Self-host Google Fonts. An EU court adviser would deny damages only to crawler-made claims.

A third of the Product Hunt launches I scanned this summer send each visitor's IP address to Google before the visitor has clicked anything. Of the 458 products in my August 2026 scan, 150 requested their fonts from Google's servers on the first load of the homepage. Since 2022 that one request has earned German website owners demand letters for 170 euros, many of them sent after a visit by a crawler built to find it. On 5 November 2026 an adviser to the EU Court of Justice said those crawler-made claims should get no damages 1. He did not say the font request is lawful. He said the IP address it sends is personal data whenever Google can identify the person behind it, and a German court that ruled on the request in 2022 found it unlawful without the visitor's consent 4.

When I first wrote up that scan, I did not count font requests as sending personal data to a vendor. After this opinion, I would. For a site that still loads Google Fonts, the opinion lowers the risk from crawler letters and leaves the risk from real visitors and regulators where it was. The change that removes both is small: serve the font files from the site's own domain, which Next.js does automatically through next/font and other stacks can do with an npm package. A site that already serves its own fonts can stop reading here.

What did the EU court adviser say about Google Fonts?

The adviser is Maciej Szpunar, one of the Advocates General who give the EU Court of Justice a written opinion before it rules. The case started with a German website owner who received a lawyer's letter in October 2022 demanding 170 euros, paid it, and then learned that the "visitor" was the letter sender's crawler. According to the German court handling the case, the same procedure was used more than 100,000 times 1. That court, Germany's highest civil court, asked the EU Court of Justice to rule on what an IP address is and on whether a crawler can claim damages. Szpunar's opinion answers both.

The IP address is personal data if Google can identify the person

The Court already held in 2016, in the Breyer case, that a dynamic IP address can be personal data for a website that has legal means to find out who was behind it 3. Szpunar asks the same question about the company receiving the address. If the recipient can reasonably identify the person, the address is personal data for the recipient. For Google, he points to its ability to combine the address with the other data it holds, and leaves it to the German court to check 1.

For the website that sent the address, he proposes his own condition: the address is personal data for the site as well if the site knew or should have known that the recipient can identify people. The Court's earlier case law has no such condition, and the Court may leave it out 1. If the Court keeps it, my own view is that a site owner will find it hard to claim in 2026 that they did not know, after four years of German rulings and demand letters about these fonts.

A crawler that provokes the transfer suffers no damage

The GDPR pays compensation to "any person who has suffered material or non-material damage as a result of an infringement" 2. Damage is a separate condition from the breach, and it is never presumed. The damage the Court has recognised in earlier cases is losing control of your data or a reasonable fear that it will be misused. A person who sends their own IP address to Google on purpose, with software, thousands of times, has lost control of nothing, because the data went exactly where they planned 1. So Szpunar's proposed answer is that no non-material damage can be recognised where someone "knowingly provoked a breach, in an automated and repeated manner, in order to obtain compensation" (my translation). If the Court disagrees, he says such a claim should fail anyway as an abuse of rights 1.

Is the Advocate General's opinion the law?

No. An Advocate General advises the Court of Justice before it rules. The Court gives its judgment later, is not bound by the opinion, and can decide differently. After that, the German court applies the answer to this case.

Until the judgment, a court or a lawyer handling a similar letter can still point to the opinion as the reasoning of the Court's own adviser.

Is loading Google Fonts from Google's servers illegal?

The adviser did not say. The German court did not ask him, and the opinion does not discuss consent or any other legal basis for sending the address to Google. It also says nothing about court orders to stop, or about what a data protection regulator may do 1.

One German court has answered. In January 2022 the Munich Regional Court ordered a website operator to stop sending a visitor's IP address to Google through Google Fonts, and to pay him 100 euros 4. The visitor had not consented, and the court rejected legitimate interest because Google Fonts "can also be used without a connection to a Google server being made when the website is called up" (my translation) 4.

That is one lower-court judgment, binding on no other court, and it used a broader test for personal data than Szpunar does 4. In my reading its result still stands for Google, which can most likely identify the visitor, though no court has found that yet.

If your site or app loads Google Fonts, what should you do?

If you run a website or web app used by people in the EU and it loads fonts from Google, you need to serve those fonts yourself, or else every page view sends the visitor's IP address to Google, which the Munich court held unlawful without consent.

1. Check what your pages request. Open your site in a private window with the browser's network tab open, filter for fonts.googleapis.com and fonts.gstatic.com, and repeat on the logged-in app, the docs and the blog. Templates and third-party widgets add their own font links.
2. Self-host the fonts. The fonts in Google's font collection on GitHub are under licences that allow redistribution, so you can download the files, serve them from your own domain and delete the link to Google. In Next.js, next/font self-hosts any Google Font so the browser sends no request to Google. For other stacks, Fontsource packages open-source fonts as npm packages for self-hosting. Loading Google's copy only after consent would also work, but every visitor who has not clicked yet would see your pages in a fallback font.
3. Check your other Google embeds. Maps, video embeds and reCAPTCHA also make the browser contact Google. Any of them that stores or reads information on the visitor's device needs consent unless it is strictly necessary for something the visitor asked for 5. Where you can, load an embed only when the visitor clicks to open it, and name Google in your Privacy Policy for the ones you keep.
4. Do not pay a demand letter about Google Fonts by reflex. Ask whether the visit came from a real person, and take legal advice: the opinion supports refusing payment for crawler-made claims, but until the Court rules it is advice. Remove the Google request either way.

Font links come back quietly: a new page template, a widget or a pasted snippet can add one in a pull request months after you removed the last. Lawcel, the tool we build, reads each pull request and flags changes that affect a company's legal documents, such as a new third party receiving visitor data.