Here’s something most beginner web developers never think about: when your site tells a visitor’s browser to go grab a font from Google’s servers, that request carries the visitor’s IP address with it. Google sees it. Not you — Google. And your visitor never agreed to that.
A German court actually fined a website owner over exactly this. The ruling found that by loading a Google-hosted font, the site passed a visitor’s IP address to Google without authorization and without a legitimate reason. That’s not a technicality — that’s a real privacy violation under Europe’s GDPR rules. (The fine in that specific case was 100 euros, but the legal precedent it sets matters more than the dollar amount.)
The tricky part? Getting meaningful consent beforehand is extremely difficult in practice. The IP address gets sent the moment the page starts loading — before any cookie banner or consent popup can appear. Technically blocking fonts until consent is granted is possible, but it’s complex to implement and rarely done correctly.
The fix is simpler than it sounds. Download the font files and host them on your own server. That way, no visitor data ever touches Google’s infrastructure. The WordPress team addressed this directly after the court ruling, pushing developers to self-host fonts instead of pulling them from Google’s CDN.
This is primarily a legal issue if your site has visitors from the European Union — GDPR is an EU regulation, not a US one. But privacy expectations are tightening globally, and many US states are also developing stronger privacy laws. If you’re building something real — a portfolio, a small business site, anything with actual users — self-hosting your fonts is a genuinely simple habit that keeps you out of trouble.