DSGVO – Google Fonts are not allowed, how to deactivate it

Perhaps you could explain why you believe that the EU data protection law will forbid using Google font.

Hello,
there are many websites of Lawyers with the statement to the EU-DSGVO
[Links redacted]

There are many other sites with this statement.

• This reply was modified 6 years, 8 months ago by Andrew Nevins.

@te-punkt, Rather than linking to people’s blogs (which we consider spammy), can you provide an official resource?

Hello Andrew,

here is the link to the law https://dsgvo-gesetz.de/

It is not allowed, to collect private data from your website visitors. But GoogleFonts collect the ip-adress of the visitor and sent it to there own google server.

You can read it at the dsgvo law and several lawyers websites.

Thanks for that, but do you have a more specific link? I’m not going to allow you to link to several lawyer’s websites.

On second thoughts, I’m closing this. Legal matters are not for the forums and pressuring volunteers to implement features by implication of law is not okay.

@anevins We don’t close just for discussing the law and technical details relating to it. We close for legal “threats”, when discussion is no longer productive. ??

@te-punkt I am unfamiliar with the specific details of the law in question, however it is extremely unlikely that it actually makes usage of Google Fonts by a website illegal. Anybody saying that it does is likely misinterpreting the letter of the law. Even the GDPR doesn’t go quite that far.

However, if you want to not use Google Fonts, then my recommendation would be to, you know, simply not use Google Fonts on your site. Even with this plugin, you can choose fonts that aren’t from Google Fonts. There’s no magic coding that needs to be done for you to not use a webfont, because you have a choice in what fonts you can use.

If this turns out to be a burden in some way, then I would recommend finding an alternative plugin to fit your needs better. There’s no shortage of plugins, and you can choose and use the ones that best suit your particular needs.

This plugin recently added the ability to import your own fonts as well. So you do have a few alternative options as Otto suggested as well. Cheers!

@otto42:
Anybody saying that it does is likely misinterpreting the letter of the law. Even the GDPR doesn’t go quite that far.

Sorry, that is absolutely wrong and dangerous to say!

It definitely is illegal to use Google Fonts under the DSGVO/GDPR because Google saves your IP address. This is personal data (as judged by the highest court in the EU).

So you are not allowed to use Google Fonts if you embed them from the google servers. If you embed them from your own server, everything is ok!

It would be useful to anyone reading this thread to distinguish fact from interpretation and not go off half-cocked on the wrong basis.

The purpose of the GDPR is to regulate how personal data is collected and manage by services. It does not forbid collecting any personal data at all. It only requires that the visitor be aware that the data is being collected, how it is handled and gives explicit consent to do so.

The GDPR is not yet in effect. Therefore, no court can have made any judgement about its interpretation or application. Earlier jurisprudence may, or may not, apply.

So what do we really know about Google fonts? If Google intends to make its fonts available in the EU or to EU residents, then it shall have to do so in a way that complies with GDPR. If Google will be compliant in the use of fonts, then its font service is not a blocker to compliance by its users. What is Google’s position on its compliance? Look here: https://cloud.google.com/security/gdpr/ In other words, Google claims compliance. If you do not believe Google and you are a customer, you shall have the right to audit Google.

> It would be useful to anyone reading this thread to distinguish
> fact from interpretation

Yeah! That’s absolutely right!

> It only requires that the visitor be aware that the data is
> being collected…

Yeah, that’s absolutely wrong.

The visitor has to give his consent before any data is stored, interpreted or used! And you have to check, if your visitor is a kid in one case.

You are only able to use the data from visitors in the following cases:

* The visitor gave his consent before storing anything.

* Your are legally forced to store data from visitors (using google fonts does not match this case…)

* The data is needed for the fulfillment of a contract. Visiting websites is no contract…

* The data is used by governmental facilities.

* The data is needed for protection of your legitimate interests. But attention, this does not work for data of children. So you have to get to know, if the visitor is a child first. If the visitor is not a kid, than you can use the data as part for “protection of legitimate interestes”. And I bet, using Google Webfonts is not protecting your legitimate interest.

This is a translation of the official guideline of the Austrian Chamber of Commerce. Not convinced? Look here and let it translate to you:

https://www.wko.at/service/wirtschaftsrecht-gewerberecht/EU-Datenschutz-Grundverordnung:-Grundsaetze-und-Rechtmaes.html

Read again.
I wrote, that IP-addresses are personal data. This is judged by the EU high court before. So logging IP addresses falls under the protection of the GDPR/DSGVO.

And sorry to correct you again, the GDPR has been effective for two years but will be initial enforced in May:

> It (the GDPR) was adopted on 27 April 2016.
> It becomes enforceable from 25 May 2018,
> after a two-year transition period.
> https://en.wikipedia.org/wiki/General_Data_Protection_Regulation

> Regulation (EU) 2016/679 of the European Parliament ..
> of 27 April 2016 on the protection of natural persons …
> (General Data Protection Regulation)
> https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32016R0679

Sorry, nothing on your linked page https://cloud.google.com/security/gdpr/ mentions fonts!
The Google Fonts “agreement of use” says, that Google saves and uses personal data for Google Fonts. So it’s up to you as webpage owner to do another way.

It definitely is illegal to use Google Fonts under the DSGVO/GDPR because Google saves your IP address. This is personal data (as judged by the highest court in the EU).

All websites know your IP address. That is part of being a website. It is impossible for a website to not know your IP address because that is how the web works.

Whether you “save” it or not is up to you, but the simple fact is that “using Google Fonts” is not something that is either allowed nor prohibited by EU laws. The law is not that simple nor straightforward.

Please read the laws, and understand them instead of parroting nonsensical positions. You cannot simply be compliant with these laws without understanding the meaning and reasons behind them. They do not regulate code, they regulate behavior and meaning.

The Google Fonts “agreement of use” says, that Google saves and uses personal data for Google Fonts. So it’s up to you as webpage owner to do another way.

Yes, Google saves data in various ways. That does not make it illegal for you to use Google. Using Google Fonts doesn’t make me store your data in any way. Amazing, right?

The GDPR doesn’t even make it illegal for you to save data yourself. It only requires that you do certain things with that data, and tell people about it appropriately.

If you are fearful or not-understanding of what these laws actually require, then you should read them. They’re not in complicated language, and do not require extreme lawyer-ese to understand. They also don’t say anything similar to what you seem to think they do.

Well….that’s wrong, as mentioned extensively before.
It makes a difference whether you’re knowing things or saving things.

Websites per se don’t know your IP address. Your hoster knows it. And there are many german hosters which inform their clients, that they stop server logs on your behalf. You see?

Short: You need the consent of the visitors if you want to store or work with their personal data.
Beforehand.

The GDPR is very straightforward with this. It does not allow the usage of personal data. Every usage of personal data is prohibited. Except the five cases I listed in my last comment and if there is law which enables the use of the data.

And the consent must be of one’s own free will and you must not be punished if you don’t give your consent. E.G. If you don’t give your consent you have to get the same service, in most cases. So if you say no to google fonts you have to get the homepage without google fonts. You cannot be excluded from the access of the content/website.

Regarding Google Webfonts: They say in their terms of use that they use your personal data. So as a website owner you have to get the consent of the visitor beforehand asking the visitor, if he is willing to share his personal data.

So if you say no to google fonts you have to get the homepage without google fonts. You cannot be excluded from the access of the content/website.

False. I can exclude anybody from any website I own for any reason I like. It’s my site, after all.

So I can perfectly reasonably say that if you don’t want to use Google Fonts, then you cannot use my site. And there’s nothing whatsoever illegal about that.

But you’re missing the point, really. The point is that using Google Fonts doesn’t give me any of your personal data. It might give some to Google, but that’s between you and Google, not between you and me. So the GDPR doesn’t have one word to say about “font usage” nor should it.

Don’t confuse the concept of privacy with technical issues. How you do things is less important in the eyes of the law than the reasons for doing them. The GDPR doesn’t care if you use Google Fonts or a font from anywhere else. It cares about the collection of personal data. If I am not collecting your personal data, then I can use whatever the heck I want to use to build my website. Whether Google collects your personal data through a font doesn’t make a bit of difference to me when I don’t have access to that data nor am I storing it. It doesn’t magically make it illegal for me to use a font to build my website. That isn’t how the law works.

To disable loading of google fonts by Elementor simply use the provided elementor/frontend/print_google_fonts filter hook.

add_filter( 'elementor/frontend/print_google_fonts', '__return_false' );

This all could have been avoided…

• This reply was modified 6 years, 7 months ago by Bainternet.
• This reply was modified 6 years, 7 months ago by Bainternet.