Google Fonts: Violation of the GDPR?

Many website operators take their breath away. The reason is the receipt of a warning. The website operators are said to have violated the GDPR and are being asked to pay an amount between €100 and €500. But what is behind it and are the warnings justified?

The reason for the warnings is the embedding of Google Fonts in the websites. Embedding the free Google Fonts is said to be an illegal encroachment on general personal rights and a violation of the GDPR. The offense of the website operators is the use of the free fonts offered by Google.

Google Fonts is a directory of hundreds of different and freely usable fonts. The fonts can be downloaded from the operator of the website and stored on their own local server. Some website operators opted for the second option, embedding the fonts online. In this case, the fonts are downloaded from the Google server when the browser visits a website. And that’s exactly the problem.

Judgment of the district court Munich

In January 2022, the District Court of Munich the use of Google Fonts is prohibited. The court justified the decision with the fact that unauthorized personal data is transmitted to Google and thus to the USA.

According to the court, the transmitted dynamic IP addresses are personal data that fall within the scope of protection of the GDPR. By transmitting the IP address, the website operator violated the right to informational self-determination of website visitors. There is no consent from the visitor or a legitimate interest from the operator. There is therefore no legal basis for the transfer.

With this reasoning by the court, the plaintiff is entitled to an injunctive relief and a claim for damages. The claim for damages can be justified with Art. 82 GDPR. However, it is questionable what intensity an intervention must have in order to justify a claim for damages.

justification for the warning

The court came to the decision that the data subject lost control of his data as a result of the transmission. In addition, the transmission to Google and thus to the USA is problematic. Because Google is known for collecting data about users. Furthermore, there is no adequate level of data protection in the USA.

These are the arguments of the authors of the letters to the website operators. By using it, the operator is said to have tried to make the author feel uncomfortable. The letter asks for the payment of damages in the amount of €100.

But there is not always an individual behind the letter. Some law firms have discovered a business area in the mass warnings. The law firms are not only asking for the payment of damages to the clients. The recipients of the warnings should sign a cease-and-desist declaration for the use of Google Fonts and assume the legal fees.

After receiving a warning

Have you received a warning from a law firm and are now wondering whether you have to settle the claims? You should not act rashly, because the warnings can be abusive, because the alleged victims may have visited the websites intentionally. For this reason, if you receive such a warning, you should seek the advice of a lawyer.