Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

Lower Saxony: LfD Niedersachsen advises on lawful use of Google Fonts

The Lower Saxony data protection authority ('LfD Niedersachsen') issued, on 24 November 2022, a press release addressing the wave of warnings that had arisen, and the claims asserted, against the use of Google Fonts by website operators, which were triggered by the Munich Regional Court's decision of 20 January 2022 (LG Munich I – 3 O 17493/20). In particular, the LfD Niedersachsen stated that the decision saw the court award the plaintiff €100 in damages for the use of Google Fonts in violation of data protection in civil proceedings. In this regard, the LfD Niedersachsen clarified that Google Inc. offers fonts for the design of websites via Google Fonts, a service used on many websites, where there are two different ways of technically integrating the service.

More specifically, the LfD Niedersachsen explained that Google Fonts can either be integrated online, whereby the fonts are loaded from Google servers when the website is accessed and the website user's personal data is automatically transmitted to Google in the US, or alternatively, the fonts used on the website can be downloaded and stored locally on the website user's own server, which is the variant that complies with data protection regulations and is the approach recommended by the LfD Niedersachsen. Furthermore, the LfD Niedersachsen stated that operators of websites who have received a warning letter or claim due to their use of Google Fonts should check whether they:

  • are the provider and data protection officer ('DPO') of the website mentioned in the letter/claim;
  • have Google Fonts integrated on the website concerned;
  • have Google Fonts integrated online; and
  • have obtained effective consent from users in accordance with Section 25(1) of the Federal Act on the Regulation of Data Protection and Privacy in Telecommunications and Telemedia ('TTDSG') and Article 6(1)(a) of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR') for the use of Google Fonts.

Moreover, the LfD Niedersachsen highlighted that, when examining websites, it regularly finds violations of the law, in particular with regard to the integration of third-party services, noting that warning letters/claims can only be safely avoided if the legal requirements of the TTDSG and the GDPR are observed when designing websites.

You can read the press release, only available in German, here.