Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

Bavaria: BayLfD issues statement on data protection considerations for use of web fonts

The Bavarian data protection authority ('BayLfD') published, on 1 March 2022, a statement addressing data protection considerations regarding the use of web fonts. In particular, the BayLfD's statement clarifies what web fonts are, how they may be integrated into a website, and the appropriate legal basis for their use. Furthermore, the BayLfD specified that with regards to the integration of web fonts on websites, the website operator is to be regarded as a controller within the meaning of Article 4(7) of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'), since they co-decide on the means and purposes of data processing and with the external embedding of third-party services, such as web fonts, in the website, they causes the third-party provider to receive personal data from users. In this regard, the BayLfD noted that the website operator's responsibility is limited to the collection and transmission of user data, because they can only determine the means and purposes of processing in that respect.

Moreover, the BayLfD further highlighted that for the integration of external fonts:

  • no data (IP addresses) may be transmitted to third-party servers before consent has been given by means of a consent banner or a consent management platform; and
  • it must be clearly stated which data (e.g. the IP address) is being processed, to whom (name of the third-party provider) it is being transmitted, and for what purpose.

Notably, the BayLfD stated that for data protection purposes, the simplest solution would be to integrate fonts into a website through 'self-hosting' rather than 'external hosting'. 

You can read the statement, only available in German, here.