Do Google Fonts Require Consent? Why External Fonts Pose a Privacy Risk

What Does Google Receive When Websites Load Its Fonts?

Websites commonly load these typefaces as external fonts, which means that a line of code tells visitors' browsers to request them from Google's servers. Website builders and templates often add this code by default. AI coding assistants tend to do the same.

Google says that each request includes the following information about visitors:

Information received per Google's Fonts FAQ, as of October 2026.

Google says that the service does not set cookies, and that it does not use the information to build profiles of visitors or to target advertising. It says that it processes IP addresses to deliver the fonts and for security purposes.

Regardless, each request sends visitors' information to a third party. This typically happens as soon as pages begin to load. It may also continue after visitors opt out, if the consent banner does not control fonts.

What Did the German Court Rule?

In January 2022, a regional court in Munich ruled against a website operator that loaded Google Fonts from Google's servers. The court found that the visitor's IP address was personal data under the GDPR. It also found that the operator had disclosed the address to Google without the visitor's consent.

The court held that the operator could not rely on a legitimate interest, because Google Fonts can be used without requiring the visitor to connect to Google's servers at all. It awarded the visitor 100 euros in damages. It also ordered the operator to stop, with a fine of up to 250,000 euros for each future violation.

What Happened After the Ruling?

The damages were small, but the same reasoning could be applied to any website that loaded fonts this way. Demand letters followed across Germany. One campaign offered to drop each claim for a payment of 170 euros. A court later treated the number of letters it sent as at least 100,000.

In December 2022, Berlin police carried out searches in four cities on behalf of prosecutors, who were investigating a lawyer and his client. The investigation covered at least 2,418 cases of suspected fraud and attempted extortion. Investigators alleged that software had been used to find websites with Google Fonts and to automate visits to them. They estimated that about 2,000 recipients had paid.

In March 2023, the same Munich court ruled for a website operator that had received one of the letters. It found that the sender had used an automated program to visit websites and had not been personally affected. It also held that such claims are excluded when the main motive is profit. However, the court noted that loading Google Fonts from Google's servers without consent can still be a violation.

The pattern resembles the wiretapping demand letters that many U.S. businesses have received under California law. In both cases, a common website feature became the basis for claims that could be produced in large numbers.

Does This Apply to U.S. Websites?

The GDPR can apply to U.S. businesses that offer goods or services to people in the European Union. For those businesses, the Munich court's reasoning applies directly.

U.S. privacy laws do not address fonts specifically. However, IP addresses are central to California's pen register theory. Some complaints that plead it list Google's font address among the third-party domains that the websites contacted. Private lawsuits over website tracking under that provision end on January 1, 2027.

Outside California, website tracking claims are also filed under the wiretapping laws of other states, including Pennsylvania and Florida, and under the federal Wiretap Act. Those claims usually concern the contents of communications, which a font request is less likely to include.

Many U.S. businesses use an opt-out model for web tracking, which state privacy laws generally permit, although it leaves some residual wiretapping risk. Under that model, external fonts may load by default, so the question is whether the request stops when visitors opt out. Under an opt-in model, the question is whether it waits for consent. In either case, a font request that ignores visitors' choices may conflict with what the consent banner or privacy notice tells them.

What Reduces the Risk?

Businesses that use Google Fonts have two common ways to reduce the risk:

• Host the fonts locally. The website serves the font files itself. Google says that it then "does not receive any kind of data related to the visits to the website." Google's fonts are open source, under licenses that generally allow this.
• Control the fonts through the consent banner. The banner then applies visitors' choices to the font request. Under an opt-in model, most visitors never interact with the banner, so most of them would see fallback fonts. Under an opt-out model, the fonts would remain in use for all visitors who do not explicitly opt out.

I recommend that businesses confirm whether their websites load external fonts, both by default and after visitors make a privacy choice. The same check applies to other files that load from third parties, such as embedded maps, videos, and scripts. Whether and how to change each one is a risk decision that should be made deliberately.