Serve your fonts from your own domain.

What a Google Fonts link sends to Google

The usual embed code is a link to a stylesheet on fonts.googleapis.com. The browser fetches that stylesheet, then the font files it names from fonts.gstatic.com. Both requests go to Google, on every page that has the link, as soon as the page loads.

Google’s Fonts FAQ lists what those requests carry: the visitor’s IP address, the address of the file, and browser headers such as the user agent and the page the font appears on. Google says the Fonts API doesn’t set cookies, and that it doesn’t use this information to build profiles or target ads.

No cookie is involved, so the question is whether a site may pass a visitor’s IP address to Google without asking. That falls under the GDPR. Its recital 30 names IP addresses among the online identifiers that can be used to identify people.

What the Munich court ruled

On 20 January 2022 the Regional Court of Munich (Landgericht München I, case 3 O 17493/20) ruled on a site that loaded Google Fonts from Google’s servers. Every visit by the person who sued passed their IP address to Google, and they had not agreed to that.

The court treated the dynamic IP address as personal data. It rejected the site owner’s claim of a legitimate interest, because Google Fonts can be used without the browser connecting to a Google server when the page loads.

The site owner was ordered to stop, under threat of a fine of up to €250,000 for each breach. It also had to tell the visitor what data it held about them, and pay €100 in damages under Article 82 of the GDPR.

This is one ruling by one German regional court, and other courts aren’t bound by it. Its reasoning is short, and the fix it points to costs little. This guide is general information, not legal advice.

Host the font files yourself

Google Fonts are open source, and their licences let you redistribute the files on their terms. Google’s own FAQ names self-hosting as the way to use them without sending visitor data to Google. Download the files from Google Fonts or its GitHub repository, put them in a folder on your site and point an @font-face rule at them.

Google’s self-hosting guide puts it simply: the CSS stays the same, and only the address of the file changes, from fonts.gstatic.com to a path on your own site.

With a build step, a package does the copying. Fontsource publishes open-source fonts as npm packages: install one, such as @fontsource-variable/open-sans, import it once, and your bundler puts the files in your site. Its CSS uses unicode-range, so browsers download only the character sets a page needs. Fontsource also offers a CDN through jsDelivr, and recommends self-hosting where you can: use the package if the aim is to keep every request on your own domain.

Some frameworks do it for you. Astro’s Fonts API downloads fonts from Google, Fontsource and other providers and serves them from your site.

Preload the main font and tighten your policy

Google’s FAQ lists what its API does for you: it sends each browser the smallest file that browser can use, and it delivers font updates without any work on your side. With your own files, you pick the formats and subsets yourself, and you update them when a new version comes out.

To get text on screen sooner, preload the one or two files the first screen needs. A font preload needs the crossorigin attribute, even when the file comes from your own domain, so it matches the request the browser makes for the font. Preload sparingly: Fontsource’s docs warn that preloading every file slows the first load.

If your site sends a Content-Security-Policy header, remove fonts.googleapis.com from style-src and fonts.gstatic.com from font-src, and set font-src 'self'. A request to Google you missed is then blocked, and the browser console names the blocked address.

Check that nothing still loads from Google

Open the page in a private window, open the browser’s developer tools and go to the Network tab. Tick Disable cache, reload, and type google in the filter box, or click Font to see every font the page loads. Any request to fonts.googleapis.com or fonts.gstatic.com means a font still comes from Google. Other Google requests, such as analytics, show up too and may need a look of their own.

Check more than the home page. A theme, page builder or plugin can add its own Google Fonts link, and so can a widget or embed from another company. Check again after updates.

Gatelamp’s scanner runs this check every week: it lists every request to another domain with the script that caused it, and its advice for a Google Fonts finding is to host the fonts yourself.