Fonts: self-hosted or from Google, and why it matters for privacy
Why we serve web fonts from your own domain instead of loading them from a third party, and what that changes for privacy and speed.
The short answer
Many websites load their fonts from a third-party font service with a single line of code. That line means every visitor’s browser connects to the service on every page view and transmits the visitor’s IP address, before any cookie banner is answered. In January 2022 the Munich regional court ruled that loading Google Fonts this way without consent violated a visitor’s rights under data protection law and awarded damages, and the practice has been a compliance risk in Europe since. The fix is simple: self-host the fonts. The same font files are served from your own domain, the third-party request disappears, and the page is usually faster because the browser no longer opens an extra connection. The fonts are free to use this way under their licences; the change is a few files and a stylesheet, and we do it on every site we build.
Third-party versus self-hosted
| Aspect | Loaded from a third party | Self-hosted |
|---|---|---|
| Data sent to a third party | Visitor IP address and request details on every page | None |
| Consent | Arguably required before the request; rarely obtained | Not needed for the fonts |
| Extra connection | Yes, before text can render in the chosen font | No; served with the page |
| Caching across sites | No longer shared in modern browsers | Cached by your own headers |
| Availability | Depends on the third party | Depends on your hosting, like everything else |
| Control over versions | The service may update the font | You choose when to update |
| Cost | Free | Free; bytes on your hosting |
Doing it properly
- List the fonts and weights the site actually uses; a site uses two families and three or four weights.
- Download the files in the modern compressed format and subset them to the characters your languages need.
- Serve them from your domain with long cache lifetimes, since the files never change.
- Preload the one or two files used above the fold so text renders in the right font immediately.
- Set the display behaviour so text is visible in a fallback font while the web font loads, with a fallback chosen to match its size.
- Remove the third-party link and confirm in the browser’s network view that no request to the font service remains.
- Update the privacy statement if it mentioned the third-party service.
The wider principle
Fonts are the most visible case of a general rule: every resource loaded from a third-party domain shares visitor data with that party and adds a dependency and a connection. The default for a business site is to serve what it can from its own domain, and to justify each exception. Fonts never need to be an exception.
What this means for you
Serve your fonts from your own domain. It removes a third-party data transfer you would otherwise have to justify, it makes the page faster, and it costs nothing but an hour of setup. Then apply the same look to every other third-party request the site makes before consent, because the fonts are rarely the only one.
Frequently asked questions
Is loading fonts from Google actually illegal?
The line that loads the font makes the visitor's browser connect to the font service, and that connection carries their IP address before they have agreed to anything. An IP address is personal data under European rules, so the transfer needs a legal basis, and convenience is not one. Self-hosting avoids the question entirely, which is why it is our default.
Will self-hosted fonts be slower?
Usually faster. Loading from a third party requires the browser to open a separate connection, and shared caching across sites no longer works in modern browsers, so the old speed argument is gone. Fonts served from your own domain on an edge network, in a modern format, with the right loading settings, arrive with the page.
Do we need to check other third-party resources too?
Yes. The same logic applies to icon libraries, scripts, stylesheets, maps and embeds loaded from third-party domains: each sends the visitor's IP address and often more to that party. Fonts are the most common and the easiest to fix; the rest belong in a review of every third-party request the site makes.
Sources
- Google Fonts: Frequently asked questions (accessed 2026-09-14)