Is your website safe from legal action? Check it now on Google Fonts!

2. Fonts explainedbriefly

In the field of writing and printing, the English word "font" can be translated into German as either "Schrift" (typeface), "Schriftfamilie" (typeface family), "Schriftsatz" (typesetting), "Zeichen" (character) or "Zeichensatz" (character set).

Google Fonts is an interactive font directory from the US technology company Google LLC. Nearly 1,500 fonts are available to website operators free of charge. These are free software licenses that any user can use at any time, free of charge and as often as they like – without any license fees, obligations, or other commitments.

That sounds like a gift from Google – but it's not!

Google not only expects something in return, but also obtains it automatically. The deal is: if you use even one Google Font free of charge, I will also register your IP identity free of charge for my further use of Google.

At first glance, the deal sounds logical and fair — if only and exclusively the two "contractual and usage partners," Google and the website operator, were and remained involved.

But that's not the case!

The option to use Google Fonts on the website is done via direct download, i.e., without uploading, in other words, without uploading to the website operator's own server. As a result, when users visit the website, Google Fonts are automatically and routinely reloaded. – and thus, with every single external website visit, the associated data is transferred directly to Google LLC – Keyword: Every IP address goes directly to Google.

3. Google Fonts and data protection – downloading via Google istheproblem

According to current case law of the European Court of Justice (ECJ), both dynamic and static IP addresses are considered personal data – and as such, they are subject to special protection. The storage of IP data, also known as data retention, is subject to strict legal limits.

However, the transfer of personal data is even more difficult, if not impossible, without the consent of the data subject on the one hand, and without their knowledge on the other.

Personal data is any information that can be used to identify living persons. IP is the abbreviation for Internet Protocol, which is the address of the computer in question. . keyword: comparable to the house number of a residential building. A computer can be assigned several IP addresses. Conversely, it is more common for a PC and IP address to be one and the same.

In accordance with the provisions of the GDPR and the Federal Data Protection Act (BDSG), the collection, storage, and use of IP addresses are very closely linked to legal requirements.

According to the BDSG, every user of the website must be informed in advance whether and how their personal data will be collected. This makes a correspondingly formulated privacy policy necessary and indispensable.

4.Current case law –Judgmentof the Munich Regional Court from January 2022

The protection of personal data, the protection of personal rights, and, of course, the associated data protection violations have been a constant topic of discussion in society for years. This also applies to Google Fonts and, in connection with this, the increasing number of – both justified and unjustified – Google Fonts warnings.

Current case law is shaped by the relevant ruling of the Munich I Regional Court dated January 20, 2022. Under the title "Violation of personal rights through data protection breach," the guiding principle of the ruling is: "It constitutes a violation of the right to informational self-determination and personal rights if the owner of a website automatically forwards the dynamic IP address of a third party to Google when that third party visits the website, without the third party's consent."

That is clear and unambiguous in its meaning!

The legal basis for this ruling is, in the broadest sense, Section 823 of the German Civil Code (BGB). Accordingly, the unauthorized disclosure of the user's dynamic IP address to Google LLC constitutes a violation of the general right of personality, namely in the form of the informal right of self-determination of the person using the website. This right to informal self-determination also includes the right to determine the use, disclosure, and reuse of personal data such as the IP address.

When the website is accessed, the IP address of the person accessing it is automatically forwarded to Google. This breach of data protection is attributed to the website operator, or in other words, charged to them, because and as long as the user does not consent to the forwarding or has not given their prior consent. And – there is no obligation on the part of the user to encrypt their IP address in advance.

Further legal bases for the ruling and the resulting consequences are Section 12 (1) and (2) BDSG, Section 3 (1) BDSG, and Article 4 (1) of the General Data Protection Regulation (GDPR).

5. Integration ofGoogle Fonts and warnings–dynamic vs. local

Dynamic integration of Google Fonts, in other words, automated integration, is activated when the server connection to Google Fonts is established. The selected font is provided through the connection to the Google server. The IP address is transmitted as personal data immediately during the establishment of the connection. The alternative term for dynamic is remote integration.

Integrating Google Fonts locally means hosting the selected Google Font on your own server. From there, the Google Font is loaded when the homepage is accessed. – there is no forwarding of the IP address to any third parties.

In short: The website you visit is both the beginning and the end – there is no further access. No one else is involved, no outsider has access.

6. Received a warning letter from Google Fonts –whatto do

The Google Fonts warning letter addresses two issues, namely

• the Google Fonts themselves
• The legal process for the Google Fonts warning letter

In order to make the website legally compliant with regard to the continued use of Google Fonts, the fonts must be integrated locally via the company's own server in the future instead of dynamically as before.

A Google Fonts warning letter is not something to be taken lightly. The recipient should not ignore it, but rather respond to it. It is advisable to seek legal advice and, if necessary, legal representation by a lawyer, ideally a specialist in IT law.

In many cases, there is cooperation between the law firm and a system house as an IT company. This ensures that, following a Google Fonts warning letter, the website becomes completely legally compliant.

7. Conclusion –integratingGoogle Fontslocallymakesthe website legally compliant

• In summary, it should be noted that, according to the applicable case law of the Munich Regional Court, Google Fonts warnings are justified in the case of dynamic fonts.
• If this dynamic is interrupted by hosting on your own server and this is also pointed out in the data protection provisions, then the website can be described as absolutely legally compliant.