Is using Google Fonts illegal?

No. The fonts themselves are open source and free to use. The problem the Munich court identified is loading them from Google's servers, which sends the visitor's IP address to Google. Hosting the same fonts on your own server avoids it.

Do I need a cookie banner for Google Fonts?

No. Google Fonts sets no cookies, so there is nothing to ask consent for. The fix is to host the fonts yourself, not to put them behind a banner.

Does next/font/google send data to Google?

No. next/font downloads the font files at build time and serves them from your own domain, so visitors' browsers never contact Google for them.

I received a warning letter about Google Fonts. Should I pay?

Get legal advice before paying anything. Many of the 2022 letters were part of mass campaigns that German prosecutors investigated for fraud and extortion. Either way, move the fonts to your own server so the question does not come up again.

Is Google Fonts GDPR Compliant? The Munich Ruling and How to Fix It

Google Fonts is on millions of websites, usually because a theme or template added it without anyone deciding to. It is free, it looks good, and it sets no cookies. So why does it come up in every GDPR discussion?

Because of where the files come from. When a page loads a font from fonts.googleapis.com, the visitor's browser asks Google's servers for it, and every request carries the visitor's IP address. Under GDPR an IP address is personal data. The short version of this post: Google Fonts is fine, loading it from Google is the problem, and the fix takes about ten minutes.

What did the Munich court decide?

In January 2022 the Regional Court of Munich (LG München I) ruled against a website owner whose site loaded Google Fonts from Google's servers. The court found that passing the visitor's IP address to Google had no legal basis. The site owner had no legitimate interest in doing so, because the same fonts could have been hosted on the site's own server without contacting Google at all. The court ordered the owner to stop and to pay the visitor 100 euros in damages.

It is one German regional court, not a ruling from the EU's highest court. But the reasoning is simple and has been repeated since: if you can avoid sending personal data to a third party at no real cost, you should.

The warning letter wave that followed

Later in 2022 thousands of German website owners received letters demanding a few hundred euros to settle a Google Fonts "violation". Many of those letters came from people who had visited sites automatically just to collect claims. In December 2022 Berlin prosecutors searched the offices of a lawyer behind one of the largest campaigns on suspicion of attempted fraud and extortion.

So the risk was partly manufactured. The underlying point still stands, though, and fixing it is easier than arguing about it.

Does Google Fonts need cookie consent?

No. Google Fonts sets no cookies, so there is nothing for a cookie banner to ask about, and putting fonts behind consent would leave visitors who decline with broken typography. Consent is the wrong tool here. The right tool is to stop sending the IP address to Google in the first place, by serving the font files from your own domain.

How do I check if my site loads Google Fonts?

Two ways:

In the browser. Open your site, open developer tools, go to the Network tab and reload. Filter on fonts.g. Any request to fonts.googleapis.com or fonts.gstatic.com means the fonts come from Google.
With a scan. The free GDPR scan now flags Google Fonts as its own finding, separate from trackers, with the fix next to it.

Check more than the front page. Plugins, embedded maps and some page builders pull in Google Fonts on their own.

How to host Google Fonts yourself

WordPress

Many themes have a setting to load Google Fonts locally, so look in the theme options first. If yours does not, a plugin such as OMGF (Optimize My Google Fonts) downloads the fonts the site uses and rewrites the links to your own server. Afterwards, check that no plugin still loads its own copy from Google.

Webflow

Fonts added under Site settings, Fonts, Google Fonts are loaded from Google. Download the font files instead, upload them under Custom fonts in the same place, switch your styles to the uploaded fonts, and then remove the Google Fonts entries.

Next.js

Use next/font. Even next/font/google downloads the files when the site is built and serves them from your own domain, so the browser never contacts Google. Remove any <link> to fonts.googleapis.com that is still in the layout.

Plain HTML, React and sites built with AI

Install the fonts from npm with the @fontsource packages, or download the files and reference them with @font-face in your CSS. Then remove the <link> and preconnect tags pointing to Google. If an AI tool like Lovable built the site, ask it to do exactly that. We have the prompt in our Lovable guide.

Are other fonts and CDNs a problem too?

The same reasoning applies to anything loaded from a third-party server that you could just as well host yourself: icon fonts from a CDN, JavaScript libraries from a public CDN, Adobe Fonts. Google Fonts gets the attention because it is everywhere and because of the Munich case. If you are moving fonts anyway, it is a good moment to look at the rest of the list in your Network tab.

Our Google Fonts entry in the tracker database has the short version.