Warning notice Google Fonts: A court ruled in early 2022 that anyone using the online version of Google Fonts (a list of fonts) may be in breach of the GDPR. This is being used by an increasing number of private individuals and, more worryingly, by warning law firms who are flooding website operators with demands for damages.

Is this legally correct? And how should victims respond?

Have you received a lawyer’s letter for using Google Web Fonts?

In recent months, we have observed an increasing trend of private individuals calling in lawyers to deal with notices or requests for information after they have discovered an alleged violation of their privacy.

For the past few weeks, a flood of letters from various private individuals has been circulating, all claiming that the recipient’s use of Google Fonts constitutes an invasion of their privacy and therefore an illegal transfer of data.

Now that lawyer-written disclaimers on the same subject are doing the rounds, a new dynamic is at play. In Germany alone, there are an estimated 18 million websites with a .de extension. Many of them use Google Fonts.

A precedent from this year suggests that the use of these Google services without visitors’ prior consent is a violation of their privacy.

Warning notice Google Fonts: The court ruled that the website operator must cease operations, hand over relevant information and pay damages for emotional distress (Landgericht (LG) München, Urt. v. 20.01.2022, ref. 3 O 17493/20). Some private individuals rely on this judgement to file their own warning letters with a large number of companies. There, too, a claim of 100 euros is asserted.

“Google Fonts” – what exactly is meant by this?

Google Fonts is an online directory that contains many different fonts. Google LLC has made the index available to the public since 2010. It already contains more than a thousand unique fonts that website owners can use on their own websites.

Useful licences are provided free of charge. The use of “Google Fonts” is so widespread among webmasters due to its ease of use and wide availability that it can be found on virtually every website. There are two different applications here:

  1. As a way of using “Google Fonts”, Google LLC offers a “dynamic” variant. In this case, the selected font is not contextualised in a specific language. Instead, a connection to Google’s servers is established each time the website is called up in order to retrieve and display the font. A person’s IP address is sent to Google’s servers as soon as a connection is established with a website hosted by Google.
  2. On the other hand, the administrator of a website can download a font for personal use and then upload it to their own server. Since the font is only embedded locally in the website, it is loaded from its own storage space every time the page is accessed.

What makes the use of Google Fonts legally difficult?

Warning notice Google Fonts: The use of Google (web) Fonts has been the subject of both complaints and criticism. Google provides website operators with a free font library and typographic components to ensure that their websites look good on all devices.

Many website owners use Google Fonts, whether their website is for presentation purposes only or is an e-commerce platform. Website owners are often unaware of the existence of this service, as it is ‘enabled’ by the web designer or web agency in charge.

Warning letter Google Fonts: Since June 2022, many individuals in Germany have sent hundreds, if not thousands, of letters to website and shop owners claiming to be victims of a data protection breach.

The reason for this is the fact that the IP address of the author was transmitted to Google through the dynamic integration of Google Fonts without the author’s knowledge and consent.

IP addresses are considered private information, the disclosure of which to third parties without consent is illegal and can lead to claims for damages on the part of the website visitors concerned and the author of the letter.

In this context, reference is made to the decision of the LG München I of 20 January 2022 (Ref.: 3 O 17493/20), in which the court awarded 100 euros in compensation for pain and suffering to a plaintiff who had suffered damage due to the unlawful collection of his IP address by Google.

The letters are almost all written in the same way and lead to the same basic demand: they should pay 100 euros to compensate for the damage they caused. The written communication usually assumes that the case is closed with the receipt of the demanded payment.

The submission of a “declaration of commitment” is only rarely demanded. Although in many cases these private written complaints did not have serious consequences if left unchecked, new unease has arisen due to the sloppy and overly flowery wording.

Warning notice Google Fonts: Lawyer from Austria issues warning letter

Several letters from a lawyer from Groß-Enzersdorf, Austria, have already been delivered. The Austrian lawyer claimed in one letter that his client had been the victim of a “Google Fonts Privacy Violation”.

The IP address of the recipient’s website visitor had been transmitted to “a company of the US-American “Alphabet Inc.” group (“Google”) without the recipient’s consent. This gives the data subject justified claims for deletion, damages, reimbursement of legal fees and information about the data processing.

The letter concludes with a settlement offer to resolve the matter in its entirety “in light of the somewhat differentiated case law in this area”. If the sum of 190 euros (consisting of 100 euros in damages and 90 euros in lawyer’s fees) is transferred to the account of the dismissing lawyer within 14 days, the claim will be dismissed.

Neither the acquitted party nor the acquitting party’s lawyer felt it necessary to confirm the conclusion of the settlement in writing. The lawyer also shows on his website alleged samples of lawsuits he has filed in similar cases.

When Google fonts are dynamically embedded in a website, the visitor’s IP address is sent to Google to retrieve the fonts, which some might consider an invasion of privacy. In that case, the broker should avoid getting involved in litigation.

In any case, the cease-and-desist letters from Austria are somewhat opaque, and it is not certain whether this country will also join the proceedings. There seems to be a large number of cases in this area of law, so it is difficult for a single lawyer to pursue all of them.

As an additional economic burden, the warning party had to bear the risks associated with the lengthy legal costs.

Legal framework for data protection concerns

The Google Fonts decision does not set a precedent with respect to existing data protection laws. The objectives of data protection law are generally as follows: To ensure that personal data can be freely exchanged between countries without interference from governments.

This includes ensuring that people’s right to privacy in the processing of their personal data and their right to freedom of expression in the use of that data are protected. Everyone has the right to decide for themselves the extent to which they are willing to disclose their personal data.

Personal data is any data which can be used to identify the person behind it, or which at least enables that person to be identified.

Persons are identifiable if they are “directly or indirectly identified, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person” (Article 4(1) of the EU General Data Protection Regulation, or GDPR).

The GDPR uses a so-called “prohibition with an exception for permitted uses” to ensure adequate protection. This means that it is illegal to do anything with a person’s personal data unless there is a specific legal provision that makes this type of processing legal.

Article 6 of the GDPR sets out the specific legal grounds for justifying the authorisation of certain measures. Examples include processing of personal data for compliance with a contractual obligation, processing in pursuit of a legitimate interest which can be demonstrated, or processing with the explicit consent of the data subject.

Personal data may only be processed if such a legitimate basis exists. Any action taken in relation to personal data shall be deemed to be processing, including collection, transmission, disclosure, storage and erasure. Warning notice Google Fonts: So many web hosts are being warned on the basis of this.

Dangers of using Google Fonts

Although it may be tempting to take advantage of the ruling of the LG Munich I and use a variety of fonts free of charge, website operators should be aware that this may be a burden under the law.

The lower court upheld the plaintiff in its entirety: The website operator was prohibited from disclosing the plaintiff’s IP address to Google when the plaintiff requested a certain font that was only available as “Google Fonts”.

In the event of a challenge to this release, a fine of up to 250,000 euros was threatened. In the event of non-payment, a six-month enforcement order could be issued. Secondly, he was granted a request to inspect the files of the website operator.

The latter must disclose whether the personal data of the data subject are processed or not. In addition, the website operator must disclose, upon request, what specific personal data are stored about the plaintiff. Thirdly, the plaintiff also has a right to compensation for his emotional distress.

The court held that the disclosure of the plaintiff’s IP address to Google and the resulting loss of control justified the award of non-monetary damages.

“The associated interference with the general right of personality is indescribable in view of the plaintiff’s loss of control over a personal data to Google, a company that notoriously collects data on its users, and the resulting injury to the plaintiff,” the court wrote.

Warning notice as a source of money?

Private individuals and, more recently, warning law firms like brandt.legal have taken advantage of this ruling. They scour the internet for websites that use dynamically adapted “Google Fonts” and visit such websites.

They tell the website operators that they noticed the use of Google Fonts during their visit and that the fact that Google can track your IP address annoys them greatly. They demand that the Google Fonts be removed from the websites, citing a ruling by the Munich I Regional Court.

They also want to know what was done with their data and whether it was stored or not. As a further incentive, they hope to receive immaterial damages of 100 euros. They have set a deadline for the website owners and threatened to sue them if they do not pay.

The more website owners come forward, the more advantageous this could be for the abnegators. It is possible that some website owners will be too quick to give in to these demands because of the cited ruling and the possibility that they have actually committed a breach of data protection.

It seems that law firms also want to support the flood of warning letters. They make the same claims on behalf of their clients and want their fees to be recognised as well. They also demand that website owners sign a declaration of commitment.

Have you also received a warning notice because of the unauthorised use of Google Fonts?

Claims for damages for pain and suffering due to an alleged violation of the right of personality have been on everyone’s lips since the ruling of the LG Munich of 21 January 2022, which assumed a violation of privacy in a similar case. We had initially advised interested parties to refrain from writing to private individuals.

In the specific case, the focus was on the pursuit of possible “damages for pain and suffering”. Nevertheless, if one has retained a lawyer, as in this case, one should always seek the advice of an experienced lawyer. For example, it is important to look at each case on its own merits to determine whether there has actually been an invasion of privacy.

The often cited Munich decision is often used in this context as if it were binding everywhere. It must be examined in each individual case whether or not there is actually a violation of the rights of the alleged victim.

What can I do now as a web agency or company?

We can assume that hundreds, if not thousands, of termination letters are currently circulating in connection with Google Fonts. Warning Notice Google Fonts?

So if you have integrated Google Fonts for your client but have not insisted on a strictly local integration, it is possible that the problem will show up on their websites or in the projects you have worked on.

If you find that your clients are using a dynamic Google Fonts integration, you should immediately alert them to the problem and ask them to switch to a local implementation of the fonts. If you don’t already know, you should learn the basics to avoid further embarrassment and damage.

You can also take this opportunity to point out to your clients that a website data policy that complies with EU regulations on data protection and data security is essential. Talk to us about working together if you are an agency or web designer interested in legally protecting your clients. We would be happy to hear from you.

Have you received a warning about Google Fonts?

Warning letter Google Fonts: If you have received such a demand letter, we would like to help you. For this purpose, we offer a free initial consultation. Contact our team of lawyers and describe your situation. The Herfurtner law firm represents clients across the country and throughout the German-speaking world.