Edip Kilinc is the founder of Webwavers. Together with his team, he develops websites, brands, and digital presences for ambitious companies – with over 250 completed projects, and honored with awards including the German Design Award 2026.
If Google Fonts are loaded from the provider's servers, the visitor's IP address is transmitted when the page is accessed. A regional court in Munich ruled in 2022 that this constitutes an infringement of personal rights without consent and awarded damages.
The ruling was followed by a wave of warning letters, many of which were questionable. The legal assessment in individual cases is still not uniform to this day – but the dispute can be completely avoided.
The solution: Integrate fonts locally. Download the files, place them on your own server, and integrate them via CSS. No external request, no IP transmission, no consent required.
This takes about fifteen minutes and has two side effects: the page becomes faster because an external connection is eliminated, and the fonts load more reliably.
The same applies to other external resources that are silently loaded in the background – icon libraries, JavaScript libraries from external servers, embedded maps.
If Google Fonts are loaded from the provider's servers, the visitor's IP address is transmitted when the page is accessed. A regional court in Munich ruled in 2022 that this constitutes an infringement of personal rights without consent and awarded damages.
The ruling was followed by a wave of warning letters, many of which were questionable. The legal assessment in individual cases is still not uniform to this day – but the dispute can be completely avoided.
The solution: Integrate fonts locally. Download the files, place them on your own server, and integrate them via CSS. No external request, no IP transmission, no consent required.
This takes about fifteen minutes and has two side effects: the page becomes faster because an external connection is eliminated, and the fonts load more reliably.
The same applies to other external resources that are silently loaded in the background – icon libraries, JavaScript libraries from external servers, embedded maps.
Two levels apply to analysis tools.
Consent. Analytics accesses the terminal device and is not technically necessary. According to Section 25 TDDDG, consent is required – regardless of all questions regarding data transfer.
Data transfer to the USA. Since July 2023, the EU-US Data Privacy Framework has been the basis here: an adequacy decision by the Commission on which certified US providers could rely.
This framework is now under significant legal pressure. A June 2026 decision by the US Supreme Court on the independence of the Federal Trade Commission has called into question a supporting pillar of the agreement. What happens next – review by the Commission, proceedings before the ECJ, or an amendment – remains open.
What this means in practice: Anyone using US services should check the current status before relying on the framework, and at least be aware of alternatives. A resilient assessment for individual cases belongs to a specialist lawyer – this article does not constitute legal advice.
For reach measurement, there are providers with servers in the EU, partly without access to the terminal device and thus without any consent requirement.
What such tools deliver: Page views, visitor numbers, referral sources, devices, countries, most popular pages, bounce behavior. For the vast majority of corporate websites, this completely covers their needs.
What they do not deliver: Cross-device user tracking, linking to advertising accounts, highly granular target group analysis. Anyone running extensive paid campaigns will reach their limits with this.
The side effect that is often overlooked: Without the consent requirement, all visitors are counted, not just those who have agreed. With rejection rates in the double-digit range, the numbers are more complete – and therefore more useful than incomplete statistics with more features.
The transition typically takes half a day, including importing the most important key performance indicators as comparison values.
Analytics and fonts are the best-known cases. On a typical company website, there are several more.
Embedded videos. These load data when the page is called up, even if nobody plays them. Solution: a preview image, load the video only after a click.
Map services. The same principle. On a contact page, an image with a link to route planning is often sufficient.
Icon and script libraries from external servers. Integrate locally, just like fonts.
Chat and scheduling tools. Check where the servers are located and whether they only load after consent has been given.
Social media integrations. A link instead of an embed solves the problem and is usually faster too.
The test: Open the developer tools in the browser, go to the Network tab, reload the page and look at the list of domains called up – before any consent. Everything that appears there and is not your own domain needs to be checked.
1. Stocktaking. Network analysis for all page types: homepage, service page, blog post, contact page. List of all external domains.
2. Localize fonts. The fastest point with the best effort-to-impact ratio.
3. Move everything that loads before consent. The most common and serious finding. Nothing must be loaded before consent, except for what is technically necessary.
4. Remove what is not needed. Forgotten tools, duplicate statistical services, old tracking codes from campaigns. On many websites, there is more of this than expected.
5. Replace embeds. Switch videos and maps to click-to-load.
6. Check statistics. Do you need the functions for which you are accepting legal uncertainty?
7. Adjust privacy policy. It must match what the site actually does – mentioning services you do not use is just as wrong as concealing ones you do.
Legal assessments change. Rulings are made, adequacy decisions falter, supervisory authorities change their assessments. Anyone who builds their website along the current legal situation is constantly rebuilding.
There is a benchmark that is more stable: How many external services does your website call?
Every service is a dependency – legally, technically, and in loading time. A website with three external connections has three risks. One with thirty has thirty, most of which no one is aware of.
The practical consequence is unspectacular: Pause for a minute with every new tool and ask whether the benefit is worth the dependency. For most chat windows, review widgets, and analytics add-ons, the answer is no.
This is not a legal strategy, but a technical one. However, it is more reliable than any adaptation to the most recent decision.
