Why it matters
In January 2022 a Munich court (Landgericht München I, case 3 O 17493/20) ruled that a site passing a visitor's IP address to Google through embedded Google Fonts, without consent, breached GDPR, and awarded the visitor 100 euros. A wave of demand letters followed in Germany. The fix is easy and makes your site faster, so it's worth doing anyway.
How Patch checks
We look for requests to fonts.googleapis.com and fonts.gstatic.com when your page first loads.
How to fix it
- Download the fonts you use and serve them from your own domain. Tools like google-webfonts-helper or Fontsource make this quick.
- Remove the <link> to fonts.googleapis.com and any @import of it in your CSS.
- Reload with the network tab open and check nothing goes to fonts.gstatic.com.
Your own report goes further: it names the exact pages, services and settings Patch found on your site, and with a full report you get a fix prompt to paste into Lovable, Bolt or Cursor.
Where this applies
A German court ruling under the EU GDPR. It binds only that case, but the reasoning applies anywhere the GDPR does.