Google Fonts (Munich): a font request sent the visitor’s IP to Google

The site embedded Google Fonts by linking to Google’s servers. Every visit made the visitor’s browser fetch the font from Google, which gave Google the visitor’s IP address. The operator said it had a legitimate interest. The court disagreed, because the same fonts can be served from the site’s own server.

These are court findings in the judgment. Inth translated the German.

• A dynamic IP address is personal data for a website operator, because it has legal means to have the person identified with the help of the authorities and the internet provider (para 4, citing BGH VI ZR 135/13).
• Passing the visitor’s IP address to Google automatically, without his consent, infringed his right to informational self-determination (paras 6 to 7).
• There was no legitimate interest, because Google Fonts "can also be used without a connection to a Google server being made when the website is called up" (translated, para 8).
• The visitor did not have to hide his own IP address first (para 9).
• Switching to self-hosted fonts after the fact did not remove the risk of repetition; only a binding undertaking backed by a penalty would.
• Damages under Article 82 were justified by the loss of control over his data to Google and his individual discomfort. The court also noted that the IP address went to a Google server in the US, where it said there was no adequate level of protection, citing Schrems II (para 12).

Illustrative pattern, not the defendant’s code.

Inth’s technical interpretation: any third-party request reveals the visitor’s IP address to that host. Fonts, icon sets, scripts and images from a CDN all do this. The question this court asked is whether the request is needed or whether the file could be served locally.

1. 28 January 2021Date from which interest runs on the damages
2. 20 January 2022LG München I gives judgment

The operator must not disclose this visitor’s IP address to Google through Google Fonts, on pain of a court penalty of up to €250,000. It must tell him what data it holds about him and pay him €100 plus interest. This is one first-instance civil judgment. It binds only the parties, and Inth has not confirmed whether it was appealed.

€100 plus interest, the access request and the costs of the case. No fine.

The sum is small, but the finding is cheap to avoid and easy to test. Any request to a third-party host before consent can expose the IP address, and a court here said that was enough for damages when a local alternative existed.

• Website audit records observable browser requests and what loaded before a choice, with the page, time, region and consent state. A request to a Google font host on first load shows up there.

Inth does not decide whether a request has a legitimate interest; that is a legal judgement for your team.

In the repository

• Search for fonts.googleapis.com and fonts.gstatic.com in templates, CSS and theme settings.
• Check third-party plugins and themes, which often load fonts on their own.

In the browser and network

• Load the site in a clean profile and list every third-party host contacted before any choice.

With the people responsible

• Agree a rule that static assets are served from your own domain unless there is a recorded reason not to.

• LG München I, 3 O 17493/20, judgment (German)

Source review: 20 October 2026. This page describes the cited record and procedural stage. It does not audit the operator’s current systems. Inth translated the German quotes and wrote the technical checks; they cannot decide which laws apply or prove compliance. Paragraph numbers follow the published text.

Related: Telekom and Google transfers, Neue Osnabrücker Zeitung