issue is the IP address transfer to Google's US servers, not cookie placement. Self-hosted fonts have zero data transmission to Google. ### What about loading Google Fonts with consent? Technically, loading Google Fonts after functional consent is given makes it compliant. However, this creates a poor UX (fonts flash or don't load until consent) and is operationally complex. Self-hosting is far simpler and provides the same visual result. ### Does this ruling apply outside Germany? The Munich ruling is a German court decision but reflects GDPR principles applicable across the EU. German DPAs have issued guidance consistent with the ruling. French (CNIL), Dutch (AP), and Austrian (DSB) guidance on third-party font CDNs reaches similar conclusions. Self-hosting is recommended regardless of jurisdiction. ### Are there other font CDNs with the same GDPR problem? Yes. Any font loaded from a third-party CDN that logs IP addresses creates a similar GDPR issue: Adobe Fonts (Typekit), Font Awesome CDN, Bunny Fonts (privacy-focused EU alternative), and others. Bunny Fonts provides a drop-in Google Fonts replacement without IP logging as a CDN alternative. Self-hosting remains the cleanest solution. Related guide ## Our guides on Google Fonts [18 March 2026](https://www.flowconsent.com/en/blog/webflow-google-fonts-gdpr-risk) ### [Google Fonts on Webflow: the GDPR risk you need to fix](https://www.flowconsent.com/en/blog/webflow-google-fonts-gdpr-risk) [Google Fonts loaded from Google servers transmit your visitors' IP addresses without consent. Here is how to fix this on Webflow.](https://www.flowconsent.com/en/blog/webflow-google-fonts-gdpr-risk) [Read the guide](https://www.flowconsent.com/en/blog/webflow-google-fonts-gdpr-risk) Same category ## More services: Fonts [See the whole category](https://www.flowconsent.com/en/services/fonts) ### [Poppins](https://www.flowconsent.com/en/services/fonts/poppins) [Poppins is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Poppins provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Poppins helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/fonts/poppins) [Fonts](https://www.flowconsent.com/en/services/fonts/poppins) · ### [Symbolset](https://www.flowconsent.com/en/services/fonts/symbolset) [Symbolset is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Symbolset integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Symbolset helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/fonts/symbolset) [Fonts](https://www.flowconsent.com/en/services/fonts/symbolset) · ### [IconScout](https://www.flowconsent.com/en/services/fonts/iconscout) [IconScout is a versatile web technology that supports digital platforms with specialized functionality and enhanced capabilities. It provides robust tools and services that integrate with modern websites and applications seamlessly. IconScout is designed to improve operational efficiency, user experience, and digital performance. Trusted by developers and businesses alike, IconScout offers reliable solutions that scale with organizational needs and evolving web standards.](https://www.flowconsent.com/en/services/fonts/iconscout) [Essential](https://www.flowconsent.com/en/services/fonts/iconscout) · ### [Cufón](https://www.flowconsent.com/en/services/fonts/cufon) [Cufon is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Cufon integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Cufon helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/fonts/cufon) [Fonts](https://www.flowconsent.com/en/services/fonts/cufon) · ### [Google Font API](https://www.flowconsent.com/en/services/fonts/google-font-api) [Google Font API is a web font service providing access to a curated library of high-quality typefaces optimized for digital use. It delivers fonts through a global CDN with smart caching and efficient loading to minimize performance impact. Google Font API supports variable fonts, subsetting, and display optimization, helping designers create beautiful typography while maintaining fast page loads. With easy integration and broad browser support, Google Font API enhances aesthetics.](https://www.flowconsent.com/en/services/fonts/google-font-api) [Essential](https://www.flowconsent.com/en/services/fonts/google-font-api) · ### [FontServer](https://www.flowconsent.com/en/services/fonts/fontserver) [FontServer is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. FontServer integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, FontServer helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/fonts/fontserver) [Essential](https://www.flowconsent.com/en/services/fonts/fontserver) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)