Adding a Google Font to a site takes about five seconds. You paste a line into the header, the type looks right, and you never think about it again. The line keeps working after you stop thinking about it, and that is the part worth understanding.
Every external embed on a page carries three quiet costs: some speed, some privacy that is not yours to give away, and a legal position you probably have not checked. None of the three shows up anywhere you look, which is why sites accumulate a dozen of these before anyone notices.
What actually happens when the font loads
A font linked from fonts.googleapis.com is not on your server. When somebody opens your page, their browser has to go and fetch it, which means opening a connection to a machine belonging to Google and telling it who is asking. The IP address goes with the request, because it has to: that is how the response finds its way back.
That happens while the page is still rendering. Before the visitor has clicked anything, before they have read a word, and before your cookie banner has finished appearing, their address has already been sent to a third party in another jurisdiction. Under the GDPR an IP address is personal data, so what you have there is a transfer with no legal basis behind it.
A court has already ruled on this
This is not a theoretical reading of the regulation. On 20 January 2022 the Regional Court of Munich I ordered a site operator to pay a visitor 100 euros for exactly this, in case 3 O 17493/20, and barred them from passing that visitor’s IP address to Google in future.
The reasoning is the part to pay attention to. The operator argued legitimate interest, and the court rejected it on a simple ground: the fonts can be hosted on your own server, at no cost, with no loss of function. When a lawful option is free and available, the unlawful one has no interest to defend.
- Court
- LG Munich I
- Damages
- 100 euros
- Time to fix it
- Half an hour
What followed was less edifying. Someone ran a crawler over the German web, found every site with a dynamic Google Fonts link, and sent out warning letters demanding settlement. The court put the number at over a hundred thousand in one case and more than two hundred thousand in another. In March 2023 the same Munich court threw that campaign out as an abuse of process, on the grounds that a crawler is not a visitor and nobody whose privacy was actually affected had been anywhere near those sites.
Read that carefully, because it is easy to take the wrong lesson from it. What got struck down was the shakedown, not the finding underneath it. Loading fonts from Google without consent is still a data transfer with nothing behind it. What changed is that the person likely to raise it is now a regulator or an actual annoyed visitor rather than an automated letter mill.
The law follows the visitor, not the server. If people in the EU read your site, this applies to you wherever you happen to be sitting.
And it is slower
The legal side gets the attention, but the performance cost is the one every visitor pays on every page.
An external font is a DNS lookup, a TCP connection and a TLS handshake to a host the browser has not spoken to yet, then a stylesheet, and only then the font files that stylesheet points at on a second host. That is a chain of four round trips that has to finish before your text can be drawn in the right typeface, and it sits in the middle of the render path. Shared browser caching across sites, which was the original argument for using a font CDN at all, has been gone for years: browsers partition their caches per site now, so every visitor downloads it fresh anyway.
Then there is what most sites actually link. A theme demo picks two families, someone adds a third for headings, nobody removes the first, and the tag requests nine weights in two families when the design uses three weights in one. Every unused weight is a file the browser fetches.
| Self-hosted | Font CDN | |
|---|---|---|
| Visitor IP sent | Nowhere | Abroad |
| Consent needed | No | Yes |
| Extra connections | None | Two hosts |
| Weights shipped | What you use | What the tag asks for |
Self-hosting fixes both problems with the same move. The files come from the origin the browser has already connected to, there is no third-party lookup, no transfer, and you ship only the weights you use. On this site the fonts are two variable files served from the theme folder, and the homepage loads its assets from exactly one origin: its own. You can check that yourself in the network tab.
Fonts are just the easiest one to point at
The same mechanism runs under everything else you embed, and some of it collects considerably more than an IP address.
- reCAPTCHA, which loads on any page carrying a form and is a Google script by construction. Cloudflare Turnstile does the same job without the profiling, which is why this site runs it on the contact form.
- Embedded video. A standard YouTube embed sets cookies before anyone presses play. The nocookie domain helps and is not a complete answer.
- Maps, chat widgets, review badges, social feeds and font icon kits. Each one is a live connection to somebody else, running on every page it appears on.
- Analytics, which at least you chose deliberately, and which still needs consent before it loads rather than after.
There is a security angle too, separate from privacy. A script you load from someone else’s server is a script they can change without telling you, and it runs with full access to your page, including whatever a visitor is typing into a form on it. If you must load third-party code, pin it with a Subresource Integrity hash so the browser refuses a file whose contents changed. Most embed snippets do not include one, and most people never add it.
The fix, in the order to do it
- Open your site with the network tab recording and sort by domain. Anything that is not your own domain is a third party, and the list is usually longer than expected.
- Self-host the fonts. Download the weights you actually use, put them in the theme, serve them with
font-display: swap, and delete the Google tag. This is half an hour of work and it closes the legal question completely. - Cut the families and weights nobody uses. Look at what the design really has: usually one family and three weights.
- Replace reCAPTCHA with Turnstile, and swap raw video embeds for a click to load placeholder.
- For anything you keep, gate it behind consent rather than loading it and asking afterwards, and name the recipient in your privacy policy. Under the GDPR each of these is a processor you are sending visitor data to, and the policy is where you are supposed to say so.
Step two alone removes the thing that has actually produced judgments.
If you build sites for other people
Then this is not really about you, and that is the uncomfortable part. You paste the embed, you hand over the site, and the letter arrives at your client. They have no idea what a font CDN is and no way to have known to ask.
Checking the third-party list before handover takes ten minutes, and telling the client what remains and why takes two more. It costs nothing and it is the difference between a technical decision and one you made on their behalf without saying so.
This is one of a set of costs that stay invisible until you go looking for them. The other one piles up on disk:
Last updated
