Google Fonts and GDPR: 50,000 German Sites Checked

Plenty of websites pull their typeface from Google Fonts. It’s convenient and free, but it has a catch: on every visit, your visitor’s IP address ends up at Google. In January 2022, a German court (Landgericht München I) ruled that a website embedding Google Fonts this way transfers a visitor’s IP address to Google without a legal basis. A wave of warning letters followed (Germany calls these “Abmahnungen”, cease-and-desist letters that come with a bill attached), and plenty of businesses had their sites rebuilt.

I wanted to know how much of that actually stuck. So I counted: 50,000 randomly selected websites belonging to German businesses, each checked individually. Nothing estimated, nothing extrapolated.

Short version: 18.7% of the reachable sites still load their fonts from Google. That’s almost one in five. You can check whether your own site is one of them in a few seconds, without signing up, using my Google Fonts Checker (in German, works on any site).

Honestly, I expected this to mostly hit small businesses. Large companies with their own legal department, I assumed, would have sorted this out long ago. So for comparison I also checked 706 large German companies: DAX and MDAX corporations, plus insurers, banks, carmakers and chemical firms. There, it’s 10.1%, roughly one in ten.

The gap is real. It’s just much smaller than I expected. Four and a half years after the ruling, one in ten major corporate websites in Germany is still loading its fonts from Google.

1. Google Fonts by the numbers: 18.7% still load from Google

Quickly, without the jargon. Google offers a large selection of fonts for free. Many website builders and design templates fetch these fonts directly from Google’s servers on every page load. To do that, your visitor’s browser has to ask Google, and the moment it does, Google knows that visitor’s IP address. The alternative is simple: the font files sit on your own web space, just like your images. Then Google never sees any of it.

Here’s how the count worked out:

• Of 50,000 addresses, 38,065 were reachable.
• Of those, 26,248 gave a clear result. 6,722 of those sites load fonts from Google.
• For 11,817 sites, the check couldn’t say for certain whether Google Fonts were involved.

Simply dropping the unclear sites would have been convenient. But the resulting rate would have been too high, because those unclear sites contain noticeably fewer Google users than the rest. I measured this properly and accounted for it (the details are further down, for anyone who wants to check my working). What comes out is 18.7%.

I did the same calculation for the large companies: 706 checked, 540 of those reachable, result 10.1%.

Which industries are hit hardest

More interesting than the headline number is the breakdown by industry.

A note on reading this table: I’m only counting sites with an unambiguous result here, so the industries compare fairly. That means the right comparison figure isn’t the overall 18.7% from above, but 25.6%, which is the share among all clearly-checked sites.

Among restaurants, 32.4% of sites load their font from Google; among pharmacies, only 13.8% do. That’s a gap of 19 percentage points. It has nothing to do with chance, and nothing to do with carelessness either. It comes down almost entirely to which website builder or design template a business used, and how recently anyone touched it.

The font I found most often, by the way, is Open Sans, with 1,627 hits.

2. Why the font is often still loading from Google even after a rebuild

Even more revealing than whether is how. In total I found 10,276 references to Google Fonts, and some sites had several. Here’s how they break down:

• Fully embedded stylesheet, the classic case: 3,983 (39%)
• A hint in the page’s head that has the browser reach out to Google in advance: 3,277 (32%)
• A Google reference somewhere else in the page’s code: 1,621 (16%)
• A reference inside one of the site’s stylesheet files: 914 (9%)
• The font file itself loading directly from Google: 481 (5%)

So only 39% are the classic, complete case. The rest are mostly leftovers. Often it’s a hint in the page head that nobody removed during a rebuild. Sometimes it’s an old stylesheet (the file that defines a site’s colors and fonts) that no one touches anymore, or a piece of the design template that simply stayed in. From the outside, the site looks rebuilt. In the background, the request to Google keeps going out regardless.

A fair objection: is that kind of hint even a problem if no font from Google ends up loading afterward? With what’s called a preconnect hint, the browser still opens the connection to Google, and that alone hands Google your visitor’s IP address. Whether that carries the same legal weight as a full font request, I can’t judge. That’s why I’m showing the breakdown openly here instead of burying it in fine print. You should be able to see which case applies to you.

3. What to do about it now

If your industry sits near the top of that table, it’s worth a closer look at your own site. The fix is short and costs nothing but about an hour of work. If you don’t maintain your own website, just forward these steps to whoever does.

1. Check. Enter your homepage into the Google Fonts Checker (in German, but works on any URL). If it finds something, it also shows you where the reference sits: directly in the page’s code, or in a stylesheet file.
2. Download the fonts. Only the weights your site actually uses. Two to four files are almost always enough. You don’t need the entire font family in nine weights.
3. Put them on your own web space. The files move to your own domain, and the site now points there instead of Google. For whoever implements this: replace the Google import with your own @font-face rules.
4. Delete the old Google reference. This is where the most common mistake happens. The self-hosted font gets added, but the old call stays in the design template. Then the site keeps loading from Google anyway.
5. Check again. The most thorough way to do this is right in the browser: right-click the page, choose “Inspect”, open the “Network” tab, and filter for “fonts.g”. Reload the page. No hit means you’re done.

On WordPress, the Google call usually sits in the theme or in a page builder, not in a file you edited yourself. There are plugins that pull fonts onto your own web space and handle the rebuild for you. Check again afterward regardless. If the call comes from an image slider or a form add-on, plugins don’t always catch it.

A cookie banner doesn’t solve this, by the way. It would have to reliably block the font until someone consents. If a visitor declines, the font then visibly swaps mid-page. Fonts on your own web space are the more robust route.

For the technically curious: how I measured this

Feel free to skip this part. It’s for anyone who wants to check my numbers. The method is deliberately unglamorous, so that checking is actually possible. All the numbers are also available as an open dataset with CSV and JSON downloads (in German), for citing and further analysis.

• Where the addresses came from: OpenStreetMap, the free online map. It lists 350,146 German businesses with their own website: restaurants, doctors’ practices, trades businesses, law firms, hotels, workshops, hair salons, pharmacies and many more. No corporations, no hand-picked selection, no list built from search results.
• Sample: From that pool, I drew 50,000 addresses at random.
• Checking method: each site was fetched once from my own server, not in a normal browser. I checked the page’s code (HTML) and up to 20 linked stylesheet files, even when those sit on someone else’s server. I searched for references to Google Fonts’ two addresses, fonts.googleapis.com and fonts.gstatic.com.
• Not reachable: 11,935 addresses weren’t reachable. Those drop out, since no one can assess them.
• Unclear: 11,817 sites gave no unambiguous picture. I didn’t drop those, I measured them separately.
• What the check doesn’t see: content loaded later via JavaScript, subpages, login areas, and anything that only happens after a choice in the cookie banner. So the rate should read as a floor rather than an exaggeration.

Why the unclear cases can’t just be dropped. The check flags “loads from Google” as soon as it finds a reference anywhere, often already in the HTML. So sites that do use Google Fonts are mostly decided immediately. What stays unclear is mainly sites with no hit where not every stylesheet file could be read. That means the unclear sites are, on average, cleaner than the rest. Drop them and you inflate the rate.

That’s not a guess, I measured it. I independently rechecked 185 of the unclear cases, with the full code and every linked stylesheet. 6 of those use Google Fonts, so 3.2% instead of the 25.6% found among the clear cases. That measured share is what feeds the unclear cases into the overall rate. I ran the same cross-check for the large companies: 4 of 175, or 2.3%.

Cross-check on the hits. I independently re-searched 50 randomly selected sites flagged “loads from Google”. All 50 were genuine hits, not a single false positive. For the large companies I checked all 48 hits: 46 confirmed, one unreachable, one unconfirmed.

On the preconnect hint. With this hint in the page head, the browser resolves Google’s address in advance and opens the encrypted connection ahead of time (DNS lookup and TLS handshake), even if no font ends up loading afterward. The second variant in this group is called dns-prefetch.

The bottom line

• 18.7% of reachable German business websites still load their fonts directly from Google. Almost one in five.
• Among large companies it’s 10.1%. The gap is real, but the 2022 wave of warning letters only partly worked even where a legal department is on staff.
• Depending on industry, the share ranges from 13.8% to 32.4%. That follows the website builder and design template used, not how careful the business is.
• Often it’s just a forgotten leftover from the last rebuild. Full, classic embedding accounts for only 39% of the references.
• Switching to self-hosted fonts is roughly an hour of work. The check itself takes ten seconds: Google Fonts Checker (in German).

Data as of September 22, 2026. I’m not a lawyer, and this article isn’t legal advice. It only shows you what’s technically happening on your site.