Serving fonts from our own server

One line, one transmission

Web fonts are usually embedded by referring to a provider’s server. That is one line in the head of the document — and with it, every visitor’s browser requests the font file from there. In making that request it necessarily transmits the device’s IP address, the address of the page being viewed and details about the browser. The site operator sees none of it. The transmission happens in the browser while the page is still being built, and a consent banner comes too late for it: it has already happened by the time the banner appears.

The judgment

Munich Regional Court I ruled on 20 January 2022 (case no. 3 O 17493/20) that dynamically embedding Google Fonts, and the transfer of the IP address to the USA that this entails, violates the general right of personality when done without consent. It awarded the claimant damages.

The judgment is a first-instance decision and binds no other court. It had its effect regardless — as the template for a wave of warning letters that reached a large number of site operators in the same year. Anyone embedding a third-party font has since been negotiating about more than typography.

The build decision

This site loads no font from a third-party server. The files sit where the site itself sits and are served from there. There is no request to a font provider, so no IP address arrives at one, and consequently there is nothing to consent to.

That costs nothing. Self-served fonts need no connection to a second server, which makes them load faster rather than slower, and they do not fail when that second server does.

Why it is checked rather than claimed

A promise about the resources a page loads goes stale quietly: one inserted component that brings its own font is enough, and the promise no longer holds — without anyone noticing. So after every change, the build of this site checks the finished output for any resource requested from a third-party host. If the check fires, no deployable build exists.

That is the difference between a privacy promise and a way of building: one lives in a text, the other in a condition a deploy fails on.