Skip to content

Compliance

Is loading Google Fonts from the CDN a GDPR problem

Loading fonts from Google's CDN at request time transmits every visitor's IP address to Google. A German court (LG München I, 3 O 17493/20) awarded damages for exactly this, and it triggered a wave of demand letters. Self-hosting the files removes the transfer entirely, is a one-line change in most frameworks, and is also faster.

What 13x checks

This is rule compliance.google-fonts-cdn in the public registry: No fonts loaded from Google's CDN. It runs on every audit, against the pages we actually fetched, and its result is derived from the response rather than estimated.

Surface
Compliance
Score weight
10 of the readiness score
Scope
Runs on every audited page
Applies
Only where the market or the page shape makes it relevant

Registry version 2026-07-30. Every rule is published, and the audit is deterministic — the same page produces the same finding every time.

The fix

The same text the audit hands you when this check fails on your own site.

Self-host the font files. Loading them from Google's CDN sends every visitor's IP address to Google on every page view.

Download the font, put the files in your project, and declare them locally:

css code
/* Remove: @import url("https://fonts.googleapis.com/css2?family=Inter"); */

@font-face {
  font-family: "Inter";
  src: url("/fonts/inter-latin-400.woff2") format("woff2");
  font-weight: 400;
  font-display: swap;
}

Also remove any <link> to fonts.googleapis.com or fonts.gstatic.com and the preconnect hints that usually accompany them. Self-hosting is also faster: it removes a DNS lookup, a TLS handshake and a round trip from your critical path.

Framework-specific versions

Where the change differs enough to be worth writing out separately.

Does your site have this problem?

13x checks this and 112 others against your live URL in about 30 seconds. No account, and every finding comes with the fix for your framework.

No signup. Results in 30 seconds.

More compliance checks