German Court Rules Websites Embedding Google Fonts Violates GDPR

A regi­o­nal court in the German city of Munich has orde­red a website opera­tor to pay €100 in dama­ges for trans­fer­ring a user’s perso­nal data — i.e., IP address — to Google via the search giant’s Fonts library without the indi­vi­du­al’s consent.

The unaut­ho­ri­zed disclo­sure of the plain­tiff’s IP address by the unna­med website to Google cons­ti­tu­tes a contra­ven­tion of the user’s privacy rights, the court said, adding the website opera­tor could theo­re­ti­cally combine the gathe­red infor­ma­tion with other third-party data to iden­tify the «persons behind the IP address.»

The viola­tion amounts to the «plain­tiff’s loss of control over a perso­nal data to Google, » the ruling read.

Google Fonts is a font embed­ding service library from Google, allo­wing deve­lo­pers to add fonts to their Android apps and websi­tes simply by refe­ren­cing a styles­heet. As of Janu­ary 2022, Google Fonts is a repo­si­tory for 1,358 font fami­lies.

Under the Euro­pean Union’s Gene­ral Data Protec­tion Regu­la­tion (GDPR), data points such as IP addres­ses, adver­ti­sing IDs, and cookies are coun­ted as perso­nal iden­ti­fi­a­ble infor­ma­tion (PII), making it manda­tory for busi­nes­ses opera­ting in the country to seek users’ expli­cit permis­sion before proces­sing such infor­ma­tion.

In addi­tion, the court noted that «Google Fonts can also be used by the defen­dant without a connec­tion to a Google server is esta­blis­hed and the IP address of the website user is trans­mit­ted to Google, » effec­ti­vely requi­ring websi­tes to host the fonts locally.

Aside from orde­ring the website to stop disclo­sing the IP address by embed­ding the font library, the court also urged the company running the website to share with the affec­ted party infor­ma­tion about the kind of perso­nal data that it stores and is being proces­sed.

The deci­sion comes weeks after the Austrian Data Protec­tion Autho­rity (DSB) ruled that the use of Google Analy­tics by a health-focu­sed website called NetDok­tor viola­tes the GDPR regu­la­tion by expor­ting visi­tors’ data to Google servers in the U.S., thereby opening the door for poten­tial survei­llance by the U.S. inte­lli­gence servi­ces.

------—

Rela­ted: A privacy concern about Google Fonts